Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7: Win64/Alureon.gen!A Virus


  • This topic is locked This topic is locked
8 replies to this topic

#1 fallenferret

fallenferret

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:38 AM

Posted 21 May 2014 - 08:33 PM

I have been cleaning virus's out of my computer for some time now, and Came across the Alureon.gen virus  Windows defender asked me to download Windows defender online, I did that and once it removed the Virus I have been stuck in a boot loop. Windows will not load past the Starting windows screen. I Downloaded FRST64 and ran the program, im wondering if someone can look at my frst.txt file and help me.
 
 
Thanks
Chris
 
 txt File
---------------------------------------------------------------------------------------------------------------------------------------------------------
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by SYSTEM on MININT-4P2MQ07 on 21-05-2014 21:21:34
Running from F:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Recovery
 
The current controlset is ControlSet004
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
 
 
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463080 2012-01-16] (Realtek Semiconductor)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-16] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\suzette\...\Run: [Omiga Plus] => C:\Program Files (x86)\Omiga Plus\omigaplus.exe [1361576 2013-09-30] (Taiwan Shui Mu Chih Ching Technology Limited.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 
==================== Services (Whitelisted) =================
 
S2 MgAssistService; C:\Program Files (x86)\Mobogenie\MgAssist.exe [63168 2014-01-09] ()
S2 omigaplussvc; C:\Program Files (x86)\Omiga Plus\omigaplusSvc.exe [424104 2013-09-30] (Taiwan Shui Mu Chih Ching Technology Limited.)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [73728 2012-02-07] (Atheros)
S4 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [X]
 
==================== Drivers (Whitelisted) ====================
 
S5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
S1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-03-03] (AVG Technologies)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-10] (MCCI Corporation)
S1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61120 2014-03-18] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 vzandnetadb; System32\Drivers\lgvzandnetadb.sys [X]
S3 vzandnetdiag; system32\DRIVERS\lgvzandnetdiag64.sys [X]
S3 vzandnetdiag2; system32\DRIVERS\lgvzandnetdiag264.sys [X]
S3 vzandnetmodem; system32\DRIVERS\lgvzandnetmdm64.sys [X]
S3 vzandnetndis; system32\DRIVERS\lgvzandnetndis64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-05-21 21:21 - 2014-05-21 21:21 - 00000000 ____D () C:\FRST
2014-05-21 09:04 - 2014-05-21 15:04 - 00000000 ____D () C:\Windows\Microsoft Antimalware
2014-05-21 05:27 - 2014-05-21 14:23 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-21 04:35 - 2014-05-21 14:23 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-21 04:23 - 2014-05-21 04:23 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-20 20:51 - 2014-05-20 20:51 - 00000000 ____D () C:\Windows\CheckSur
2014-05-20 20:43 - 2014-05-20 20:49 - 551293744 _____ () C:\Users\suzette\Downloads\Windows6.1-KB947821-v33-x64.msu
2014-05-20 17:47 - 2014-05-05 20:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-20 17:47 - 2014-05-05 20:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-20 17:47 - 2014-05-05 19:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-20 17:47 - 2014-05-05 19:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-20 17:47 - 2014-05-05 19:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-20 17:47 - 2014-05-05 18:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-20 11:55 - 2014-05-20 11:55 - 00021786 _____ () C:\ComboFix.txt
2014-05-20 07:44 - 2014-05-20 07:44 - 00270384 _____ () C:\Windows\Minidump\052014-24960-01.dmp
2014-05-20 07:35 - 2014-05-20 07:35 - 00278976 _____ () C:\Windows\Minidump\052014-26442-01.dmp
2014-05-20 07:22 - 2014-05-20 07:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieUserList
2014-05-20 07:22 - 2014-05-20 07:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieSiteList
2014-05-20 07:19 - 2014-05-20 07:19 - 00000000 ____D () C:\Program Files (x86)\Windows Kits
2014-05-20 07:17 - 2014-05-20 07:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-20 07:13 - 2014-05-20 07:13 - 00997536 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\sdksetup.exe
2014-05-20 06:59 - 2014-05-20 06:59 - 00270384 _____ () C:\Windows\Minidump\052014-21231-01.dmp
2014-05-20 06:52 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-20 06:52 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-20 06:52 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-20 06:52 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-20 06:52 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-20 06:52 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-20 06:52 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-20 06:52 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-20 06:51 - 2014-05-20 11:55 - 00000000 ____D () C:\Qoobox
2014-05-20 06:51 - 2014-05-20 11:54 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 06:48 - 2014-05-20 06:48 - 05200426 ____R (Swearware) C:\Users\suzette\Downloads\ComboFix.exe
2014-05-20 06:42 - 2014-05-20 06:42 - 00278976 _____ () C:\Windows\Minidump\052014-26083-01.dmp
2014-05-20 06:38 - 2014-05-20 06:38 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-20 06:38 - 2014-05-04 13:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-05-20 06:35 - 2014-05-20 06:35 - 00002021 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-20 06:35 - 2014-05-20 06:35 - 00002021 _____ () C:\ProgramData\Desktop\Adobe Reader X.lnk
2014-05-20 06:30 - 2014-03-06 01:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-05-20 06:30 - 2014-03-06 00:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-05-20 06:30 - 2014-03-06 00:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-05-20 06:30 - 2014-03-06 00:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-05-20 06:30 - 2014-03-06 00:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-05-20 06:30 - 2014-03-06 00:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-05-20 06:30 - 2014-03-06 00:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-05-20 06:30 - 2014-03-06 00:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-05-20 06:30 - 2014-03-06 00:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-20 06:30 - 2014-03-05 23:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-05-20 06:30 - 2014-03-05 23:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-05-20 06:30 - 2014-03-05 23:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-20 06:30 - 2014-03-05 23:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-05-20 06:30 - 2014-03-05 23:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-20 06:30 - 2014-03-05 23:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-20 06:30 - 2014-03-05 23:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-05-20 06:30 - 2014-03-05 23:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-20 06:30 - 2014-03-05 23:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-20 06:30 - 2014-03-05 22:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-20 06:29 - 2014-03-06 00:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-05-20 06:29 - 2014-03-06 00:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-05-20 06:29 - 2014-03-06 00:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-05-20 06:29 - 2014-03-06 00:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-05-20 06:29 - 2014-03-06 00:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-05-20 06:29 - 2014-03-06 00:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-05-20 06:29 - 2014-03-06 00:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-05-20 06:29 - 2014-03-06 00:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-20 06:29 - 2014-03-06 00:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-20 06:29 - 2014-03-05 23:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-20 06:29 - 2014-03-05 23:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-20 06:29 - 2014-03-05 23:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-20 06:29 - 2014-03-05 23:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-20 06:29 - 2014-03-05 23:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-20 06:29 - 2014-03-05 23:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-20 06:29 - 2014-03-05 23:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-05-20 06:29 - 2014-03-05 22:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-05-20 06:29 - 2014-03-05 22:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-20 06:29 - 2014-03-05 22:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-20 06:29 - 2014-03-05 22:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-05-20 06:29 - 2014-03-05 21:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-05-20 06:29 - 2014-03-05 21:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-05-20 06:29 - 2014-03-05 21:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-20 06:29 - 2014-03-05 21:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-20 06:29 - 2014-03-05 21:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-19 23:02 - 2014-05-19 23:02 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-19 20:55 - 2014-05-08 22:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-19 20:55 - 2014-05-08 22:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-19 20:55 - 2014-03-24 18:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-05-19 20:55 - 2014-03-24 18:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-19 20:20 - 2014-05-20 07:46 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-05-19 20:20 - 2014-05-19 20:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-19 20:20 - 2014-05-19 20:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-19 20:20 - 2014-04-03 05:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-05-19 20:20 - 2014-04-03 05:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-05-19 20:20 - 2014-04-03 05:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-05-19 20:19 - 2014-05-19 20:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\suzette\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-19 19:52 - 2014-05-19 19:52 - 00270384 _____ () C:\Windows\Minidump\051914-28438-01.dmp
2014-05-19 19:24 - 2014-05-19 19:24 - 00000000 ____D () C:\Program Files (x86)\Roblox
 
