Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

PureLeadsUp.exe detected by AVG Resident Shield - can't remove - "inaccessible"


  • This topic is locked This topic is locked
11 replies to this topic

#1 accentaa

accentaa

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 25 June 2014 - 02:16 PM

Problem: 

 

AVG Resident Shield detected 2 instances of  PureLeadsUp.exe (c:Program Files (x86)\PureLeads\PureLeadsUp.exe).  One was removed but the second said that it “was inaccessible.”  (I’m sorry but I can’t remember the exact words.  I closed the window and can’t find the report.) – Related adware:

1 / 68      (Adware)

PureLeads.Service.exe  (867e32c5083c4f90c4c704eb03ac29ef0a7c378d)

1 / 68      (Adware)

PureLeadsSvc.exe  (7598dd84cf1c4089af7554f2c23d8c69a72f49dc)

1 / 68      (Adware)

DynLib.dll  (ec07efdecb7e21a63c8c04ea962fcb890a10b095)

1 / 68      (Adware)

plsapp.exe  (d0aa9c701934b9542ecf42b6a4bc8fb34eb16d7b)

1 / 68      (Adware)

plsappdll.dll  (7df6f58a0f3d132ac3a783c1577514beb5b5cfb3)

 

My computer is running extremely slow and just taking three times longer to follow a click/command.  It’s behaving awkwardly when opening documents and websites.  I’m not sure how to describe “awkward” any better than that.

 

PureLeads was not mentioned in your self-help guide list of infections.  Although I didn’t check all the related ones.

 

I’m including the AVG infection log – I’m not sure which have been healed. (It’s attached as a *.csv file because I couldn’t cut and paste it.)

 

I’m running Office 2003 because a computer fix-it guy removed 2007 just after I’d purchased it while he was repairing my screen.  I just paid for the download version without the CD and have been stuck with 2003 since then. 

 

What I’ve done:

 

  1. Read through similar problems on your site and read all the prep literature.  (Did a few things pre-maturely and some that you advise not to do until told to, so I’ll do as you say now!)
  2. Downloaded and ran FRST64 – Premature, I know – I’ve included the logs last after the DDS logs.
  3. Downloaded and ran Cobian Backup
  4. Checked Windows firewall – which was already enabled.
  5. Downloaded and Ran DDS (first time) and saved the logs
  6. Disabled script blocking (Active scripting is, and has been enabled) – I sometimes receive “cross-scripting” errors on certain web pages.  (Especially jjill.com)
  7. Ran Defogger which said I had no CD emulators.   I’m not sure what a CD emulator is but I have, and hate, and am tied to itunes, and have recently downloaded (paid for) software to convert movie soundtracks into audio files.  (Still can’t unlock itunes death grip on the purchased files.)
  8. Ran AdwCleaner and the fix – sorry…..I teach via VIOP to Korea nine hours a day with lots of open windows, files and a few programs open at the same time – am a little desperate.  Speed is critical.
  9. Ran DDS again – deleting the first logs and pasting most recent logs below.
  10. Have one zipped and one unzipped copy of the DDS attach report but didn’t post.  (Pretty sure it wasn’t asked for yet.)

Included:

