Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus....Help Please.......


  • This topic is locked This topic is locked
37 replies to this topic

#1 newsomnewsom

newsomnewsom

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 25 June 2014 - 02:07 AM

Hi,

 

Wondering if someone could help please? Recently my laptop was affected by a virus - schoolboy error, not normally caught out by things like this but, I was using the laptop one day and suddenly a pop-up appeared, something under the name of "flash updater" or some such name. not pretending to be Adobe or anything, a windows pop-up and I didn't recognize the name so I cancelled it. it then re-appeared in succession so many times that I thought it must be legit and of course accepted. Foolish error...

 

I then realised that the computer was beginning to crash and so went about hurriedly installing anti-virus [yes I should of had it installed already!!] but AVG only seemed to keep it at bay as opposed to removing it entirely. I then came across bleepingcomputer and instead of contacting and seeking help, I scoured the forums and ran a lot of the software available. It seems to have removed the virus, though I can't be sure obviously and although it runs okay when just using it, as soon as I use the internet in either safe mode [very slow and not running right] or in normal mode [extremely slow and excessive "script" pop-ups] it seems to affect the computer until I re-boot it......  

 

Adding to that, a couple of external HDD's I have, now are not recognised by the laptop and I can't use them on this computer. One of which - works fines on another laptop at the office but just won't work on this laptop.

 

If anyone could help take me through the process of fixing/cleaning the laptop, it would be much appreciated....

 

Thanks

 

Phil



BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,701 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 PM

Posted 30 June 2014 - 02:10 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/538930 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 30 June 2014 - 05:06 AM

Hi,

 

Attached DDS Log.

 

I still think the laptop has virus. On using internet explorer the computer gradually becomes slower and unresponsive, also get excessive script pop-ups. The laptop appears to run fine when not using explorer.

 

I ran:

 

ADW Cleaner

ComboFix

JRT

RKILL

RogueKiller

MBAM

MBAM Rootkit

 

Intially the computer became infected through a 'flash updater' pop-up.

 

Thanks

 

Phil

Attached Files



#4 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 30 June 2014 - 05:10 AM

Forgot to say,

 

I've been running the laptop in safe mode with networking for accessing the internet, this seems ok.

 

it does seem to have gone now, but following the problems, on shut-down it was always taking a while due to 'iexplore.exe' still running.

 

Also, on shutting down, the laptop would attempt to shut down and then the screen would flash lots of times, sort of displaying different 'internet pages', strange random pages that I wouldn't recognise, before closing.

 

 

Phil



#5 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:57 PM

Posted 30 June 2014 - 09:21 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===


--RogueKiller--
  • Download & SAVE to your Desktop For 32bit system or For 64bit system
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller+
=======

Download the correct version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Let me know what problem persists.

#6 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 30 June 2014 - 10:32 AM

Hi Nasdaq,

 

Thanks.

 

 

Rogue killer report:

 

RogueKiller V9.0.1.0 [Jun  2 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : John [Admin rights]
Mode : Remove -- Date : 06/30/2014  16:08:21

¤¤¤ Bad processes : 1 ¤¤¤
[Suspicious.Path] AmazonMP3DownloaderHelper.exe -- C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-4009691917-2544462992-1046117616-1000\Software\Microsoft\Windows\CurrentVersion\Run | AmazonMP3DownloaderHelper : C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [x] -> DELETED
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-4009691917-2544462992-1046117616-1000\Software\Microsoft\Windows\CurrentVersion\Run | AmazonMP3DownloaderHelper : C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe  -> ERROR [2]
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> NOT SELECTED
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> NOT SELECTED

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BEVT-60A23T0 +++++
--- User ---
[MBR] c9cee16bb49a66fcda3ecc7f8a958ac2
[BSP] 800a81993d4dab224a80f55b5928da7d : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 288243 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 590731264 | Size: 16698 MB
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 624928768 | Size: 103 MB
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_DEL_06032014_115122.log - RKreport_SCN_06032014_114924.log - RKreport_SCN_06302014_155924.log

 

 