==================== One Month Modified Files and Folders =======
 
2014-05-21 21:21 - 2014-05-21 21:21 - 00000000 ____D () C:\FRST
2014-05-21 15:04 - 2014-05-21 09:04 - 00000000 ____D () C:\Windows\Microsoft Antimalware
2014-05-21 14:23 - 2014-05-21 05:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-21 14:23 - 2014-05-21 04:35 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-21 14:23 - 2012-12-25 04:26 - 00000000 ____D () C:\users\suzette
2014-05-21 14:23 - 2012-11-29 01:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-21 14:22 - 2012-11-29 01:36 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-05-21 14:22 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2014-05-21 05:06 - 2012-11-29 01:48 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-05-21 05:06 - 2012-11-29 01:48 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-05-21 04:24 - 2012-11-29 01:16 - 01653585 _____ () C:\Windows\WindowsUpdate.log
2014-05-21 04:23 - 2014-05-21 04:23 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-21 04:23 - 2013-10-07 20:10 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-21 04:22 - 2013-09-30 18:16 - 00000000 ____D () C:\Program Files (x86)\Omiga Plus
2014-05-21 04:22 - 2012-11-29 01:18 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 21:23 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-05-20 20:52 - 2013-10-07 20:10 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-20 20:51 - 2014-05-20 20:51 - 00000000 ____D () C:\Windows\CheckSur
2014-05-20 20:49 - 2014-05-20 20:43 - 551293744 _____ () C:\Users\suzette\Downloads\Windows6.1-KB947821-v33-x64.msu
2014-05-20 20:36 - 2009-07-13 20:45 - 00021296 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 20:36 - 2009-07-13 20:45 - 00021296 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 20:34 - 2009-07-13 21:13 - 00788772 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-20 20:28 - 2013-08-27 22:24 - 00032080 _____ () C:\Windows\setupact.log
2014-05-20 20:28 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 20:17 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-20 15:34 - 2012-11-29 03:12 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-05-20 15:26 - 2013-10-01 00:07 - 00724254 _____ () C:\Windows\PFRO.log
2014-05-20 11:55 - 2014-05-20 11:55 - 00021786 _____ () C:\ComboFix.txt
2014-05-20 11:55 - 2014-05-20 06:51 - 00000000 ____D () C:\Qoobox
2014-05-20 11:54 - 2014-05-20 06:51 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 11:53 - 2009-07-13 18:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-20 11:52 - 2013-11-05 16:24 - 00000000 ____D () C:\Program Files (x86)\Uniblue
2014-05-20 07:46 - 2014-05-19 20:20 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-05-20 07:44 - 2014-05-20 07:44 - 00270384 _____ () C:\Windows\Minidump\052014-24960-01.dmp
2014-05-20 07:44 - 2013-05-10 18:53 - 418082860 _____ () C:\Windows\MEMORY.DMP
2014-05-20 07:44 - 2013-05-10 18:53 - 00000000 ____D () C:\Windows\Minidump
2014-05-20 07:35 - 2014-05-20 07:35 - 00278976 _____ () C:\Windows\Minidump\052014-26442-01.dmp
2014-05-20 07:22 - 2014-05-20 07:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieUserList
2014-05-20 07:22 - 2014-05-20 07:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieSiteList
2014-05-20 07:19 - 2014-05-20 07:19 - 00000000 ____D () C:\Program Files (x86)\Windows Kits
2014-05-20 07:19 - 2014-05-20 07:17 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-20 07:13 - 2014-05-20 07:13 - 00997536 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\sdksetup.exe
2014-05-20 06:59 - 2014-05-20 06:59 - 00270384 _____ () C:\Windows\Minidump\052014-21231-01.dmp
2014-05-20 06:48 - 2014-05-20 06:48 - 05200426 ____R (Swearware) C:\Users\suzette\Downloads\ComboFix.exe
2014-05-20 06:42 - 2014-05-20 06:42 - 00278976 _____ () C:\Windows\Minidump\052014-26083-01.dmp
2014-05-20 06:38 - 2014-05-20 06:38 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-20 06:35 - 2014-05-20 06:35 - 00002021 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-20 06:35 - 2014-05-20 06:35 - 00002021 _____ () C:\ProgramData\Desktop\Adobe Reader X.lnk
2014-05-19 23:02 - 2014-05-19 23:02 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-19 21:50 - 2013-10-07 20:10 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-19 21:50 - 2013-10-07 20:10 - 00002185 _____ () C:\ProgramData\Desktop\Google Chrome.lnk
2014-05-19 20:56 - 2012-11-29 01:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-19 20:56 - 2012-11-29 01:18 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-19 20:56 - 2012-11-29 01:18 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-19 20:48 - 2013-10-07 20:10 - 00003896 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-19 20:47 - 2013-10-07 20:10 - 00003644 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-19 20:46 - 2014-01-20 11:51 - 00000000 ____D () C:\Program Files (x86)\Registry Dr
2014-05-19 20:46 - 2013-08-13 20:28 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-05-19 20:46 - 2013-08-13 20:27 - 00000000 ____D () C:\AI_RecycleBin
2014-05-19 20:45 - 2014-02-05 03:35 - 00003458 _____ () C:\Windows\System32\Tasks\RegistryDr_Popup
2014-05-19 20:45 - 2014-01-20 11:51 - 00000000 ____D () C:\Users\suzette\Documents\RegistryDr
2014-05-19 20:40 - 2014-02-10 18:35 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-05-19 20:40 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\security
2014-05-19 20:39 - 2014-01-20 11:50 - 00000000 ____D () C:\Users\suzette\AppData\Local\genienext
2014-05-19 20:39 - 2014-01-20 11:49 - 00000000 ____D () C:\Program Files (x86)\TidyNetwork
2014-05-19 20:39 - 2014-01-08 00:00 - 00000000 ____D () C:\ProgramData\WPM
2014-05-19 20:39 - 2013-09-15 00:00 - 00000000 ____D () C:\ProgramData\BitGuard
2014-05-19 20:39 - 2013-09-02 19:47 - 00000000 ____D () C:\Users\suzette\AppData\Roaming\Iminent
2014-05-19 20:39 - 2013-09-02 19:47 - 00000000 ____D () C:\ProgramData\Iminent
2014-05-19 20:39 - 2013-04-27 16:27 - 00000000 ____D () C:\Program Files (x86)\SweetIM
2014-05-19 20:20 - 2014-05-19 20:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-19 20:20 - 2014-05-19 20:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-19 20:20 - 2014-05-19 20:19 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\suzette\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-19 20:01 - 2013-12-29 18:01 - 00000000 ____D () C:\Program Files (x86)\Modio
2014-05-19 20:00 - 2014-01-20 11:50 - 00000000 ____D () C:\Users\suzette\AppData\Local\Mobogenie
2014-05-19 20:00 - 2014-01-20 11:50 - 00000000 ____D () C:\Program Files (x86)\Mobogenie
2014-05-19 19:52 - 2014-05-19 19:52 - 00270384 _____ () C:\Windows\Minidump\051914-28438-01.dmp
2014-05-19 19:52 - 2013-10-07 20:11 - 00000000 ____D () C:\Program Files\Google
2014-05-19 19:52 - 2013-04-16 10:28 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-19 19:40 - 2013-10-07 20:10 - 00000000 ____D () C:\ProgramData\Google
2014-05-19 19:40 - 2013-03-23 08:14 - 00000000 ____D () C:\Users\suzette\AppData\Local\Google
2014-05-19 19:24 - 2014-05-19 19:24 - 00000000 ____D () C:\Program Files (x86)\Roblox
2014-05-19 19:24 - 2014-02-09 12:57 - 00000000 ____D () C:\Users\suzette\AppData\Roaming\systweak
2014-05-19 19:21 - 2013-10-19 11:50 - 00000000 ____D () C:\Program Files (x86)\OpenDownloaderManager
2014-05-19 19:16 - 2014-02-07 19:10 - 00000000 ____D () C:\Users\suzette\AppData\Local\Torch
2014-05-08 22:14 - 2014-05-19 20:55 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-08 22:11 - 2014-05-19 20:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-05 20:40 - 2014-05-20 17:47 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-05 20:17 - 2014-05-20 17:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-05 19:25 - 2014-05-20 17:47 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 19:07 - 2014-05-20 17:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-05 19:00 - 2014-05-20 17:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-05 18:10 - 2014-05-20 17:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-04 13:12 - 2014-05-20 06:38 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
 
Files to move or delete:
====================
C:\Users\suzette\jagex_cl_oldschool_LIVE.dat
C:\Users\suzette\jagex_cl_runescape_LIVE.dat
C:\Users\suzette\random.dat
 
 
==================== Known DLLs (Whitelisted) ================
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
TDL4: custom:26000022 <===== ATTENTION!
 