1.  DDS Logs

2.  FRST Logs

3. AVG report log - attached as .csv excel file. (Wasn't allowed put AdwCleaner log instead.)

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17041
Run by A the Administrator at 13:40:56 on 2014-06-25
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.6051.1745 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Windows\system32\lsm.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe
C:\Windows\system32\CISVC.EXE
C:\Windows\system32\svchost.exe -k iissvcs
C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\RunDll32.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\TimeLeft3\TimeLeft.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\AVG\AVG9\avgui.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mWinlogon: Userinit = userinit.exe,
BHO: AutorunsDisabled - <orphaned>
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [HP Officejet Pro 8600 (NET)] "C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN34OBXJDY05KC:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1
uRun: [Adobe Reader Synchronizer] "C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe"
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
StartupFolder: C:\Users\ATHEAD~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~1.LNK - C:\Windows\System32\RunDll32.exe
StartupFolder: C:\Users\ATHEAD~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\TimeLeft.lnk - C:\Program Files (x86)\TimeLeft3\TimeLeft.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://tweencam.tween-waters.com/AxisCamControl.ocx
DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} - hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.45.247.167:60001/activex/AMC.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{7358788D-CFC1-4B34-9EC1-B609BCB63740} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\2656C6B696E6534376 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\9445740435471697262796467656355796475637F57537473486374727F5F486 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\960586F6E656 : DHCPNameServer = 198.224.153.135 198.224.155.135
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\E696472716D6 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{E3DCA80A-97F8-4194-97E0-CDAD5BAB270B} : DHCPNameServer = 198.224.159.135 198.224.158.135
TCP: Interfaces\{F925B909-CC29-43F7-BAB1-6959732054C7} : DHCPNameServer = 192.168.1.254
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: AutorunsDisabled - <orphaned>
x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [IntelWirelessWiMAX] "C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe" /tasktray /nosplash
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 dlkmdldr;dlkmdldr;C:\Windows\System32\drivers\dlkmdldr.sys [2014-3-17 13936]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-1-25 268512]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\Windows\System32\drivers\Thpevm.sys [2009-6-29 14784]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;C:\Windows\System32\drivers\avgldx64.sys [2012-12-23 282976]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;C:\Windows\System32\drivers\avgmfx64.sys [2012-12-23 35664]
R1 AvgTdiA;AVG Free Network Redirector x64;C:\Windows\System32\drivers\avgtdia.sys [2012-12-23 317520]
R2 avg9wd;AVG Free WatchDog;C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [2012-12-23 308136]
R2 cbVSCService11;Cobian Backup 11 Volume Shadow Copy Requester;C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [2014-6-24 67584]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-1-28 249200]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 DisplayLinkService;DisplayLinkManager;C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [2011-4-10 9663848]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2012-7-18 514048]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 133928]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2012-7-18 979456]
R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\Windows\System32\drivers\bpenum.sys [2012-7-3 84480]
R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\Windows\System32\drivers\bpusb.sys [2012-7-3 84992]
R3 dlkmd;dlkmd;C:\Windows\System32\drivers\dlkmd.sys [2014-3-17 206960]
R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-7-9 169752]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-3-12 342528]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-3-11 347872]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-15 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-15 180736]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 AX88178;ASIX AX88178 USB2.0 to Gigabit Ethernet Adapter;C:\Windows\System32\drivers\ax88178.sys [2010-11-23 59392]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\System32\drivers\bpmp.sys [2012-7-3 182272]
S3 DisplayLinkUsbPort;DisplayLink USB Device;C:\Windows\System32\drivers\DisplayLinkUsbPort_5.6.31854.0.sys [2011-4-10 17408]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-1-8 58056]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-3-31 1512640]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-5-24 111616]
S3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2011-5-26 174680]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2012-3-26 22528]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-5-2 19456]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-11-12 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-5-2 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-12-23 1255736]
S4 plsapp;plsapp;C:\Program Files (x86)\PureLeads\plsapp.exe --> C:\Program Files (x86)\PureLeads\plsapp.exe [?]
S4 PlsvcV1;PlsvcV1;C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [2014-1-23 91936]
S4 PlsvcV2;PlsvcV2;C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [2014-1-23 24352]
.
=============== Created Last 30 ================
.
2014-06-25 11:30:37 -------- d-----w- C:\Users\A the Administrator\AppData\Local\Adobe
2014-06-24 21:27:33 10779000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{47577E3C-081D-4F29-859E-E05AA6791856}\mpengine.dll
2014-06-24 20:17:41 -------- d-----w- C:\A the Administrator 2014-06-24 15;17;41 (Full)
2014-06-24 20:01:27 -------- d-----w- C:\Program Files (x86)\Cobian Backup 11
2014-06-24 17:47:48 -------- d-----w- C:\FRST
2014-06-24 01:59:52 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{67330303-A0C8-4F96-9D8B-160DCA15F69D}\gapaengine.dll
2014-06-24 01:59:13 10779000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-17 15:30:23 -------- d-----w- C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate
2014-06-17 15:25:35 -------- d-----w- C:\Windows\SysWow64\Adobe
2014-06-06 17:31:19 -------- d-----r- C:\Users\A the Administrator\Dropbox
2014-06-06 17:30:17 -------- d-----w- C:\Users\A the Administrator\AppData\Roaming\DropboxMaster
2014-06-06 17:27:59 -------- d-----w- C:\Users\A the Administrator\AppData\Roaming\Dropbox
.
==================== Find3M  ====================
.
2014-06-25 01:18:22 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-25 01:18:22 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-05-24 15:59:06 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-05-24 15:59:06 194048 ----a-w- C:\Windows\SysWow64\elshyph.dll
2014-05-10 22:35:54 5905904 ----a-w- C:\Windows\System32\GfxUI.exe
2014-05-10 22:35:53 175104 ----a-w- C:\Windows\System32\gfxSrvc.dll
2014-04-14 02:24:46 465408 ----a-w- C:\Windows\System32\aepdu.dll
2014-04-14 02:19:37 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-04-01 02:41:40 58568 ----a-w- C:\Windows\SysWow64\sirenacm.dll
2014-04-01 02:34:22 322248 ----a-w- C:\Windows\WLXPGSS.SCR
2014-04-01 02:06:06 58056 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
2013-11-15 16:10:22 378 ----a-w- C:\Program Files (x86)\temp995.bat
2013-03-16 21:39:04 51300952 ----a-w- C:\Program Files\HRBlock_Basic+Efile (1).exe
.
============= FINISH: 13:41:50.61 ===============

 

 

FRST Log

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014
Ran by A the Administrator (administrator) on AMANDA-TOSHIBA on 25-06-2014 12:35:34
Running from C:\Users\A the Administrator\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
(CobianSoft, Luis Cobian) C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe
(Microsoft Corporation) C:\Windows\System32\CISVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
(Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(NesterSoft Inc.) C:\Program Files (x86)\TimeLeft3\TimeLeft.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelWirelessWiMAX] => C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe [1626112 2012-07-25] (Intel® Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG9_TRAY] => C:\Program Files (x86)\AVG\AVG9\avgtray.exe [2077536 2012-12-24] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe [698760 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2014-05-24] (Google Inc.)
HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Policies\system: [DisableLockWorkstation] 0
AppInit_DLLs: avgrssta.dll => C:\Windows\system32\avgrssta.dll [13048 2012-12-23] (AVG Technologies CZ, s.r.o.)
Startup: C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk
ShortcutTarget: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimeLeft.lnk
ShortcutTarget: TimeLeft.lnk -> C:\Program Files (x86)\TimeLeft3\TimeLeft.exe (NesterSoft Inc.)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE62CF440895CCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {8C6AB8FA-BE78-430B-A25D-045C1391C492} URL = https://www.google.com/search?q={searchTerms}
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://tweencam.tween-waters.com/AxisCamControl.ocx
DPF: HKLM-x32 {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {DE625294-70E6-45ED-B895-CFFA13AEB044} http://216.45.247.167:60001/activex/AMC.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/DownloadManager,version=1.1 - C:\Windows\ ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\A the Administrator\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\A the Administrator\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR HKLM-x32\...\Chrome\Extension: [cgpimkfhjdaobobdomcikioipaenlhke] - \CRE\cgpimkfhjdaobobdomcikioipaenlhke.crx []