FRST64 Report:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-06-2014 02
Ran by John (administrator) on PHIL-HP-WORK on 30-06-2014 16:13:15
Running from C:\Users\John\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\...\Policies\Explorer: []
ShellIconOverlayIdentifiers: AutoCAD Digital Signatures Icon Overlay Handler -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {3E2911A6-2565-4363-B4AE-077573C4FC3B} URL = http://uk.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {E7A28D4E-17C0-4515-B1FC-7E88A57304E6} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {3E2911A6-2565-4363-B4AE-077573C4FC3B} URL = http://uk.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {E7A28D4E-17C0-4515-B1FC-7E88A57304E6} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - DefaultScope {3E2911A6-2565-4363-B4AE-077573C4FC3B} URL = http://uk.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {3E2911A6-2565-4363-B4AE-077573C4FC3B} URL = http://uk.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {E7A28D4E-17C0-4515-B1FC-7E88A57304E6} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll No File
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2010-07-12] (EasyBits Software Corp.)
ShellExecuteHooks-x32:  - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: google.co.uk
CHR Extension: (Google Docs) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-02]
CHR Extension: (Google Drive) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-02]
CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-02]
CHR Extension: (Google Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-02]
CHR Extension: (Google Wallet) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-02]
CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-02]

==================== Services (Whitelisted) =================

S4 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3644432 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [292424 2014-05-13] (AVG Technologies CZ, s.r.o.)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S4 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
S4 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S4 RtVOsdService; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [315392 2010-06-24] (Realtek Semiconductor Corp.) [File not signed]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236312 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [191768 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [323352 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130328 2014-05-13] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [273176 2014-05-13] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50464 2014-04-30] (AVG Technologies)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2014-06-03] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119000 2014-06-04] (Malwarebytes Corporation)
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-30 16:13 - 2014-06-30 16:13 - 00013573 _____ () C:\Users\John\Downloads\FRST.txt
2014-06-30 16:12 - 2014-06-30 16:12 - 02083328 _____ (Farbar) C:\Users\John\Downloads\FRST64.exe
2014-06-30 16:12 - 2014-06-30 16:12 - 00001127 _____ () C:\Users\John\Desktop\FRST64 - Shortcut.lnk
2014-06-30 09:31 - 2014-06-30 09:31 - 00688992 ____R (Swearware) C:\Users\John\Desktop\dds.com
2014-06-30 09:26 - 2014-06-30 09:49 - 00000944 _____ () C:\Users\John\Desktop\attach.txt
2014-06-27 09:23 - 2014-06-27 09:23 - 00549550 _____ () C:\Users\John\Desktop\West Sussex County Council Contact us online_aspx.mht
2014-06-26 16:17 - 2014-06-26 16:43 - 00000000 ____D () C:\Users\John\Downloads\Auschwitz The Nazis and the Final Solution [BBC] Complete (XviD asd) EnglishV+NapisyPL
2014-06-24 15:23 - 2014-06-30 15:24 - 00003180 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForJohn
2014-06-24 15:23 - 2014-06-30 15:24 - 00000328 _____ () C:\Windows\Tasks\HPCeeScheduleForJohn.job
2014-06-24 15:21 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-24 15:21 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-24 15:21 - 2014-05-30 10:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-24 15:21 - 2014-05-30 10:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-24 15:21 - 2014-05-30 10:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-24 15:21 - 2014-05-30 10:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-24 15:21 - 2014-05-30 09:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-24 15:21 - 2014-05-30 09:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-24 15:21 - 2014-05-30 09:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-24 15:21 - 2014-05-30 09:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-24 15:21 - 2014-05-30 09:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-24 15:21 - 2014-05-30 09:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-24 15:21 - 2014-05-30 09:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-24 15:21 - 2014-05-30 09:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-24 15:21 - 2014-05-30 09:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-24 15:21 - 2014-05-30 09:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-24 15:21 - 2014-05-30 09:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-24 15:21 - 2014-05-30 08:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-24 15:21 - 2014-05-30 08:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-24 15:21 - 2014-05-30 08:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-24 15:21 - 2014-05-30 08:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-24 15:20 - 2014-05-30 11:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-24 15:20 - 2014-05-30 10:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-24 15:20 - 2014-05-30 10:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-24 15:20 - 2014-05-30 10:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-24 15:20 - 2014-05-30 10:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-24 15:20 - 2014-05-30 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-24 15:20 - 2014-05-30 10:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-24 15:20 - 2014-05-30 10:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-24 15:20 - 2014-05-30 10:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-24 15:20 - 2014-05-30 10:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-24 15:20 - 2014-05-30 10:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-24 15:20 - 2014-05-30 10:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-24 15:20 - 2014-05-30 09:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-24 15:20 - 2014-05-30 09:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-24 15:20 - 2014-05-30 09:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-24 15:20 - 2014-05-30 09:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-24 15:20 - 2014-05-30 09:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-24 15:20 - 2014-05-30 09:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-24 15:20 - 2014-05-30 09:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-24 15:20 - 2014-05-30 09:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-24 15:20 - 2014-05-30 09:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-24 15:20 - 2014-05-30 09:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-24 15:20 - 2014-05-30 09:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-24 15:20 - 2014-05-30 08:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-24 15:20 - 2014-05-30 08:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-24 15:20 - 2014-05-30 08:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-24 15:20 - 2014-05-30 08:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-24 15:20 - 2014-05-30 08:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-24 15:20 - 2014-05-30 08:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-24 15:20 - 2014-05-30 08:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-24 15:20 - 2014-05-30 08:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-24 15:18 - 2014-03-26 15:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-24 15:18 - 2014-03-26 15:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-24 15:18 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-24 15:18 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-24 15:18 - 2014-03-26 15:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-24 15:18 - 2014-03-26 15:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-24 15:18 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-24 15:18 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-24 15:12 - 2014-06-08 10:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-24 15:12 - 2014-06-08 10:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-24 15:12 - 2014-04-25 03:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-24 15:12 - 2014-04-25 03:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-24 15:12 - 2014-04-05 03:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-24 15:12 - 2014-04-05 03:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 12:45 - 2014-06-11 12:45 - 00000000 ____D () C:\Users\John\AppData\Roaming\Amazon
2014-06-11 12:44 - 2014-06-11 12:44 - 02328688 _____ () C:\Users\John\Downloads\AmazonMP3DownloaderInstall._V383688048_.exe
2014-06-11 12:44 - 2014-06-11 12:44 - 00000000 ____D () C:\Users\John\Documents\Amazon MP3
2014-06-11 12:44 - 2014-06-11 12:44 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2014-06-10 15:38 - 2014-06-10 15:38 - 00280957 _____ () C:\Users\John\Desktop\Attachments_2014610.zip
2014-06-09 15:19 - 2014-06-09 15:19 - 02198109 _____ () C:\Users\John\Desktop\4 Grand Avenue.zip
2014-06-08 20:08 - 2014-06-08 20:10 - 00000000 ____D () C:\Users\John\Downloads\Black Hawk Down (2001) [1080p]
2014-06-05 16:39 - 2014-06-05 16:39 - 00000000 ____D () C:\Windows\pss
2014-06-05 13:34 - 2014-06-26 20:12 - 00000000 ____D () C:\Users\John\AppData\Local\CrashDumps
2014-06-04 13:00 - 2014-06-04 13:00 - 00026246 _____ () C:\ComboFix.txt
2014-06-04 12:37 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-04 12:37 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-04 12:37 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-04 12:37 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-04 12:37 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-04 12:37 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-04 12:37 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-04 12:37 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-04 12:34 - 2014-06-04 13:00 - 00000000 ____D () C:\Qoobox
2014-06-04 10:52 - 2014-06-04 10:52 - 01472131 _____ () C:\Users\John\Desktop\vba32arkit.zip
2014-06-04 10:26 - 2014-06-24 09:10 - 00000000 ____D () C:\Users\John\Downloads\Wedding_Music_Playlist
2014-06-03 12:12 - 2014-06-03 12:12 - 00380416 _____ () C:\Users\John\Desktop\h2u8tjsz.exe
2014-06-03 12:01 - 2014-06-03 12:01 - 00277040 _____ () C:\Windows\Minidump\060314-64288-01.dmp
2014-06-03 11:33 - 2014-06-03 11:33 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-06-03 11:32 - 2014-06-03 11:32 - 04673536 _____ () C:\Users\John\Desktop\RogueKiller.exe
2014-06-03 11:24 - 2014-06-03 11:24 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\John\Desktop\rkill.exe
2014-06-03 11:15 - 2014-06-03 11:17 - 00277040 _____ () C:\Windows\Minidump\060314-62057-01.dmp
2014-06-03 10:33 - 2014-06-04 13:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-03 10:31 - 2014-06-04 13:56 - 00000000 ____D () C:\Users\John\Desktop\mbar
2014-06-03 10:31 - 2014-06-03 10:31 - 12589848 _____ (Malwarebytes Corp.) C:\Users\John\Desktop\mbar-1.07.0.1009.exe
2014-06-03 10:04 - 2014-06-03 10:04 - 00002971 _____ () C:\Users\John\Desktop\HiJackThis.lnk
2014-06-03 10:04 - 2014-06-03 10:04 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
2014-06-03 10:04 - 2014-06-03 10:04 - 00000000 ____D () C:\Program Files (x86)\Trend Micro
2014-06-03 10:03 - 2014-06-03 10:03 - 01402880 _____ () C:\Users\John\Desktop\HiJackThis.msi
2014-06-03 09:06 - 2014-06-30 16:13 - 00000000 ____D () C:\FRST
2014-06-02 13:14 - 2014-06-04 13:11 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-02 13:14 - 2014-06-03 10:31 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-02 13:14 - 2014-06-02 13:14 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-02 13:14 - 2014-05-12 07:35 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-02 13:14 - 2014-05-12 07:35 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-02 13:13 - 2014-06-02 13:13 - 17292208 _____ (Malwarebytes Corporation ) C:\Users\John\Desktop\mbam-setup.exe
2014-06-02 11:35 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-06-02 09:15 - 2014-06-04 12:58 - 00000000 ____D () C:\Windows\erdnt
2014-06-02 09:14 - 2014-06-04 12:33 - 05206532 ____R (Swearware) C:\Users\John\Desktop\ComboFix.exe
2014-06-02 09:09 - 2014-06-02 09:09 - 00000000 ____D () C:\Windows\ERUNT
2014-06-02 09:08 - 2014-06-02 09:08 - 01016261 _____ (Thisisu) C:\Users\John\Desktop\JRT.exe
2014-06-02 08:49 - 2014-06-04 12:25 - 00000000 ____D () C:\AdwCleaner
2014-06-02 08:48 - 2014-06-02 08:48 - 01327971 _____ () C:\Users\John\Desktop\AdwCleaner.exe
2014-05-31 22:07 - 2014-05-31 22:10 - 00000000 ____D () C:\Users\John\Downloads\Lone Survivor (2013)