==================== Restore Points  =========================
 
Restore point made on: 2014-05-20 06:29:25
Restore point made on: 2014-05-20 06:37:59
Restore point made on: 2014-05-20 15:31:57
Restore point made on: 2014-05-20 17:09:48
Restore point made on: 2014-05-20 17:46:40
Restore point made on: 2014-05-20 17:49:43
Restore point made on: 2014-05-20 17:56:11
Restore point made on: 2014-05-20 18:44:48
Restore point made on: 2014-05-20 20:15:31
Restore point made on: 2014-05-20 20:27:10
Restore point made on: 2014-05-20 20:51:22
Restore point made on: 2014-05-20 23:00:23
Restore point made on: 2014-05-21 04:22:57
Restore point made on: 2014-05-21 04:24:12
Restore point made on: 2014-05-21 05:26:48
 
==================== Memory info =========================== 
 
Percentage of memory in use: 16%
Total physical RAM: 3965.59 MB
Available physical RAM: 3320.71 MB
Total Pagefile: 3963.79 MB
Available Pagefile: 3306.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:453.96 GB) (Free:343.27 GB) NTFS
Drive d: (Win7_sp1_32-64_EN-faXcooL) (CDROM) (Total:4.22 GB) (Free:0 GB) UDF
Drive e: (RECOVERY) (Fixed) (Total:11.76 GB) (Free:4.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]
ATTENTION: Malware custom entry on BCD on drive e: detected.
Drive f: (WDO_MEDIA64) (Removable) (Total:7.44 GB) (Free:7.03 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 91056831)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
 
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 7 GB) (Disk ID: 006C447D)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)
 
 
LastRegBack: 2014-05-19 23:49
 
==================== End Of Log ============================

Edited by Queen-Evie, 21 May 2014 - 09:14 PM.
moved from Am I Infected to Malware Removal Logs. FRST logs are allowed only in MRL. Your other topic with a FRST log was deleted because it was a duplicate


BC AdBot (Login to Remove)

 


#2 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:38 PM

Posted 22 May 2014 - 06:58 AM

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 

 

Don´t you think that there is a reason why everyone tells you not to use Combofix on your own? :rolleyes:

 

 

 

Fix with FRST (Recovery Environment)


  • Open notepad (Start =>All Programs => Accessories => Notepad).
  • Please copy the entire contents of the code box below.
    (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt

    GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
    
    S2 MgAssistService; C:\Program Files (x86)\Mobogenie\MgAssist.exe [63168 2014-01-09] ()
    S2 omigaplussvc; C:\Program Files (x86)\Omiga Plus\omigaplusSvc.exe [424104 2013-09-30] (Taiwan Shui Mu Chih Ching Technology Limited.)
    S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-10] (MCCI Corporation)
    S1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61120 2014-03-18] (StdLib)
    
    C:\Program Files (x86)\Mobogenie
    C:\Program Files (x86)\Omiga Plus
    C:\Windows\System32\DRIVERS\sscdserd.sys
    C:\Windows\System32\drivers\wStLib64.sys
    C:\Users\suzette\jagex_cl_oldschool_LIVE.dat
    C:\Users\suzette\jagex_cl_runescape_LIVE.dat
    C:\Users\suzette\random.dat
    
    TDL4: custom:26000022 <===== ATTENTION!
    
    SaveMbr: drive=0

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Now please enter System Recovery Options again.

  • Run frst.exe (on 64bit, run frst64.exe) and press the Fix button just once and wait.
  • The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

 

 

 

Also upload the MBRDUMP.txt from the same location.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#3 fallenferret

fallenferret
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:38 AM

Posted 22 May 2014 - 08:49 AM

Thank You for the quick Reply.

 

I have done as you requested, here is my Fixlog.txt results

---------------------------------------------------------------------------

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-05-2014
Ran by SYSTEM at 2014-05-22 09:46:06 Run:1
Running from F:\
Boot Mode: Recovery
==============================================
 
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 
S2 MgAssistService; C:\Program Files (x86)\Mobogenie\MgAssist.exe [63168 2014-01-09] ()
S2 omigaplussvc; C:\Program Files (x86)\Omiga Plus\omigaplusSvc.exe [424104 2013-09-30] (Taiwan Shui Mu Chih Ching Technology Limited.)
S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-10] (MCCI Corporation)
S1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61120 2014-03-18] (StdLib)
 
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\Omiga Plus
C:\Windows\System32\DRIVERS\sscdserd.sys
C:\Windows\System32\drivers\wStLib64.sys
C:\Users\suzette\jagex_cl_oldschool_LIVE.dat
C:\Users\suzette\jagex_cl_runescape_LIVE.dat
C:\Users\suzette\random.dat
 
TDL4: custom:26000022 <===== ATTENTION!
 
SaveMbr: drive=0
*****************
 
C:\Windows\System32\GroupPolicy\Machine => Moved successfully.
C:\Windows\System32\GroupPolicy\GPT.ini => Moved successfully.
MgAssistService => Service deleted successfully.
omigaplussvc => Service deleted successfully.
sscdserd => Service deleted successfully.
wStLib64 => Service deleted successfully.
C:\Program Files (x86)\Mobogenie => Moved successfully.
C:\Program Files (x86)\Omiga Plus => Moved successfully.
C:\Windows\System32\DRIVERS\sscdserd.sys => Moved successfully.
C:\Windows\System32\drivers\wStLib64.sys => Moved successfully.
C:\Users\suzette\jagex_cl_oldschool_LIVE.dat => Moved successfully.
C:\Users\suzette\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\suzette\random.dat => Moved successfully.
 
The operation completed successfully.
The operation completed successfully.
MBRDUMP.txt is made successfully.
 
==== End of Fixlog ====
 
 
And here is my MBRDUMP.txt
------------------------------------------------------------------
3ÀŽÐ¼ |ŽÀŽØ¾ |¿ ¹ üó¤PhËû¹ ½¾€~  |…ƒÅâñ͈V UÆFÆF ´A»ªUÍ]rûUªu ÷Á tþFf`€~ t&fh    fÿvh  h |h h ´BŠV ‹ôÍŸƒÄžë¸» |ŠV ŠvŠNŠnÍfasþNu€~ €„Š ²€ë„U2äŠV Í]ëž>þ}Uªunÿv è uú°Ñædèƒ °ßæ`è| °ÿædèu û¸ »Íf#Àu;fûTCPAu2ùr,fh»  fh  fh   fSfSfUfh    fh |  fah  ÍZ2öê |  Í ·ë ¶ë µ2ä ‹ð¬< t » ´Íëòôëý+Éädë $àø$ÃInvalid partition table Error loading operating system Missing operating system   c{š1h‘   Þ??   †9 €þÿÿ @  Px þÿÿþÿÿ y Ⱦ8                Uª


#4 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:38 PM

Posted 22 May 2014 - 10:37 AM

Please attach MBRDump.txt.