==================== Services (Whitelisted) =================

R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2012-12-24] (AVG Technologies CZ, s.r.o.)
R2 cbVSCService11; C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [67584 2013-03-07] (CobianSoft, Luis Cobian) [File not signed]
R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9663848 2011-04-10] (DisplayLink Corp.)
R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
S4 PlsvcV1; C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [91936 2014-01-23] (PureLeads)
S4 PlsvcV2; C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [24352 2014-01-23] (sendori)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel® Corporation) [File not signed]
S4 plsapp; C:\Program Files (x86)\PureLeads\plsapp.exe [X]

==================== Drivers (Whitelisted) ====================

R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.)
R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2012-12-23] (AVG Technologies CZ, s.r.o.)
R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2012-12-23] (AVG Technologies CZ, s.r.o.)
S3 AX88178; C:\Windows\System32\DRIVERS\ax88178.sys [59392 2010-11-23] (ASIX Electronics Corp.)
S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_5.6.31854.0.sys [17408 2011-04-10] (http://libusb-win32.sourceforge.net)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-03-26] (Apple Inc.) [File not signed]
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-25 06:30 - 2014-06-25 06:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe
2014-06-24 21:16 - 2014-06-24 21:16 - 00000500 _____ () C:\Users\A the Administrator\Desktop\defogger_disable.log
2014-06-24 21:16 - 2014-06-24 21:16 - 00000000 _____ () C:\Users\A the Administrator\defogger_reenable
2014-06-24 20:21 - 2014-06-24 20:21 - 00001560 _____ () C:\Users\A the Administrator\Desktop\AdwCleaner[S3].txt
2014-06-24 19:19 - 2014-06-24 19:19 - 00002270 _____ () C:\Users\A the Administrator\Desktop\DDS Attach - Zipped.zip
2014-06-24 19:13 - 2014-06-24 19:13 - 00004834 _____ () C:\Users\A the Administrator\Desktop\DDS Attach - Needs zipping.txt
2014-06-24 19:12 - 2014-06-24 19:12 - 00014305 _____ () C:\Users\A the Administrator\Desktop\DDS 2.txt
2014-06-24 18:07 - 2014-06-24 18:07 - 00004834 _____ () C:\Users\A the Administrator\Desktop\attach.txt
2014-06-24 18:07 - 2014-06-24 18:06 - 00014305 _____ () C:\Users\A the Administrator\Desktop\dds.txt
2014-06-24 17:05 - 2014-06-24 17:05 - 00688992 ____R (Swearware) C:\Users\A the Administrator\Desktop\dds.com
2014-06-24 15:17 - 2014-06-24 19:21 - 00000000 ____D () C:\A the Administrator 2014-06-24 15;17;41 (Full)
2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cobian Backup 11
2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\Program Files (x86)\Cobian Backup 11
2014-06-24 14:58 - 2014-06-24 14:58 - 19709440 _____ (Luis Cobian, CobianSoft) C:\Users\A the Administrator\Downloads\cbSetup.exe
2014-06-24 13:06 - 2014-06-25 12:35 - 00016490 _____ () C:\Users\A the Administrator\Desktop\FRST.txt
2014-06-24 13:05 - 2014-06-24 13:06 - 02082816 ____N (Farbar) C:\Users\A the Administrator\Desktop\FRST64.exe
2014-06-24 12:47 - 2014-06-25 12:35 - 00000000 ____D () C:\FRST
2014-06-17 10:30 - 2014-06-17 10:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate
2014-06-17 10:29 - 2014-06-17 10:37 - 00000000 ____D () C:\Users\A the Administrator\Documents\My Digital Editions
2014-06-17 10:29 - 2014-06-17 10:29 - 00002254 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk
2014-06-17 10:29 - 2014-06-17 10:29 - 00002242 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2014-06-17 10:29 - 2014-06-17 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2014-06-17 10:25 - 2014-06-17 10:30 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-06-17 10:13 - 2014-06-17 10:12 - 18816968 _____ (Bitberry Software ) C:\Users\A the Administrator\Downloads\FreeFileViewerSetup.exe
2014-06-15 22:08 - 2014-06-15 22:08 - 00005000 _____ () C:\Users\A the Administrator\AppData\Local\recently-used.xbel
2014-06-08 19:07 - 2014-06-08 19:07 - 00054270 ____N () C:\Users\A the Administrator\Documents\Cable connections TV to computer.htm
2014-06-08 19:07 - 2014-06-08 19:07 - 00000000 ____D () C:\Users\A the Administrator\Documents\Cable connections TV to computer_files
2014-06-06 12:31 - 2014-06-09 16:28 - 00000000 ___RD () C:\Users\A the Administrator\Dropbox
2014-06-06 12:31 - 2014-06-06 12:31 - 00001073 ____N () C:\Users\A the Administrator\Desktop\Dropbox.lnk
2014-06-06 12:30 - 2014-06-09 16:28 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\DropboxMaster
2014-06-06 12:29 - 2014-06-06 12:29 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-06 12:27 - 2014-06-20 17:51 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Dropbox
2014-06-05 15:23 - 2014-06-24 21:26 - 00004006 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3FD717AA-1F60-4979-A8D3-3CF186CBBF16}
2014-05-30 09:54 - 2014-06-21 14:08 - 00000000 ____D () C:\Users\A the Administrator\Documents\Libby