==================== One Month Modified Files and Folders =======

2014-06-30 16:20 - 2014-06-30 16:13 - 00013573 _____ () C:\Users\John\Downloads\FRST.txt
2014-06-30 16:13 - 2014-06-03 09:06 - 00000000 ____D () C:\FRST
2014-06-30 16:12 - 2014-06-30 16:12 - 02083328 _____ (Farbar) C:\Users\John\Downloads\FRST64.exe
2014-06-30 16:12 - 2014-06-30 16:12 - 00001127 _____ () C:\Users\John\Desktop\FRST64 - Shortcut.lnk
2014-06-30 15:56 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-30 15:56 - 2009-07-14 05:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-30 15:55 - 2010-11-10 09:38 - 01926272 _____ () C:\Windows\WindowsUpdate.log
2014-06-30 15:52 - 2013-06-12 07:43 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-30 15:48 - 2011-06-17 19:09 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-30 15:47 - 2011-06-17 19:09 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-30 15:47 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-30 15:47 - 2009-07-14 05:51 - 00099895 _____ () C:\Windows\setupact.log
2014-06-30 15:24 - 2014-06-24 15:23 - 00003180 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForJohn
2014-06-30 15:24 - 2014-06-24 15:23 - 00000328 _____ () C:\Windows\Tasks\HPCeeScheduleForJohn.job
2014-06-30 15:08 - 2013-09-12 13:02 - 00000000 ____D () C:\ProgramData\MFAData
2014-06-30 09:51 - 2011-12-21 19:13 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-30 09:50 - 2013-05-07 16:02 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-30 09:49 - 2014-06-30 09:26 - 00000944 _____ () C:\Users\John\Desktop\attach.txt
2014-06-30 09:31 - 2014-06-30 09:31 - 00688992 ____R (Swearware) C:\Users\John\Desktop\dds.com
2014-06-27 09:23 - 2014-06-27 09:23 - 00549550 _____ () C:\Users\John\Desktop\West Sussex County Council Contact us online_aspx.mht
2014-06-26 20:12 - 2014-06-05 13:34 - 00000000 ____D () C:\Users\John\AppData\Local\CrashDumps
2014-06-26 16:55 - 2013-02-27 12:19 - 00000000 ____D () C:\Users\John\AppData\Roaming\BitTorrent
2014-06-26 16:43 - 2014-06-26 16:17 - 00000000 ____D () C:\Users\John\Downloads\Auschwitz The Nazis and the Final Solution [BBC] Complete (XviD asd) EnglishV+NapisyPL
2014-06-24 16:15 - 2014-03-07 13:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-24 16:10 - 2014-03-07 13:11 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-24 16:10 - 2011-05-05 12:46 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-24 16:04 - 2014-05-06 17:14 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-24 15:21 - 2011-05-05 11:47 - 00000000 ____D () C:\Users\John
2014-06-24 09:11 - 2013-12-29 13:53 - 00000000 ____D () C:\Users\John\Desktop\Wedding
2014-06-24 09:10 - 2014-06-04 10:26 - 00000000 ____D () C:\Users\John\Downloads\Wedding_Music_Playlist
2014-06-24 09:10 - 2013-07-30 10:28 - 00000000 ____D () C:\Users\John\Downloads\Blue
2014-06-11 22:47 - 2009-07-14 06:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-11 12:45 - 2014-06-11 12:45 - 00000000 ____D () C:\Users\John\AppData\Roaming\Amazon
2014-06-11 12:44 - 2014-06-11 12:44 - 02328688 _____ () C:\Users\John\Downloads\AmazonMP3DownloaderInstall._V383688048_.exe
2014-06-11 12:44 - 2014-06-11 12:44 - 00000000 ____D () C:\Users\John\Documents\Amazon MP3
2014-06-11 12:44 - 2014-06-11 12:44 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2014-06-10 19:22 - 2014-01-01 16:08 - 00000000 ____D () C:\Users\John\AppData\Roaming\vlc
2014-06-10 15:39 - 2013-01-16 07:12 - 00000000 ____D () C:\Users\John\Documents\LCUCK - HND Civil Engineering
2014-06-10 15:38 - 2014-06-10 15:38 - 00280957 _____ () C:\Users\John\Desktop\Attachments_2014610.zip
2014-06-09 15:19 - 2014-06-09 15:19 - 02198109 _____ () C:\Users\John\Desktop\4 Grand Avenue.zip
2014-06-09 06:14 - 2011-05-20 21:07 - 00000000 ____D () C:\ProgramData\Recovery
2014-06-08 20:10 - 2014-06-08 20:08 - 00000000 ____D () C:\Users\John\Downloads\Black Hawk Down (2001) [1080p]
2014-06-08 10:13 - 2014-06-24 15:12 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 10:08 - 2014-06-24 15:12 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-05 16:39 - 2014-06-05 16:39 - 00000000 ____D () C:\Windows\pss