 

Then try to boot into windows...

 

 

Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)

  • Run FRST.
  • Don´t change one of the checkboxes and hit Scan.
  • Logfiles are created on your desktop.
  • Poste the FRST.txt and (after the first scan only!) the Addition.txt.

 

 

 

Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.

  • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Show All ( should be unchecked by default )
  • Leave everything else as it is.
  • Close all other running programs as well as your Browser.
  • Click the Scan button & wait for it to finish.
  • Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.
  • Please post the content of the ark.txt here.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#5 fallenferret

fallenferret
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:38 AM

Posted 22 May 2014 - 01:53 PM

i have done as you asked.

 

Frst.txt
___________________________________

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by suzette (administrator) on SUZETTE-PC on 22-05-2014 14:44:24
Running from C:\Users\suzette\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463080 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-16] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4140096594-4005692477-1792498084-1000\...\Run: [Omiga Plus] => "C:\Program Files (x86)\Omiga Plus\omigaplus.exe" /autorun
 
==================== Internet (Whitelisted) ====================
 
ProxyServer: http=127.0.0.1:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4D8ADA80E073CF01
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NIS&pvid=21.1.0.18
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchURL = http://home.microsoft.com/access/autosearch.asp?p=%s
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDCJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDCJS
SearchScopes: HKLM-x32 - DefaultScope {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDCJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDCJS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DownloadTerms - {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} - C:\Users\suzette\AppData\Local\DownloadTerms\temp.dat No File
BHO-x32: Fast Free Converter 3.0 - {304E71B8-633E-4C36-996A-7D21D9D1518F} - C:\PROGRA~2\FASTFR~1\FASTFR~1\FASTFR~1.DLL No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: GetSavin 5.0 - {D62032F9-ED80-4046-AC04-779FB3A48E40} - C:\Users\suzette\AppData\Local\getsavin\ie\getsavin_1376408410.dll No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 
FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
 
Chrome: 
=======
CHR Extension: (Norton Identity Protection) - C:\Users\suzette\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-10-12]
CHR Extension: (Google Wallet) - C:\Users\suzette\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-12]
CHR HKCU\...\Chrome\Extension: [neebgdeaohaofdhldpobdpfocdonmgki] - C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx [2013-04-25]
CHR HKLM-x32\...\Chrome\Extension: [neebgdeaohaofdhldpobdpfocdonmgki] - C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx [2013-04-25]
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\suzette\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx [2013-04-25]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
==================== Services (Whitelisted) =================
 
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [73728 2012-02-08] (Atheros)
S4 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S2 vToolbarUpdater15.5.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [X]
 
==================== Drivers (Whitelisted) ====================
 
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-03-03] (AVG Technologies)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 vzandnetadb; System32\Drivers\lgvzandnetadb.sys [X]
S3 vzandnetdiag; system32\DRIVERS\lgvzandnetdiag64.sys [X]
S3 vzandnetdiag2; system32\DRIVERS\lgvzandnetdiag264.sys [X]
S3 vzandnetmodem; system32\DRIVERS\lgvzandnetmdm64.sys [X]
S3 vzandnetndis; system32\DRIVERS\lgvzandnetndis64.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-05-22 14:44 - 2014-05-22 14:44 - 00011914 _____ () C:\Users\suzette\Desktop\FRST.txt
2014-05-22 14:44 - 2014-05-22 14:43 - 00380416 _____ () C:\Users\suzette\Desktop\zsx1q340.exe
2014-05-22 14:44 - 2014-05-21 21:13 - 02067456 _____ (Farbar) C:\Users\suzette\Desktop\FRST64.exe
2014-05-22 10:49 - 2014-05-22 10:49 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-05-22 10:47 - 2014-05-22 10:47 - 00002119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-05-22 10:47 - 2014-05-22 10:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-22 10:44 - 2014-05-22 10:45 - 13829304 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\mseinstall.exe
2014-05-22 10:33 - 2014-05-22 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-22 10:14 - 2014-05-22 10:14 - 00279000 _____ () C:\Windows\Minidump\052214-15100-01.dmp
2014-05-22 01:21 - 2014-05-22 14:44 - 00000000 ____D () C:\FRST
2014-05-21 13:04 - 2014-05-21 19:04 - 00000000 ____D () C:\Windows\Microsoft Antimalware
2014-05-21 09:27 - 2014-05-22 10:32 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-21 08:35 - 2014-05-22 10:47 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-21 08:23 - 2014-05-21 08:23 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-21 00:51 - 2014-05-21 00:51 - 00000000 ____D () C:\Windows\CheckSur
2014-05-21 00:43 - 2014-05-21 00:49 - 551293744 _____ () C:\Users\suzette\Downloads\Windows6.1-KB947821-v33-x64.msu
2014-05-20 21:47 - 2014-05-06 00:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-20 21:47 - 2014-05-06 00:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-20 21:47 - 2014-05-05 23:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-20 21:47 - 2014-05-05 23:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-20 21:47 - 2014-05-05 23:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-20 21:47 - 2014-05-05 22:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-20 15:55 - 2014-05-20 15:55 - 00021786 _____ () C:\ComboFix.txt
2014-05-20 11:44 - 2014-05-20 11:44 - 00270384 _____ () C:\Windows\Minidump\052014-24960-01.dmp
2014-05-20 11:35 - 2014-05-20 11:35 - 00278976 _____ () C:\Windows\Minidump\052014-26442-01.dmp
2014-05-20 11:22 - 2014-05-20 11:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieUserList
2014-05-20 11:22 - 2014-05-20 11:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieSiteList
2014-05-20 11:19 - 2014-05-20 11:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2014-05-20 11:19 - 2014-05-20 11:19 - 00000000 ____D () C:\Program Files (x86)\Windows Kits
2014-05-20 11:17 - 2014-05-20 11:19 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-20 11:13 - 2014-05-20 11:13 - 00997536 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\sdksetup.exe
2014-05-20 10:59 - 2014-05-20 10:59 - 00270384 _____ () C:\Windows\Minidump\052014-21231-01.dmp
2014-05-20 10:52 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-20 10:52 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-20 10:52 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-20 10:52 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-20 10:52 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-20 10:52 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-20 10:52 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-20 10:52 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-20 10:51 - 2014-05-20 15:55 - 00000000 ____D () C:\Qoobox
2014-05-20 10:51 - 2014-05-20 15:54 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 10:42 - 2014-05-20 10:42 - 00278976 _____ () C:\Windows\Minidump\052014-26083-01.dmp
2014-05-20 10:38 - 2014-05-20 10:38 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-20 10:38 - 2014-05-04 17:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-20 10:35 - 2014-05-20 10:35 - 00002021 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-20 10:30 - 2014-03-06 05:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-20 10:30 - 2014-03-06 04:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-20 10:30 - 2014-03-06 04:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-20 10:30 - 2014-03-06 04:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-20 10:30 - 2014-03-06 04:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-20 10:30 - 2014-03-06 04:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-20 10:30 - 2014-03-06 04:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-20 10:30 - 2014-03-06 04:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-20 10:30 - 2014-03-06 04:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-20 10:30 - 2014-03-06 03:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-20 10:30 - 2014-03-06 03:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-20 10:30 - 2014-03-06 03:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-20 10:30 - 2014-03-06 03:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-20 10:30 - 2014-03-06 03:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-20 10:30 - 2014-03-06 03:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-20 10:30 - 2014-03-06 03:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-20 10:30 - 2014-03-06 03:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-20 10:30 - 2014-03-06 03:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-20 10:30 - 2014-03-06 02:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-20 10:29 - 2014-03-06 04:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-20 10:29 - 2014-03-06 04:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-20 10:29 - 2014-03-06 04:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-20 10:29 - 2014-03-06 04:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-20 10:29 - 2014-03-06 04:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-20 10:29 - 2014-03-06 04:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-20 10:29 - 2014-03-06 04:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-20 10:29 - 2014-03-06 04:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-20 10:29 - 2014-03-06 04:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-20 10:29 - 2014-03-06 03:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-20 10:29 - 2014-03-06 03:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-20 10:29 - 2014-03-06 03:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-20 10:29 - 2014-03-06 03:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-20 10:29 - 2014-03-06 03:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-20 10:29 - 2014-03-06 03:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-20 10:29 - 2014-03-06 03:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-20 10:29 - 2014-03-06 02:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-20 10:29 - 2014-03-06 02:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-20 10:29 - 2014-03-06 02:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-20 10:29 - 2014-03-06 02:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-20 10:29 - 2014-03-06 01:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-20 10:29 - 2014-03-06 01:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-20 10:29 - 2014-03-06 01:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-20 10:29 - 2014-03-06 01:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-20 10:29 - 2014-03-06 01:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-20 03:02 - 2014-05-20 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-20 00:55 - 2014-05-09 02:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-20 00:55 - 2014-05-09 02:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-20 00:55 - 2014-03-24 22:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-20 00:55 - 2014-03-24 22:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-20 00:20 - 2014-05-20 11:46 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-20 00:20 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-20 00:20 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-20 00:20 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-20 00:19 - 2014-05-20 00:20 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\suzette\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-19 23:52 - 2014-05-19 23:52 - 00270384 _____ () C:\Windows\Minidump\051914-28438-01.dmp
2014-05-19 23:24 - 2014-05-19 23:24 - 00000000 ____D () C:\Program Files (x86)\Roblox
 