==================== One Month Modified Files and Folders =======

2014-06-25 12:36 - 2014-06-24 13:06 - 00016490 _____ () C:\Users\A the Administrator\Desktop\FRST.txt
2014-06-25 12:35 - 2014-06-24 12:47 - 00000000 ____D () C:\FRST
2014-06-25 12:30 - 2013-05-02 12:54 - 00000439 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-06-25 12:29 - 2014-05-24 11:16 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-25 12:28 - 2014-05-24 11:16 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-25 08:20 - 2013-10-25 16:55 - 02079481 _____ () C:\Windows\WindowsUpdate.log
2014-06-25 06:32 - 2012-12-23 21:28 - 00000000 ____D () C:\Windows\system32\Drivers\Avg
2014-06-25 06:30 - 2014-06-25 06:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe
2014-06-24 22:08 - 2013-05-29 10:22 - 00000000 ____D () C:\Users\A the Administrator\Documents\Writing
2014-06-24 21:26 - 2014-06-05 15:23 - 00004006 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3FD717AA-1F60-4979-A8D3-3CF186CBBF16}
2014-06-24 21:16 - 2014-06-24 21:16 - 00000500 _____ () C:\Users\A the Administrator\Desktop\defogger_disable.log
2014-06-24 21:16 - 2014-06-24 21:16 - 00000000 _____ () C:\Users\A the Administrator\defogger_reenable
2014-06-24 21:16 - 2013-05-29 10:03 - 00000000 ____D () C:\Users\A the Administrator
2014-06-24 20:21 - 2014-06-24 20:21 - 00001560 _____ () C:\Users\A the Administrator\Desktop\AdwCleaner[S3].txt
2014-06-24 20:18 - 2012-12-23 19:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-24 20:18 - 2012-12-23 19:01 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-24 20:18 - 2012-12-23 19:01 - 00003770 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-24 20:18 - 2012-12-23 19:01 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-24 19:51 - 2009-07-13 23:45 - 00025904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-24 19:51 - 2009-07-13 23:45 - 00025904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-24 19:43 - 2013-11-17 13:01 - 00008160 _____ () C:\Windows\setupact.log
2014-06-24 19:43 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-24 19:42 - 2013-11-22 21:50 - 00137540 _____ () C:\Windows\PFRO.log
2014-06-24 19:35 - 2013-10-28 14:56 - 00000000 ____D () C:\AdwCleaner
2014-06-24 19:21 - 2014-06-24 15:17 - 00000000 ____D () C:\A the Administrator 2014-06-24 15;17;41 (Full)
2014-06-24 19:19 - 2014-06-24 19:19 - 00002270 _____ () C:\Users\A the Administrator\Desktop\DDS Attach - Zipped.zip
2014-06-24 19:13 - 2014-06-24 19:13 - 00004834 _____ () C:\Users\A the Administrator\Desktop\DDS Attach - Needs zipping.txt
2014-06-24 19:12 - 2014-06-24 19:12 - 00014305 _____ () C:\Users\A the Administrator\Desktop\DDS 2.txt
2014-06-24 18:07 - 2014-06-24 18:07 - 00004834 _____ () C:\Users\A the Administrator\Desktop\attach.txt
2014-06-24 18:06 - 2014-06-24 18:07 - 00014305 _____ () C:\Users\A the Administrator\Desktop\dds.txt
2014-06-24 17:05 - 2014-06-24 17:05 - 00688992 ____R (Swearware) C:\Users\A the Administrator\Desktop\dds.com
2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cobian Backup 11
2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\Program Files (x86)\Cobian Backup 11
2014-06-24 14:58 - 2014-06-24 14:58 - 19709440 _____ (Luis Cobian, CobianSoft) C:\Users\A the Administrator\Downloads\cbSetup.exe
2014-06-24 13:06 - 2014-06-24 13:05 - 02082816 ____N (Farbar) C:\Users\A the Administrator\Desktop\FRST64.exe
2014-06-23 21:45 - 2013-05-29 10:18 - 00000000 ____D () C:\Users\A the Administrator\Documents\Home Affordable
2014-06-23 15:22 - 2014-02-20 15:59 - 00000000 ____D () C:\writeitnow4
2014-06-21 14:08 - 2014-05-30 09:54 - 00000000 ____D () C:\Users\A the Administrator\Documents\Libby
2014-06-21 11:41 - 2014-04-25 18:03 - 00000000 ____D () C:\Program Files (x86)\PureLeads
2014-06-20 17:51 - 2014-06-06 12:27 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Dropbox
2014-06-20 09:01 - 2013-11-21 16:07 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\CrashDumps
2014-06-18 15:49 - 2013-05-29 10:09 - 00000000 ____D () C:\Users\A the Administrator\Documents\Carrot English
2014-06-18 12:22 - 2014-05-24 11:16 - 00003920 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-06-18 12:22 - 2014-05-24 11:16 - 00003668 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-06-18 12:06 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-17 10:37 - 2014-06-17 10:29 - 00000000 ____D () C:\Users\A the Administrator\Documents\My Digital Editions
2014-06-17 10:36 - 2013-12-26 22:15 - 00321024 _____ () C:\Users\A the Administrator\Documents\CHEATSHEET ONLY.xls
2014-06-17 10:30 - 2014-06-17 10:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate
2014-06-17 10:30 - 2014-06-17 10:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-06-17 10:29 - 2014-06-17 10:29 - 00002254 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk
2014-06-17 10:29 - 2014-06-17 10:29 - 00002242 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk
2014-06-17 10:29 - 2014-06-17 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2014-06-17 10:29 - 2013-05-10 01:43 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-06-17 10:12 - 2014-06-17 10:13 - 18816968 _____ (Bitberry Software ) C:\Users\A the Administrator\Downloads\FreeFileViewerSetup.exe
2014-06-16 09:37 - 2013-12-27 17:06 - 00982528 ___SH () C:\Users\A the Administrator\Desktop\Thumbs.db
2014-06-16 06:47 - 2013-05-29 11:09 - 00000000 ____D () C:\Users\A the Administrator\.gimp-2.8
2014-06-15 22:08 - 2014-06-15 22:08 - 00005000 _____ () C:\Users\A the Administrator\AppData\Local\recently-used.xbel
2014-06-09 16:28 - 2014-06-06 12:31 - 00000000 ___RD () C:\Users\A the Administrator\Dropbox
2014-06-09 16:28 - 2014-06-06 12:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\DropboxMaster
2014-06-08 19:07 - 2014-06-08 19:07 - 00054270 ____N () C:\Users\A the Administrator\Documents\Cable connections TV to computer.htm
2014-06-08 19:07 - 2014-06-08 19:07 - 00000000 ____D () C:\Users\A the Administrator\Documents\Cable connections TV to computer_files
2014-06-06 16:50 - 2009-07-14 00:13 - 00798316 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-06 12:31 - 2014-06-06 12:31 - 00001073 ____N () C:\Users\A the Administrator\Desktop\Dropbox.lnk
2014-06-06 12:29 - 2014-06-06 12:29 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-06-01 17:17 - 2012-12-23 19:16 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-30 12:49 - 2013-05-29 10:17 - 00000000 ____D () C:\Users\A the Administrator\Documents\Computer info
2014-05-29 17:37 - 2013-10-21 11:22 - 00277504 _____ () C:\Users\A the Administrator\Documents\CHEATSHEET NOW copy.xls
2014-05-26 08:53 - 2013-10-22 21:24 - 00000000 ____D () C:\Users\A the Administrator\Documents\Earl
2014-05-26 08:53 - 2013-05-29 10:18 - 00000000 ____D () C:\Users\A the Administrator\Documents\E cigs