2014-06-05 16:04 - 2014-05-23 15:07 - 00000000 ___RD () C:\Users\John\Dropbox
2014-06-05 13:11 - 2014-05-23 15:06 - 00000000 ____D () C:\Users\John\AppData\Roaming\DropboxMaster
2014-06-05 13:11 - 2014-05-23 15:05 - 00000000 ____D () C:\Users\John\AppData\Roaming\Dropbox
2014-06-04 14:00 - 2011-10-24 20:57 - 00000000 ____D () C:\Windows\Minidump
2014-06-04 13:58 - 2011-10-24 20:57 - 629868947 _____ () C:\Windows\MEMORY.DMP
2014-06-04 13:58 - 2011-05-05 19:40 - 00440902 _____ () C:\Windows\PFRO.log
2014-06-04 13:56 - 2014-06-03 10:33 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-04 13:56 - 2014-06-03 10:31 - 00000000 ____D () C:\Users\John\Desktop\mbar
2014-06-04 13:11 - 2014-06-02 13:14 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 13:00 - 2014-06-04 13:00 - 00026246 _____ () C:\ComboFix.txt
2014-06-04 13:00 - 2014-06-04 12:34 - 00000000 ____D () C:\Qoobox
2014-06-04 13:00 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-06-04 12:58 - 2014-06-02 09:15 - 00000000 ____D () C:\Windows\erdnt
2014-06-04 12:56 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-04 12:33 - 2014-06-02 09:14 - 05206532 ____R (Swearware) C:\Users\John\Desktop\ComboFix.exe
2014-06-04 12:25 - 2014-06-02 08:49 - 00000000 ____D () C:\AdwCleaner
2014-06-04 10:52 - 2014-06-04 10:52 - 01472131 _____ () C:\Users\John\Desktop\vba32arkit.zip
2014-06-04 09:54 - 2013-05-20 15:34 - 00000000 ____D () C:\Users\John\Desktop\DPool
2014-06-03 12:12 - 2014-06-03 12:12 - 00380416 _____ () C:\Users\John\Desktop\h2u8tjsz.exe
2014-06-03 12:01 - 2014-06-03 12:01 - 00277040 _____ () C:\Windows\Minidump\060314-64288-01.dmp
2014-06-03 11:33 - 2014-06-03 11:33 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-06-03 11:32 - 2014-06-03 11:32 - 04673536 _____ () C:\Users\John\Desktop\RogueKiller.exe
2014-06-03 11:24 - 2014-06-03 11:24 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\John\Desktop\rkill.exe
2014-06-03 11:17 - 2014-06-03 11:15 - 00277040 _____ () C:\Windows\Minidump\060314-62057-01.dmp
2014-06-03 10:31 - 2014-06-03 10:31 - 12589848 _____ (Malwarebytes Corp.) C:\Users\John\Desktop\mbar-1.07.0.1009.exe
2014-06-03 10:31 - 2014-06-02 13:14 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-03 10:07 - 2011-05-05 11:57 - 00000000 ____D () C:\Users\John\AppData\Local\VirtualStore
2014-06-03 10:04 - 2014-06-03 10:04 - 00002971 _____ () C:\Users\John\Desktop\HiJackThis.lnk
2014-06-03 10:04 - 2014-06-03 10:04 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
2014-06-03 10:04 - 2014-06-03 10:04 - 00000000 ____D () C:\Program Files (x86)\Trend Micro
2014-06-03 10:03 - 2014-06-03 10:03 - 01402880 _____ () C:\Users\John\Desktop\HiJackThis.msi
2014-06-03 10:00 - 2010-11-10 09:53 - 00000000 ____D () C:\ProgramData\WildTangent
2014-06-03 10:00 - 2010-11-10 09:53 - 00000000 ____D () C:\Program Files (x86)\HP Games
2014-06-03 10:00 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-02 14:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\IME
2014-06-02 14:17 - 2013-03-27 09:14 - 00000000 ____D () C:\Users\John\AppData\Local\Akamai
2014-06-02 13:14 - 2014-06-02 13:14 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-02 13:14 - 2014-06-02 13:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-02 13:13 - 2014-06-02 13:13 - 17292208 _____ (Malwarebytes Corporation ) C:\Users\John\Desktop\mbam-setup.exe
2014-06-02 12:00 - 2011-06-17 19:09 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-02 09:28 - 2011-06-17 19:09 - 00000000 ____D () C:\Users\John\AppData\Local\Google
2014-06-02 09:09 - 2014-06-02 09:09 - 00000000 ____D () C:\Windows\ERUNT
2014-06-02 09:08 - 2014-06-02 09:08 - 01016261 _____ (Thisisu) C:\Users\John\Desktop\JRT.exe
2014-06-02 08:48 - 2014-06-02 08:48 - 01327971 _____ () C:\Users\John\Desktop\AdwCleaner.exe
2014-05-31 22:10 - 2014-05-31 22:07 - 00000000 ____D () C:\Users\John\Downloads\Lone Survivor (2013)
2014-05-31 02:51 - 2011-06-17 19:09 - 00000000 ____D () C:\Program Files\Google
2014-05-31 02:51 - 2010-11-10 10:21 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-31 02:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration

Some content of TEMP:
====================
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoq3nul.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-24 08:55

==================== End Of Log ============================

 



#7 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:57 PM

Posted 30 June 2014 - 01:16 PM

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start
HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\...\Policies\Explorer: []
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks-x32:  - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  No File [ ]
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoq3nul.dll

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/
===

Let me know of any remaining issues with this computer.

#8 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 01 July 2014 - 02:16 AM

Hi,

 

Fixlog:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-06-2014 02
Ran by John at 2014-07-01 07:33:04 Run:1
Running from C:\Users\John\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\...\Policies\Explorer: []
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No
File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks-x32:  -
UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} -  No File [ ]
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoq3nul.dll

End

*****************

HKU\S-1-5-21-4009691917-2544462992-1046117616-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value deleted successfully.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4' => Key deleted successfully.
'HKLM\Software\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1' => Key deleted successfully.
'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2' => Key deleted successfully.
'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3' => Key deleted successfully.
'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.
'HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}' => Key deleted successfully.
'HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}'=> Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}' => Key deleted successfully.
'HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}' => Key deleted successfully.
'HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}'=> Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
'HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}'=> Key not found.
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\ShellExecuteHooks-x32:  - => Value not found.
'HKCR\Wow6432Node\CLSID\ShellExecuteHooks-x32:  -'=> Key not found.
'HKLM\Software\MozillaPlugins\FF Plugin: @microsoft.com/GENUINE - disabled No File'=> Key not found.
"FF Plugin: @microsoft.com/GENUINE - disabled No File" => not found.
'HKLM\Software\Wow6432Node\MozillaPlugins\FF Plugin-x32: @microsoft.com/GENUINE - disabled No File'=> Key not found.
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File not found.
'HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin' => Key deleted successfully.
C:\Users\John\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll => Moved successfully.
Prot6Flt => Service deleted successfully.
C:\Users\John\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoq3nul.dll => Moved successfully.

==== End of Fixlog ====

 

 

 

Security check would not run properly. it ran automatically as administrator, but throughout all its processes - "the system cannot find the file specified" message appeared, then on the :

"performing system health check" stage, same message and the program stalled. No log to report.....

 

Computer seems to be running a bit better than previously, now not in safe mode any more and internet access is usable so far....

 

However,

 

"windows explorer has stopped working" - message keeps appearing when using the internet and "windows explorer is restarting" also,

"page not responding" and "script error messages" 

 

Also this keeps happening:

 

screen sort of flashes - like a brief powercut across the screen, only a brief moment but this is also not normal.....