==================== One Month Modified Files and Folders =======
 
2014-05-22 14:44 - 2014-05-22 14:44 - 00011914 _____ () C:\Users\suzette\Desktop\FRST.txt
2014-05-22 14:44 - 2014-05-22 01:21 - 00000000 ____D () C:\FRST
2014-05-22 14:43 - 2014-05-22 14:44 - 00380416 _____ () C:\Users\suzette\Desktop\zsx1q340.exe
2014-05-22 14:43 - 2013-08-28 02:24 - 00033098 _____ () C:\Windows\setupact.log
2014-05-22 14:40 - 2013-10-08 00:10 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-22 14:40 - 2012-11-29 05:18 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-22 14:40 - 2012-11-29 05:16 - 01910174 _____ () C:\Windows\WindowsUpdate.log
2014-05-22 13:46 - 2009-07-13 23:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-05-22 11:09 - 2009-07-14 00:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-22 11:09 - 2009-07-14 00:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-22 11:06 - 2009-07-14 01:13 - 00788772 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-22 11:03 - 2013-10-08 00:10 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-22 11:03 - 2012-11-29 05:48 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-05-22 11:03 - 2012-11-29 05:48 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-05-22 11:03 - 2012-11-29 05:36 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-05-22 11:02 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 10:49 - 2014-05-22 10:49 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-05-22 10:47 - 2014-05-22 10:47 - 00002119 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-05-22 10:47 - 2014-05-22 10:47 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-05-22 10:47 - 2014-05-21 08:35 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-05-22 10:45 - 2014-05-22 10:44 - 13829304 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\mseinstall.exe
2014-05-22 10:35 - 2009-07-14 01:08 - 00032598 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-22 10:33 - 2014-05-22 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-22 10:32 - 2014-05-21 09:27 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-22 10:32 - 2012-11-29 05:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-22 10:14 - 2014-05-22 10:14 - 00279000 _____ () C:\Windows\Minidump\052214-15100-01.dmp
2014-05-22 10:14 - 2014-02-10 22:35 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-05-22 10:14 - 2013-05-10 22:53 - 333006492 _____ () C:\Windows\MEMORY.DMP
2014-05-22 10:14 - 2013-05-10 22:53 - 00000000 ____D () C:\Windows\Minidump
2014-05-22 10:14 - 2013-05-04 11:22 - 00000008 __RSH () C:\Users\suzette\ntuser.pol
2014-05-22 10:14 - 2012-12-25 08:26 - 00000000 ____D () C:\Users\suzette
2014-05-21 21:13 - 2014-05-22 14:44 - 02067456 _____ (Farbar) C:\Users\suzette\Desktop\FRST64.exe
2014-05-21 19:04 - 2014-05-21 13:04 - 00000000 ____D () C:\Windows\Microsoft Antimalware
2014-05-21 18:22 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\registration
2014-05-21 08:23 - 2014-05-21 08:23 - 00000000 ___HT () C:\Windows\wusa.lock
2014-05-21 01:23 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2014-05-21 00:51 - 2014-05-21 00:51 - 00000000 ____D () C:\Windows\CheckSur
2014-05-21 00:49 - 2014-05-21 00:43 - 551293744 _____ () C:\Users\suzette\Downloads\Windows6.1-KB947821-v33-x64.msu
2014-05-21 00:21 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-21 00:17 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-20 19:34 - 2012-11-29 07:12 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-05-20 19:26 - 2013-10-01 04:07 - 00724254 _____ () C:\Windows\PFRO.log
2014-05-20 15:55 - 2014-05-20 15:55 - 00021786 _____ () C:\ComboFix.txt
2014-05-20 15:55 - 2014-05-20 10:51 - 00000000 ____D () C:\Qoobox
2014-05-20 15:54 - 2014-05-20 10:51 - 00000000 ____D () C:\Windows\erdnt
2014-05-20 15:53 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-20 15:52 - 2013-11-05 20:24 - 00000000 ____D () C:\Program Files (x86)\Uniblue
2014-05-20 11:46 - 2014-05-20 00:20 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-20 11:44 - 2014-05-20 11:44 - 00270384 _____ () C:\Windows\Minidump\052014-24960-01.dmp
2014-05-20 11:35 - 2014-05-20 11:35 - 00278976 _____ () C:\Windows\Minidump\052014-26442-01.dmp
2014-05-20 11:22 - 2014-05-20 11:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieUserList
2014-05-20 11:22 - 2014-05-20 11:22 - 00000000 __SHD () C:\Users\suzette\AppData\Local\EmieSiteList
2014-05-20 11:19 - 2014-05-20 11:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2014-05-20 11:19 - 2014-05-20 11:19 - 00000000 ____D () C:\Program Files (x86)\Windows Kits
2014-05-20 11:19 - 2014-05-20 11:17 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-20 11:13 - 2014-05-20 11:13 - 00997536 _____ (Microsoft Corporation) C:\Users\suzette\Downloads\sdksetup.exe
2014-05-20 10:59 - 2014-05-20 10:59 - 00270384 _____ () C:\Windows\Minidump\052014-21231-01.dmp
2014-05-20 10:42 - 2014-05-20 10:42 - 00278976 _____ () C:\Windows\Minidump\052014-26083-01.dmp
2014-05-20 10:38 - 2014-05-20 10:38 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-20 10:35 - 2014-05-20 10:35 - 00002021 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-05-20 10:35 - 2012-11-29 05:46 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-20 10:22 - 2012-12-25 08:29 - 00000000 ___RD () C:\Users\suzette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-20 10:22 - 2012-12-25 08:29 - 00000000 ___RD () C:\Users\suzette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-20 03:02 - 2014-05-20 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-20 01:50 - 2013-10-08 00:10 - 00002185 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-20 00:56 - 2012-11-29 05:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-20 00:56 - 2012-11-29 05:18 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-20 00:56 - 2012-11-29 05:18 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-20 00:48 - 2013-10-08 00:10 - 00003896 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-20 00:47 - 2013-10-08 00:10 - 00003644 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-20 00:46 - 2014-01-20 15:51 - 00000000 ____D () C:\Program Files (x86)\Registry Dr
2014-05-20 00:46 - 2013-08-14 00:28 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-05-20 00:46 - 2013-08-14 00:27 - 00000000 ____D () C:\AI_RecycleBin
2014-05-20 00:45 - 2014-02-05 07:35 - 00003458 _____ () C:\Windows\System32\Tasks\RegistryDr_Popup
2014-05-20 00:45 - 2014-01-20 15:51 - 00000000 ____D () C:\Users\suzette\Documents\RegistryDr
2014-05-20 00:40 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\security
2014-05-20 00:39 - 2014-01-20 15:50 - 00000000 ____D () C:\Users\suzette\AppData\Local\genienext
2014-05-20 00:39 - 2014-01-20 15:49 - 00000000 ____D () C:\Program Files (x86)\TidyNetwork
2014-05-20 00:39 - 2014-01-08 04:00 - 00000000 ____D () C:\ProgramData\WPM
2014-05-20 00:39 - 2013-09-15 04:00 - 00000000 ____D () C:\ProgramData\BitGuard
2014-05-20 00:39 - 2013-09-02 23:47 - 00000000 ____D () C:\Users\suzette\AppData\Roaming\Iminent
2014-05-20 00:39 - 2013-09-02 23:47 - 00000000 ____D () C:\ProgramData\Iminent
2014-05-20 00:39 - 2013-04-27 20:27 - 00000000 ____D () C:\Program Files (x86)\SweetIM
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-20 00:20 - 2014-05-20 00:20 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-20 00:20 - 2014-05-20 00:19 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\suzette\Downloads\mbam-setup-2.0.1.1004.exe
2014-05-20 00:01 - 2013-12-29 22:01 - 00000000 ____D () C:\Program Files (x86)\Modio
2014-05-20 00:00 - 2014-01-20 15:50 - 00000000 ____D () C:\Users\suzette\AppData\Local\Mobogenie
2014-05-19 23:52 - 2014-05-19 23:52 - 00270384 _____ () C:\Windows\Minidump\051914-28438-01.dmp
2014-05-19 23:52 - 2013-10-08 00:11 - 00000000 ____D () C:\Program Files\Google
2014-05-19 23:52 - 2013-04-16 14:28 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-19 23:40 - 2013-10-08 00:10 - 00000000 ____D () C:\ProgramData\Google
2014-05-19 23:40 - 2013-03-23 12:14 - 00000000 ____D () C:\Users\suzette\AppData\Local\Google
2014-05-19 23:24 - 2014-05-19 23:24 - 00000000 ____D () C:\Program Files (x86)\Roblox
2014-05-19 23:24 - 2014-02-09 16:57 - 00000000 ____D () C:\Users\suzette\AppData\Roaming\systweak
2014-05-19 23:21 - 2013-10-19 15:50 - 00000000 ____D () C:\Program Files (x86)\OpenDownloaderManager
2014-05-19 23:16 - 2014-02-07 23:10 - 00000000 ____D () C:\Users\suzette\AppData\Local\Torch
2014-05-09 02:14 - 2014-05-20 00:55 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 02:11 - 2014-05-20 00:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 00:40 - 2014-05-20 21:47 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 00:17 - 2014-05-20 21:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 23:25 - 2014-05-20 21:47 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 23:07 - 2014-05-20 21:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-05 23:00 - 2014-05-20 21:47 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 22:10 - 2014-05-20 21:47 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-04 17:12 - 2014-05-20 10:38 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2014-05-20 03:49
 