Files to move or delete:
====================
C:\Users\A the Administrator\SaveAsPDFandXPS.exe

Some content of TEMP:
====================
C:\Users\A the Administrator\AppData\Local\Temp\6_Offer_15.exe
C:\Users\A the Administrator\AppData\Local\Temp\BackupSetup.exe
C:\Users\A the Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfmowb9.dll
C:\Users\A the Administrator\AppData\Local\Temp\i4jdel0.exe
C:\Users\A the Administrator\AppData\Local\Temp\Language_Translator.gadget.exe
C:\Users\A the Administrator\AppData\Local\Temp\Mobogenie550.exe
C:\Users\A the Administrator\AppData\Local\Temp\SpOrder.dll
C:\Users\A the Administrator\AppData\Local\Temp\Tsu3F5E7880.dll
C:\Users\A the Administrator\AppData\Local\Temp\Tsu56337359.dll
C:\Users\Guest\AppData\Local\Temp\msvcp100.dll
C:\Users\Guest\AppData\Local\Temp\msvcr100.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-21 00:19

==================== End Of Log ============================

 

 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 26 June 2014 - 10:47 AM

Clarifications on my post:

 

I received another warning from Resident Shield alert and have the text from it:  File name is PureLeads\sqlite3.dll. 

 

The threat name: Adware Generic5.AXWM. 

 

I removed it to the vault as a "power user." 

 

Computer reactions:  Web pages are displaying only partially with pieces (mostly at the bottom) missing and weird spacing.  There is a long lag between commands and actions - spinning wheels before doing what I've clicked on.

 

Hope that helps.  I'm really anxious to get this fixed.  Working is a challenge.

 

Thanks much,

 

Accentaa



#3 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 30 June 2014 - 06:35 AM

Oooooh Boy, Sure getting anxious here.  This is my first posting, have I done something wrong? 

 

Accentaa



#4 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,669 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:18 PM

Posted 30 June 2014 - 02:20 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/538997 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#5 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 30 June 2014 - 08:04 PM

Attached File  attach.zip   2.63KB   0 downloadsHello again,

 

Yes, I'm still having the problem and it's getting worse.  I'm not sure the PureLeads is causing the problems because it seems as though AVG corralled it. 

 

The description of the problem hasn't changed and I've done nothing else to try to fix it. 

 

Here is the DDS log just completed.  (DDS log - cut and paste --  "Attach" log - zipped and attached.)

 

--  Hope it helps.