 

Computer does also boot very slowly where it didn't used to, and it still doesn't seem to run as it used to.....

 

 

thanks in advance

 

Phil

 

 

 



#9 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:57 PM

Posted 01 July 2014 - 07:40 AM

Run the SFC.exe tool.

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7
http://support.microsoft.com/kb/929833

Keep me posted.

#10 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 01 July 2014 - 08:27 AM

Hi,

I ran sfc: Windows Resource Protection did not find any integrity violations.


It's very odd, the minute I use the internet in normal mode, the longer it stays connected, gradually the computer gets worse...

Still, on shut down "task host window" causes the process to hang, didn't manage to catch it last time, but I'm sure it's the explorer.exe that's mentioned.

Thanks

#11 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:57 PM

Posted 01 July 2014 - 10:15 AM

Secunia Personal Software Inspector (PSI)
http://secunia.com/vulnerability_scanning/personal/
Secunia PSI is a security scanner which identifies programs/drivers that are damaged OR needs to be updated.
If interested in security I would download the tool and run it.
<<<>>>

Perform a Clean Startup
Follow the instructions on this page.
http://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html

Keep me posted.

#12 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 02 July 2014 - 02:41 AM

Hi,

 

I've been running clean start up mode since the problems began [which I'd forgotten, and only re-discovered yesterday when following through  the steps, I did the opposite which launch everything on start up which created a nightmare loading phase...took forever.] Anyway, I reverted settings back to clean start up [everything except Microsoft disabled] then ran secunia PSI.

 

It performed a cursory scan and displayed " some software might be outdated". no indication of what an no log/history or anything, just the message and "scan" option.

 

There is definitely still a problem though, yesterday after I thought it was fixed I was running in normal mode, connected to the internet, over a period of a few hours the computer became sluggish and un responsive so I attempted to shut down and boot in safe mode, again on shut down, between the "shutting down" and blank screen/shut off -  the random images flashing briefly happened. They are not images from my computer and they are never any flash images of any web pages I visit. they are not on the screen long enough to determine what they are, but I definitely don't recognize them......

 

This has got to be a virus hasn't it?

 

 

Thanks

 

Phil

 



#13 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 02 July 2014 - 04:35 AM

Even happening in safe mode now...
I've got a feeling it's still lurking there somewhere. I haven't run anti malware bytes in a while. Even when I was running it, seemed to highlight and obviously delete whatever it found but then on starting up in normal mode, re scan, seemed to be back, whatever it is...


Phil

#14 nasdaq

nasdaq

  • Malware Response Team
  • 39,543 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:57 PM

Posted 02 July 2014 - 08:13 AM

Let see what this tool will find.

Please download ComboFix from any of the links below, and save it to your desktop. For information regarding this download, please visit this web page: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT....

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Do not install any other programs until this if fixed.


How to : Disable Anti-virus and Firewall...
http://www.bleepingcomputer.com/forums/topic114351.html

Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt
Note:
Do not mouse click ComboFix's window while it's running. That may cause it to stall


Note: If you have difficulty properly disabling your protective programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html

Note: If after running ComboFix you get this error message "Illegal operation attempted on a registry key that has been marked for deletion." when attempting to run a program all you need to do is restart the computer to reset the registry.
==============

#15 newsomnewsom

newsomnewsom
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:57 PM

Posted 02 July 2014 - 09:33 AM

Whilst running I got a pop-up message re: iexplorer.exe :

 

C:\Program Files\Internet Explorer\iexplorer.exe

 

Illegal operation attempted on a registry key that has been marked for deletion.

 

 

 

 

combofix log:

 