==================== End Of Log ============================
 
Addition.txt
____________________________________________
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014
Ran by suzette at 2014-05-22 14:44:52
Running from C:\Users\suzette\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
 
==================== Installed Programs ======================
 
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}) (Version: 2.3.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2F72F540-1F60-4266-9506-952B21D6640D}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco Connect (HKLM-x32\...\Cisco Connect) (Version: 1.4.11299.0 - Cisco Consumer Products LLC)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{9DDFE322-6BA0-4F90-8689-D98382492371}) (Version: 2.1.1002.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Support Center (HKLM\...\Dell Support Center) (Version: 3.1.5907.16 - Dell Inc.)
Dell Support Center (Version: 3.1.5907.16 - PC-Doctor, Inc.) Hidden
Dell Wireless Driver Installation (HKLM-x32\...\{451517F1-7E41-400B-AA36-FB7E2563526D}) (Version: 9.0 - Dell)
eBay (HKLM-x32\...\{A8B88634-7F90-402F-B66A-86429755F6A5}) (Version: 1.4.0 - eBay Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
iTunes (HKLM\...\{0225AD21-F3E2-4916-BFF3-65D3F9052582}) (Version: 11.0.2.26 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kits Configuration Installer (x32 Version: 8.100.25984 - Microsoft) Hidden
Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Omiga Plus (HKLM-x32\...\Omiga Plus) (Version: 1.6.6 - Taiwan Shui Mu Chih Ching Technology Limited.)
Optimizer Pro v3.0 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.0 - PC Utilities Pro) <==== ATTENTION
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6554 - Realtek Semiconductor Corp.)
SavetheChildren Reminder by We-Care.com v4.1.26.4 (HKLM-x32\...\{26B4D0E1-6F6D-48DF-8719-80276A259F7E}) (Version: 4.1.26.4 - We-Care.com)
SDK Debuggers (x32 Version: 8.100.26629 - Microsoft Corporation) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SmartPCFix 3.09 (HKLM-x32\...\SmartPCFix_is1) (Version:  - smartpcfix.com, Inc.) <==== ATTENTION
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Software Development Kit EULA (x32 Version: 8.100.25984 - Microsoft Corporations) Hidden
Windows Software Development Kit for Windows 8.1 (HKLM-x32\...\{25981ccc-475f-4b68-850b-89d3fc287ff1}) (Version: 8.100.26695 - Microsoft Corporation)
 
==================== Restore Points  =========================
 
20-05-2014 14:29:22 Windows Update
20-05-2014 14:37:50 Windows Update
20-05-2014 23:31:46 Windows Update
21-05-2014 01:09:42 Windows Update
21-05-2014 01:46:33 Windows Update
21-05-2014 01:49:41 Windows Update
21-05-2014 01:55:46 Windows Update
21-05-2014 02:44:41 Windows Update
21-05-2014 04:15:28 Windows Update
21-05-2014 04:26:53 Windows Update
21-05-2014 04:51:15 Windows Update
21-05-2014 07:00:20 Windows Update
21-05-2014 12:22:54 Windows Update
21-05-2014 12:24:08 Windows Update
21-05-2014 13:26:41 Windows Update
22-05-2014 14:32:07 Windows Update
22-05-2014 14:58:37 Windows Update
 
==================== Hosts content: ==========================
 
2009-07-13 22:34 - 2014-05-20 15:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {04FAD385-24EF-482E-99D4-374F25892519} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {0CFBB707-204C-4052-85CB-A95003B80A66} - System32\Tasks\TidyNetwork Update => C:\Users\suzette\AppData\Local\TidyNetwork\petnupdate.exe
Task: {10F6A5D8-9B88-4AA0-8C80-F972E49E2F47} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {1D614A32-8519-4043-BE66-012B8098CEE7} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe
Task: {22FB2999-1FBF-451F-8B91-4DF092651891} - System32\Tasks\AmiUpdXp => C:\Users\suzette\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: {339B5AC6-0647-4191-84CC-04990A91E7E2} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe
Task: {4CD0B81F-62F6-4C65-A371-78F5B717F1CA} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
Task: {4F9E73D5-78D7-4C62-8D55-9D6FA4A19090} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe
Task: {51403EB5-4080-451D-B0B6-D3F1550CFB99} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-20] (Adobe Systems Incorporated)
Task: {514EAE6D-AB7A-4BC4-9A2C-0A0AC4D8D8BC} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {55F45AAD-2012-458F-BE14-35CEFD73B653} - System32\Tasks\4969 => Wscript.exe C:\Users\suzette\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {60CC39C6-02CF-45E2-90C6-A4B1AB8F8752} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08] (Google Inc.)
Task: {75DDD55A-AA23-4546-8D53-79CA43D1020C} - System32\Tasks\Microsoft\Windows\Maintenance\UP_Scheduler => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {7682FC2D-CB50-4967-89F5-074687D5C630} - System32\Tasks\GC_Scheduler => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {97ED3D72-5354-4566-86D7-E4A5791D6F50} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {994CA860-CC50-43B6-B7B4-289752B366A1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-08] (Google Inc.)
Task: {B46CE138-CF6C-4EC4-A598-0322ECD9CE5E} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {B65CF6F4-3708-4498-8ECE-819471D602D6} - System32\Tasks\GC_Informer => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {BC5586E5-0500-447F-9062-606C243B5B90} - System32\Tasks\MySearchDial => C:\Users\suzette\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {D0427B6F-73ED-4E7D-8EAB-DE4FB4CF64A3} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe <==== ATTENTION
Task: {DD1F24E6-50F8-4701-9D6C-B5E4F96F082A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {EE80AD58-B550-49AC-8766-EDCFE6A941B9} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2012-11-29 06:48 - 2012-03-19 19:09 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-11-29 05:37 - 2012-01-26 23:49 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2013-01-28 15:08 - 2013-01-28 15:08 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-01-28 15:08 - 2013-01-28 15:08 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-15 04:50 - 2014-02-15 04:50 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\00a0b4a9df6e4abf30ae2af3624a77ce\IsdiInterop.ni.dll
2012-11-29 05:34 - 2012-02-01 18:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2012-11-29 05:31 - 2011-12-16 14:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
 