 

Thanks again,

Accentaa

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17041
Run by A the Administrator at 19:48:28 on 2014-06-30
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.6051.3805 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Windows\system32\lsm.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe
C:\Windows\system32\CISVC.EXE
C:\Windows\system32\svchost.exe -k iissvcs
C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\RunDll32.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\TimeLeft3\TimeLeft.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mWinlogon: Userinit = userinit.exe,
BHO: AutorunsDisabled - <orphaned>
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [HP Officejet Pro 8600 (NET)] "C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN34OBXJDY05KC:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1
uRun: [Adobe Reader Synchronizer] "C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe"
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
StartupFolder: C:\Users\ATHEAD~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~1.LNK - C:\Windows\System32\RunDll32.exe
StartupFolder: C:\Users\ATHEAD~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\TimeLeft.lnk - C:\Program Files (x86)\TimeLeft3\TimeLeft.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://tweencam.tween-waters.com/AxisCamControl.ocx
DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} - hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.45.247.167:60001/activex/AMC.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{7358788D-CFC1-4B34-9EC1-B609BCB63740} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\2656C6B696E6534376 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\9445740435471697262796467656355796475637F57537473486374727F5F486 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\960586F6E656 : DHCPNameServer = 198.224.153.135 198.224.155.135
TCP: Interfaces\{CE6ADB20-EC7C-4270-BA1B-F042D81677AC}\E696472716D6 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{E3DCA80A-97F8-4194-97E0-CDAD5BAB270B} : DHCPNameServer = 198.224.159.135 198.224.158.135
TCP: Interfaces\{F925B909-CC29-43F7-BAB1-6959732054C7} : DHCPNameServer = 192.168.1.254
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-BHO: AutorunsDisabled - <orphaned>
x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [IntelWirelessWiMAX] "C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe" /tasktray /nosplash
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe"
x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe"
x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe"
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 dlkmdldr;dlkmdldr;C:\Windows\System32\drivers\dlkmdldr.sys [2014-3-17 13936]
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2014-1-25 268512]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\Windows\System32\drivers\Thpevm.sys [2009-6-29 14784]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;C:\Windows\System32\drivers\avgldx64.sys [2012-12-23 282976]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;C:\Windows\System32\drivers\avgmfx64.sys [2012-12-23 35664]
R1 AvgTdiA;AVG Free Network Redirector x64;C:\Windows\System32\drivers\avgtdia.sys [2012-12-23 317520]
R2 avg9wd;AVG Free WatchDog;C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [2012-12-23 308136]
R2 cbVSCService11;Cobian Backup 11 Volume Shadow Copy Requester;C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [2014-6-24 67584]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-1-28 249200]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 DisplayLinkService;DisplayLinkManager;C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [2011-4-10 9663848]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2012-7-18 514048]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 133928]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2012-7-18 979456]
R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\Windows\System32\drivers\bpenum.sys [2012-7-3 84480]
R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\Windows\System32\drivers\bpusb.sys [2012-7-3 84992]
R3 dlkmd;dlkmd;C:\Windows\System32\drivers\dlkmd.sys [2014-3-17 206960]
R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-7-9 169752]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-3-12 342528]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-3-11 347872]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-15 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-15 180736]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 AX88178;ASIX AX88178 USB2.0 to Gigabit Ethernet Adapter;C:\Windows\System32\drivers\ax88178.sys [2010-11-23 59392]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\System32\drivers\bpmp.sys [2012-7-3 182272]
S3 DisplayLinkUsbPort;DisplayLink USB Device;C:\Windows\System32\drivers\DisplayLinkUsbPort_5.6.31854.0.sys [2011-4-10 17408]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-1-8 58056]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-3-31 1512640]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-5-24 111616]
S3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2011-5-26 174680]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2012-3-26 22528]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-5-2 19456]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-11-12 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-5-2 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-12-23 1255736]
S4 plsapp;plsapp;C:\Program Files (x86)\PureLeads\plsapp.exe --> C:\Program Files (x86)\PureLeads\plsapp.exe [?]
S4 PlsvcV1;PlsvcV1;C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [2014-1-23 91936]
S4 PlsvcV2;PlsvcV2;C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [2014-1-23 24352]
.
=============== Created Last 30 ================
.
2014-06-30 21:00:50 10779000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7C2DDCE5-30AB-426F-BFA2-DC8BCA1E5B24}\mpengine.dll
2014-06-29 20:25:47 10779000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-25 11:30:37 -------- d-----w- C:\Users\A the Administrator\AppData\Local\Adobe
2014-06-24 20:17:41 -------- d-----w- C:\A the Administrator 2014-06-24 15;17;41 (Full)
2014-06-24 20:01:27 -------- d-----w- C:\Program Files (x86)\Cobian Backup 11
2014-06-24 17:47:48 -------- d-----w- C:\FRST
2014-06-24 01:59:52 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{67330303-A0C8-4F96-9D8B-160DCA15F69D}\gapaengine.dll
2014-06-17 15:30:23 -------- d-----w- C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate
2014-06-17 15:25:35 -------- d-----w- C:\Windows\SysWow64\Adobe
2014-06-06 17:31:19 -------- d-----r- C:\Users\A the Administrator\Dropbox
2014-06-06 17:30:17 -------- d-----w- C:\Users\A the Administrator\AppData\Roaming\DropboxMaster
2014-06-06 17:27:59 -------- d-----w- C:\Users\A the Administrator\AppData\Roaming\Dropbox
.
==================== Find3M  ====================
.
2014-06-25 01:18:22 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-25 01:18:22 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-05-24 15:59:06 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-05-24 15:59:06 194048 ----a-w- C:\Windows\SysWow64\elshyph.dll
2014-05-10 22:35:54 5905904 ----a-w- C:\Windows\System32\GfxUI.exe
2014-05-10 22:35:53 175104 ----a-w- C:\Windows\System32\gfxSrvc.dll
2014-04-14 02:24:46 465408 ----a-w- C:\Windows\System32\aepdu.dll
2014-04-14 02:19:37 424448 ----a-w- C:\Windows\System32\aeinv.dll
2013-11-15 16:10:22 378 ----a-w- C:\Program Files (x86)\temp995.bat
2013-03-16 21:39:04 51300952 ----a-w- C:\Program Files\HRBlock_Basic+Efile (1).exe
.
============= FINISH: 19:49:42.65 ===============
 

 



#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,256 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:18 PM

Posted 01 July 2014 - 08:47 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

--RogueKiller--
  • Download & SAVE to your Desktop For 32bit system or For 64bit system
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller+
=======

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Uncheck the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the correct version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Wait for further instructions.