ComboFix 14-06-30.01 - John 02/07/2014  14:38:15.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.44.1033.18.3999.2067 [GMT 1:00]
Running from: c:\users\John\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2014-06-02 to 2014-07-02  )))))))))))))))))))))))))))))))
.
.
2014-07-02 13:59 . 2014-07-02 13:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-07-02 13:59 . 2014-07-02 13:59 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-07-01 15:29 . 2014-07-01 15:29 -------- d-----w- c:\users\John\AppData\Local\Secunia PSI
2014-07-01 15:21 . 2014-07-01 15:21 -------- d-----w- c:\program files (x86)\Secunia
2014-06-24 14:18 . 2014-03-26 14:44 2002432 ----a-w- c:\windows\system32\msxml6.dll
2014-06-24 14:18 . 2014-03-26 14:44 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-06-24 14:18 . 2014-03-26 14:27 1389056 ----a-w- c:\windows\SysWow64\msxml6.dll
2014-06-24 14:18 . 2014-03-26 14:27 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2014-06-24 14:18 . 2014-03-26 14:41 2048 ----a-w- c:\windows\system32\msxml6r.dll
2014-06-24 14:18 . 2014-03-26 14:41 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-06-24 14:18 . 2014-03-26 14:25 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2014-06-24 14:18 . 2014-03-26 14:25 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2014-06-24 14:12 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll
2014-06-24 14:12 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-06-24 14:12 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll
2014-06-24 14:12 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2014-06-24 14:12 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-06-24 14:12 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-11 11:45 . 2014-06-11 11:45 -------- d-----w- c:\users\John\AppData\Roaming\Amazon
2014-06-11 11:44 . 2014-06-11 11:44 -------- d-----w- c:\users\John\AppData\Local\Program Files
2014-06-10 18:06 . 2014-06-10 18:06 -------- d-----w- c:\users\John\AppData\Local\ElevatedDiagnostics
2014-06-05 12:34 . 2014-07-01 07:19 -------- d-----w- c:\users\John\AppData\Local\CrashDumps
2014-06-03 10:33 . 2014-06-03 10:33 -------- d-----w- c:\programdata\RogueKiller
2014-06-03 09:33 . 2014-06-04 12:56 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-06-03 09:04 . 2014-06-03 09:04 388096 ----a-r- c:\users\John\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2014-06-03 09:04 . 2014-06-03 09:04 -------- d-----w- c:\program files (x86)\Trend Micro
2014-06-03 08:06 . 2014-07-01 06:34 -------- d-----w- C:\FRST
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-02 13:30 . 2014-06-02 12:14 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-24 15:10 . 2014-03-07 12:11 95414520 ----a-w- c:\windows\system32\MRT.exe
2014-06-03 09:31 . 2014-06-02 12:14 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-15 08:52 . 2013-01-10 08:43 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-15 08:52 . 2013-01-10 08:43 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-13 13:20 . 2014-05-13 13:20 235800 ----a-w- c:\windows\system32\drivers\avgldx64.sys
2014-05-13 13:20 . 2014-05-13 13:20 273176 ----a-w- c:\windows\system32\drivers\avgtdia.sys
2014-05-13 13:06 . 2014-05-13 13:06 323352 ----a-w- c:\windows\system32\drivers\avgloga.sys
2014-05-13 13:05 . 2014-05-13 13:05 191768 ----a-w- c:\windows\system32\drivers\avgidsha.sys
2014-05-13 13:05 . 2014-05-13 13:05 152344 ----a-w- c:\windows\system32\drivers\avgdiska.sys
2014-05-13 13:05 . 2014-05-13 13:05 130328 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
2014-05-13 13:04 . 2014-05-13 13:04 236312 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys
2014-05-13 13:04 . 2014-05-13 13:04 31512 ----a-w- c:\windows\system32\drivers\avgrkx64.sys
2014-05-12 06:35 . 2014-06-02 12:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-12 06:35 . 2014-06-02 12:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-30 23:20 . 2014-05-30 11:31 10702536 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D663FE80-3EF0-4967-A550-ABA0C1C1F3CB}\mpengine.dll
2014-04-30 11:38 . 2013-09-12 12:07 50464 ----a-w- c:\windows\system32\drivers\avgtpx64.sys
2014-04-12 02:22 . 2014-05-14 15:30 155072 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:22 . 2014-05-14 15:30 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:19 . 2014-05-14 15:30 136192 ----a-w- c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-14 15:30 29184 ----a-w- c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-14 15:30 28160 ----a-w- c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-14 15:31 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-14 15:30 31232 ----a-w- c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-14 15:30 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-14 15:30 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x]
R3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
R4 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
R4 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
R4 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
R4 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R4 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R4 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [x]
R4 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
R4 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R4 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [x]
R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192se.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-05-19 18:36 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-10 08:52]
.
2014-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-17 18:09]
.
2014-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-17 18:09]
.
2014-06-30 c:\windows\Tasks\HPCeeScheduleForJohn.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 04:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-05-27 21720]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
   89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
   27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,
   6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
   ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93,
   aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
   d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
   b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:8e,7c,74,47,d8,ff,cd,01
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-07-02  15:06:47
ComboFix-quarantined-files.txt  2014-07-02 14:06
ComboFix2.txt  2014-06-04 12:00
.
Pre-Run: 53,305,942,016 bytes free
Post-Run: 53,341,364,224 bytes free
.
- - End Of File - - 025F9FF0A3246B77236A906BBD0CEE3A

 

Thanks Nasddaq

 

Phil
 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users