==================== EXE Association (whitelisted) =============
 
 
==================== Disabled items from MSCONFIG ==============
 
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/22/2014 11:03:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/22/2014 10:36:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/22/2014 10:16:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 09:20:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 09:07:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 08:52:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 08:49:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 00:30:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 00:24:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/20/2014 10:47:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (05/22/2014 02:40:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: 
%%-2147024891
 
Error: (05/22/2014 02:40:02 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Function Discovery Resource Publication service terminated with the following error: 
%%-2147024891
 
Error: (05/22/2014 11:04:20 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Digital Delivery Service service terminated unexpectedly.  It has done this 1 time(s).
 
Error: (05/22/2014 11:03:29 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: 
%%-2147024891
 
Error: (05/22/2014 11:03:29 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Function Discovery Resource Publication service terminated with the following error: 
%%-2147024891
 
Error: (05/22/2014 11:02:14 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Computer Browser service terminated with the following error: 
%%1060
 
Error: (05/22/2014 11:02:10 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater15.5.0 service failed to start due to the following error: 
%%2
 
Error: (05/22/2014 11:02:09 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Function Discovery Resource Publication service terminated with the following error: 
%%-2147024891
 
Error: (05/22/2014 11:02:09 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Computer Browser service terminated with the following error: 
%%1060
 
Error: (05/22/2014 11:00:44 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Computer Browser service terminated with the following error: 
%%1060
 
 
Microsoft Office Sessions:
=========================
Error: (05/22/2014 11:03:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/22/2014 10:36:52 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/22/2014 10:16:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 09:20:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 09:07:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 08:52:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 08:49:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 00:30:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/21/2014 00:24:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/20/2014 10:47:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
CodeIntegrity Errors:
===================================
  Date: 2014-05-20 15:51:57.409
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-20 15:51:57.347
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 25%
Total physical RAM: 3965.59 MB
Available physical RAM: 2962.01 MB
Total Pagefile: 7929.37 MB
Available Pagefile: 6252.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:453.96 GB) (Free:342.49 GB) NTFS
Drive d: (Win7_sp1_32-64_EN-faXcooL) (CDROM) (Total:4.22 GB) (Free:0 GB) UDF
Drive e: (WDO_MEDIA64) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 91056831)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)
 
========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 006C447D)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)
 
==================== End Of Log ============================
 
After Running GMER.exe here is my ark.txt log
 
______________________________________________
GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-05-22 14:50:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500DM0 rev.KC45 465.76GB
Running: zsx1q340.exe; Driver: C:\Users\suzette\AppData\Local\Temp\fgdirfow.sys
 
 
---- Threads - GMER 2.1 ----
 
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3344:2320]  000007fefb5a2a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3344:2876]  000007fef0ee4830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3344:3416]  000007fef8af5124
 
---- EOF - GMER 2.1 ----
 
 
 


#6 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:38 PM

Posted 23 May 2014 - 04:17 AM

Add-/remove programms

Click on start-->control panel.

Vista/7: Open Programs and Features
XP: Open add/remove programs

Search for and remove the following programs
 

Optimizer Pro v3.0
SmartPCFix 3.09
SavetheChildren Reminder by We-Care.com v4.1.26.4
Omiga Plus


Close the window.

 

 

 

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 

  • Download the attached fixlist.txt and save it to the location where FRST is saved to.
  • Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

 

 

 

 

Full System Scan with Malwarebytes Antimalware
 

  • If not existing, please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.

If the program is already installed:

  • Run Malwarebytes Antimalware
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

 

 

 

 

Scan file(s) via VirusTotal

Please check the file in the code box via Virustotal

  • Click browse
  • Navigate to the location of MBRDump.txt, highlight it and click open.
  • click Send File.

please be patinet until the file is uploade completely. If you get the message

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

click on Reanalyse. Wait until Current status: Finished appears. Now, copy the link from within your browser´s adress bar and poste it here.

 

Attached Files


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#7 fallenferret

fallenferret
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:38 AM

Posted 23 May 2014 - 09:57 AM

I have done what you asked, Except for the last step. The MBRDump.txt file was never generated. 

 

 

here is my Fixlog

---------------------------------------

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-05-2014
Ran by suzette at 2014-05-23 10:27:08 Run:2
Running from C:\Users\suzette\Desktop
Boot Mode: Safe Mode (with Networking)
==============================================
 