#7 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 01 July 2014 - 11:51 AM

Hi nasdaq,  (Great name.)

 

Thanks for your help.  I've completed everything and have the various logs labeled and posted below.  I didn't receive the attach.txt with the FRST run.

 

I'm looking forward to your replay.

 

Accentaa

 

 

 

RK Report

 

RogueKiller V9.1.0.0 (x64) [Jun 23 2014] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : A the Administrator [Admin rights]

Mode : Remove -- Date : 07/01/2014  11:02:25

 

¤¤¤ Bad processes : 0 ¤¤¤

 

¤¤¤ Registry Entries : 27 ¤¤¤

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{E3DCA80A-97F8-4194-97E0-CDAD5BAB270B} | DhcpNameServer : 198.224.159.135 198.224.158.135  -> NOT SELECTED

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{E3DCA80A-97F8-4194-97E0-CDAD5BAB270B} | DhcpNameServer : 198.224.159.135 198.224.158.135  -> NOT SELECTED

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{E3DCA80A-97F8-4194-97E0-CDAD5BAB270B} | DhcpNameServer : 198.224.159.135 198.224.158.135  -> NOT SELECTED

[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> NOT SELECTED

[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0  -> NOT SELECTED

[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0  -> NOT SELECTED

[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0  -> NOT SELECTED

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> NOT SELECTED

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> NOT SELECTED

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> NOT SELECTED

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> NOT SELECTED

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> NOT SELECTED

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> NOT SELECTED

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 2  -> NOT SELECTED

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> NOT SELECTED

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> NOT SELECTED

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowDownloads : 2  -> NOT SELECTED

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> NOT SELECTED

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1820053979-2075085244-1934946815-1007\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> NOT SELECTED

 

¤¤¤ Scheduled tasks : 0 ¤¤¤

 

¤¤¤ Files : 0 ¤¤¤

 

¤¤¤ HOSTS File : 1 ¤¤¤

[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1  localhost

 

¤¤¤ Antirootkit : 0 ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK6475GSX ATA Device +++++

--- User ---

[MBR] 2eb6dd9d6409074e1d16ee8cbe815266

[BSP] 511700816bc1d28bbd96ad8c3d5f6d1b : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 610378 MB

User = LL1 ... OK

User = LL2 ... OK

 

 

============================================

RKreport_SCN_07012014_105014.log - RKreport_DEL_07012014_105214.log - RKreport_SCN_07012014_105753.log

 

 

AdwCleaner Report

 

# AdwCleaner v3.214 - Report created 01/07/2014 at 11:08:49

# Updated 29/06/2014 by Xplode

# Operating System : Windows 7 Professional Service Pack 1 (64 bits)

# Username : A the Administrator - AMANDA-TOSHIBA

# Running from : C:\Users\A the Administrator\Desktop\adwcleaner_3.214.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17041

 

 

-\\ Google Chrome v

 

[ File : C:\Users\A the Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

[ File : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [8317 octets] - [28/10/2013 14:57:25]

AdwCleaner[R1].txt - [5964 octets] - [11/05/2014 15:04:21]

AdwCleaner[R2].txt - [1196 octets] - [11/05/2014 15:22:26]

AdwCleaner[R3].txt - [1493 octets] - [24/06/2014 19:29:55]

AdwCleaner[R4].txt - [2139 octets] - [01/07/2014 11:08:49]

AdwCleaner[S0].txt - [8019 octets] - [28/10/2013 15:04:31]

AdwCleaner[S1].txt - [5720 octets] - [11/05/2014 15:07:27]

AdwCleaner[S2].txt - [1258 octets] - [11/05/2014 15:24:38]

AdwCleaner[S3].txt - [1560 octets] - [24/06/2014 19:35:21]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R4].txt - [2439 octets] ##########

 

 

Post “Clean” Report

 

# AdwCleaner v3.214 - Report created 01/07/2014 at 11:14:03

# Updated 29/06/2014 by Xplode

# Operating System : Windows 7 Professional Service Pack 1 (64 bits)

# Username : A the Administrator - AMANDA-TOSHIBA

# Running from : C:\Users\A the Administrator\Desktop\adwcleaner_3.214.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.17041

 

 

-\\ Google Chrome v

 

[ File : C:\Users\A the Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

[ File : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [8317 octets] - [28/10/2013 14:57:25]

AdwCleaner[R1].txt - [5964 octets] - [11/05/2014 15:04:21]

AdwCleaner[R2].txt - [1196 octets] - [11/05/2014 15:22:26]

AdwCleaner[R3].txt - [1493 octets] - [24/06/2014 19:29:55]

AdwCleaner[R4].txt - [2535 octets] - [01/07/2014 11:08:49]

AdwCleaner[S0].txt - [8019 octets] - [28/10/2013 15:04:31]

AdwCleaner[S1].txt - [5720 octets] - [11/05/2014 15:07:27]