Content of fixlist:
*****************
Task: {04FAD385-24EF-482E-99D4-374F25892519} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {0CFBB707-204C-4052-85CB-A95003B80A66} - System32\Tasks\TidyNetwork Update => C:\Users\suzette\AppData\Local\TidyNetwork\petnupdate.exe
Task: {10F6A5D8-9B88-4AA0-8C80-F972E49E2F47} - System32\Tasks\RegistryDr_Start => C:\Program Files (x86)\Registry Dr\RegistryDr.exe <==== ATTENTION
Task: {22FB2999-1FBF-451F-8B91-4DF092651891} - System32\Tasks\AmiUpdXp => C:\Users\suzette\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: {4CD0B81F-62F6-4C65-A371-78F5B717F1CA} - System32\Tasks\RegistryDr_Popup => C:\Program Files (x86)\Registry Dr\Splash.exe <==== ATTENTION
Task: {514EAE6D-AB7A-4BC4-9A2C-0A0AC4D8D8BC} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {55F45AAD-2012-458F-BE14-35CEFD73B653} - System32\Tasks\4969 => Wscript.exe C:\Users\suzette\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
+Task: {75DDD55A-AA23-4546-8D53-79CA43D1020C} - System32\Tasks\Microsoft\Windows\Maintenance\UP_Scheduler => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {7682FC2D-CB50-4967-89F5-074687D5C630} - System32\Tasks\GC_Scheduler => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {97ED3D72-5354-4566-86D7-E4A5791D6F50} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {B46CE138-CF6C-4EC4-A598-0322ECD9CE5E} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {B65CF6F4-3708-4498-8ECE-819471D602D6} - System32\Tasks\GC_Informer => %LOCALAPPDATA%\GCC\Controller.exe <==== ATTENTION
Task: {BC5586E5-0500-447F-9062-606C243B5B90} - System32\Tasks\MySearchDial => C:\Users\suzette\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {D0427B6F-73ED-4E7D-8EAB-DE4FB4CF64A3} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe <==== ATTENTION
Task: {EE80AD58-B550-49AC-8766-EDCFE6A941B9} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
HKU\S-1-5-21-4140096594-4005692477-1792498084-1000\...\Run: [Omiga Plus] => "C:\Program Files (x86)\Omiga Plus\omigaplus.exe" /autorun
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {319ACD25-FD9A-4436-8596-81975E66EA9B} URL = 
BHO-x32: DownloadTerms - {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} - C:\Users\suzette\AppData\Local\DownloadTerms\temp.dat No File
BHO-x32: Fast Free Converter 3.0 - {304E71B8-633E-4C36-996A-7D21D9D1518F} - C:\PROGRA~2\FASTFR~1\FASTFR~1\FASTFR~1.DLL No File
BHO-x32: GetSavin 5.0 - {D62032F9-ED80-4046-AC04-779FB3A48E40} - C:\Users\suzette\AppData\Local\getsavin\ie\getsavin_1376408410.dll No File
CHR HKCU\...\Chrome\Extension: [neebgdeaohaofdhldpobdpfocdonmgki] - C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx [2013-04-25]
CHR HKLM-x32\...\Chrome\Extension: [neebgdeaohaofdhldpobdpfocdonmgki] - C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx [2013-04-25]
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\suzette\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx [2013-04-25]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 
C:\Program Files (x86)\RegClean Pro
C:\Users\suzette\AppData\Local\TidyNetwork
C:\Program Files (x86)\Registry Dr
C:\Users\suzette\AppData\Local\SwvUpdater
C:\Program Files (x86)\Desk 365
C:\Users\suzette\AppData\Local\Temp\launchie.vbs
%LOCALAPPDATA%\GCC
C:\Users\suzette\AppData\Roaming\MYSEAR~1
C:\Program Files (x86)\Omiga Plus
C:\Users\suzette\AppData\Local\DownloadTerms
C:\PROGRA~2\FASTFR~1\FASTFR~1
C:\Users\suzette\AppData\Local\getsavin
*****************
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{04FAD385-24EF-482E-99D4-374F25892519} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04FAD385-24EF-482E-99D4-374F25892519} => Key deleted successfully.
C:\Windows\System32\Tasks\RegClean Pro => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0CFBB707-204C-4052-85CB-A95003B80A66} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0CFBB707-204C-4052-85CB-A95003B80A66} => Key deleted successfully.
C:\Windows\System32\Tasks\TidyNetwork Update => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TidyNetwork Update => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{10F6A5D8-9B88-4AA0-8C80-F972E49E2F47} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10F6A5D8-9B88-4AA0-8C80-F972E49E2F47} => Key deleted successfully.
C:\Windows\System32\Tasks\RegistryDr_Start => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegistryDr_Start => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{22FB2999-1FBF-451F-8B91-4DF092651891} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{22FB2999-1FBF-451F-8B91-4DF092651891} => Key deleted successfully.
C:\Windows\System32\Tasks\AmiUpdXp => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4CD0B81F-62F6-4C65-A371-78F5B717F1CA} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4CD0B81F-62F6-4C65-A371-78F5B717F1CA} => Key deleted successfully.
C:\Windows\System32\Tasks\RegistryDr_Popup => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegistryDr_Popup => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{514EAE6D-AB7A-4BC4-9A2C-0A0AC4D8D8BC} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{514EAE6D-AB7A-4BC4-9A2C-0A0AC4D8D8BC} => Key deleted successfully.
C:\Windows\System32\Tasks\Desk 365 RunAsStdUser => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{55F45AAD-2012-458F-BE14-35CEFD73B653} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55F45AAD-2012-458F-BE14-35CEFD73B653} => Key deleted successfully.
C:\Windows\System32\Tasks\4969 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4969 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\+{75DDD55A-AA23-4546-8D53-79CA43D1020C} => Key not found.
C:\Windows\+System32\Tasks\Microsoft\Windows\Maintenance\UP_Scheduler not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree+\Microsoft\Windows\Maintenance\UP_Scheduler => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7682FC2D-CB50-4967-89F5-074687D5C630} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7682FC2D-CB50-4967-89F5-074687D5C630} => Key deleted successfully.
C:\Windows\System32\Tasks\GC_Scheduler => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GC_Scheduler => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97ED3D72-5354-4566-86D7-E4A5791D6F50} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97ED3D72-5354-4566-86D7-E4A5791D6F50} => Key deleted successfully.
C:\Windows\System32\Tasks\RegClean Pro_UPDATES => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_UPDATES => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B46CE138-CF6C-4EC4-A598-0322ECD9CE5E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B46CE138-CF6C-4EC4-A598-0322ECD9CE5E} => Key deleted successfully.
C:\Windows\System32\Tasks\RegClean Pro_DEFAULT => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_DEFAULT => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B65CF6F4-3708-4498-8ECE-819471D602D6} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B65CF6F4-3708-4498-8ECE-819471D602D6} => Key deleted successfully.
C:\Windows\System32\Tasks\GC_Informer => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GC_Informer => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BC5586E5-0500-447F-9062-606C243B5B90} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BC5586E5-0500-447F-9062-606C243B5B90} => Key deleted successfully.
C:\Windows\System32\Tasks\MySearchDial => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MySearchDial => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D0427B6F-73ED-4E7D-8EAB-DE4FB4CF64A3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D0427B6F-73ED-4E7D-8EAB-DE4FB4CF64A3} => Key deleted successfully.
C:\Windows\System32\Tasks\Omiga Plus RunAsStdUser => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Omiga Plus RunAsStdUser => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EE80AD58-B550-49AC-8766-EDCFE6A941B9} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EE80AD58-B550-49AC-8766-EDCFE6A941B9} => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => Key deleted successfully.
HKU\S-1-5-21-4140096594-4005692477-1792498084-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Omiga Plus => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{319ACD25-FD9A-4436-8596-81975E66EA9B} => Key deleted successfully.
HKCR\CLSID\{319ACD25-FD9A-4436-8596-81975E66EA9B} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{304E71B8-633E-4C36-996A-7D21D9D1518F} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{304E71B8-633E-4C36-996A-7D21D9D1518F} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D62032F9-ED80-4046-AC04-779FB3A48E40} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{D62032F9-ED80-4046-AC04-779FB3A48E40} => Key deleted successfully.
HKCU\SOFTWARE\Google\Chrome\Extensions\neebgdeaohaofdhldpobdpfocdonmgki => Key deleted successfully.
C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\neebgdeaohaofdhldpobdpfocdonmgki => Key deleted successfully.
"C:\Users\suzette\AppData\Local\CRE\neebgdeaohaofdhldpobdpfocdonmgki.crx" => File/Directory not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj => Key deleted successfully.
"C:\Users\suzette\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx" => File/Directory not found.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
"C:\Program Files (x86)\RegClean Pro" => File/Directory not found.
"C:\Users\suzette\AppData\Local\TidyNetwork" => File/Directory not found.
"C:\Program Files (x86)\Registry Dr" => File/Directory not found.
"C:\Users\suzette\AppData\Local\SwvUpdater" => File/Directory not found.
"C:\Program Files (x86)\Desk 365" => File/Directory not found.
"C:\Users\suzette\AppData\Local\Temp\launchie.vbs" => File/Directory not found.
"C:\Users\suzette\AppData\Roaming\MYSEAR~1" => File/Directory not found.
"C:\Program Files (x86)\Omiga Plus" => File/Directory not found.
C:\Users\suzette\AppData\Local\DownloadTerms => Moved successfully.
"C:\PROGRA~2\FASTFR~1\FASTFR~1" => File/Directory not found.
"C:\Users\suzette\AppData\Local\getsavin" => File/Directory not found.
 
==== End of Fixlog ====
 
 
And here is my Log from Malwarebytes

----------------------------------------------------
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 5/23/2014
Scan Time: 10:34:25 AM
Logfile: 
Administrator: Yes
 
Version: 2.00.1.1004
Malware Database: v2014.05.23.08
Rootkit Database: v2014.05.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: suzette
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 273217
Time Elapsed: 6 min, 29 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
 
 
Thanks for the quick replies
 
 


#8 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:38 PM

Posted 26 May 2014 - 07:43 AM

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#9 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:38 PM

Posted 10 June 2014 - 06:28 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users