AdwCleaner[S2].txt - [1258 octets] - [11/05/2014 15:24:38]

AdwCleaner[S3].txt - [1560 octets] - [24/06/2014 19:35:21]

AdwCleaner[S4].txt - [2462 octets] - [01/07/2014 11:14:03]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [2522 octets] ##########

 

 

FRST Log

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2014

Ran by A the Administrator (administrator) on AMANDA-TOSHIBA on 01-07-2014 11:29:54

Running from C:\Users\A the Administrator\Desktop

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

 

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe

(CobianSoft, Luis Cobian) C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe

(Microsoft Corporation) C:\Windows\System32\CISVC.EXE

(Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgnsa.exe

(Microsoft Corporation) C:\Windows\System32\alg.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe

(Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgtray.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe

(NesterSoft Inc.) C:\Program Files (x86)\TimeLeft3\TimeLeft.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe

(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

 

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [IntelWirelessWiMAX] => C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe [1626112 2012-07-25] (Intel® Corporation)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM-x32\...\Run: [AVG9_TRAY] => C:\Program Files (x86)\AVG\AVG9\avgtray.exe [2077536 2012-12-24] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HWSetup] => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)

HKLM-x32\...\Run: [] => [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe [698760 2013-12-21] (Adobe Systems Incorporated)

HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2014-05-24] (Google Inc.)

HKU\S-1-5-21-1820053979-2075085244-1934946815-1007\...\Policies\system: [DisableLockWorkstation] 0

AppInit_DLLs: avgrssta.dll => C:\Windows\system32\avgrssta.dll [13048 2012-12-23] (AVG Technologies CZ, s.r.o.)

Startup: C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk

ShortcutTarget: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

Startup: C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimeLeft.lnk

ShortcutTarget: TimeLeft.lnk -> C:\Program Files (x86)\TimeLeft3\TimeLeft.exe (NesterSoft Inc.)

ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE62CF440895CCE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {8C6AB8FA-BE78-430B-A25D-045C1391C492} URL = https://www.google.com/search?q={searchTerms}

BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://tweencam.tween-waters.com/AxisCamControl.ocx

DPF: HKLM-x32 {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {DE625294-70E6-45ED-B895-CFFA13AEB044} http://216.45.247.167:60001/activex/AMC.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Hosts: 127.0.0.1          localhost

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1212152.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Microsoft.com/DownloadManager,version=1.1 - C:\Windows\ ()

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\A the Administrator\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\A the Administrator\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox

 

Chrome:

=======

CHR HomePage: hxxp://www.google.com/

CHR RestoreOnStartup: "hxxp://www.google.com/"

CHR HKLM-x32\...\Chrome\Extension: [cgpimkfhjdaobobdomcikioipaenlhke] - \CRE\cgpimkfhjdaobobdomcikioipaenlhke.crx []

 

==================== Services (Whitelisted) =================

 

R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2012-12-24] (AVG Technologies CZ, s.r.o.)

R2 cbVSCService11; C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [67584 2013-03-07] (CobianSoft, Luis Cobian) [File not signed]

R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [9663848 2011-04-10] (DisplayLink Corp.)

R2 DMAgent; C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [514048 2012-07-18] (Red Bend Ltd.) [File not signed]

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

S4 PlsvcV1; C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [91936 2014-01-23] (PureLeads)

S4 PlsvcV2; C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [24352 2014-01-23] (sendori)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

R2 WiMAXAppSrv; C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [979456 2012-07-18] (Intel® Corporation) [File not signed]

S4 plsapp; C:\Program Files (x86)\PureLeads\plsapp.exe [X]

 

==================== Drivers (Whitelisted) ====================

 

R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.)

R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2012-12-23] (AVG Technologies CZ, s.r.o.)

R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2012-12-23] (AVG Technologies CZ, s.r.o.)

S3 AX88178; C:\Windows\System32\DRIVERS\ax88178.sys [59392 2010-11-23] (ASIX Electronics Corp.)

S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_5.6.31854.0.sys [17408 2011-04-10] (http://libusb-win32.sourceforge.net)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-03-26] (Apple Inc.) [File not signed]

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2014-07-01 11:29 - 2014-07-01 11:29 - 00015814 _____ () C:\Users\A the Administrator\Desktop\FRST.txt

2014-07-01 11:27 - 2014-07-01 11:28 - 02083328 _____ (Farbar) C:\Users\A the Administrator\Desktop\FRST64.exe

2014-07-01 11:07 - 2014-07-01 11:07 - 01346519 _____ () C:\Users\A the Administrator\Desktop\adwcleaner_3.214.exe

2014-07-01 10:39 - 2014-07-01 10:39 - 00000000 ____D () C:\ProgramData\RogueKiller

2014-07-01 10:30 - 2014-07-01 10:31 - 05283416 _____ () C:\Users\A the Administrator\Desktop\RogueKillerX64.exe

2014-06-25 13:37 - 2014-06-25 13:37 - 00688992 _____ (Swearware) C:\Users\A the Administrator\Downloads\dds.com

2014-06-25 06:30 - 2014-06-25 06:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe

2014-06-24 21:16 - 2014-06-24 21:16 - 00000000 _____ () C:\Users\A the Administrator\defogger_reenable

2014-06-24 15:17 - 2014-06-24 19:21 - 00000000 ____D () C:\A the Administrator 2014-06-24 15;17;41 (Full)

2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cobian Backup 11

2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\Program Files (x86)\Cobian Backup 11

2014-06-24 14:58 - 2014-06-24 14:58 - 19709440 _____ (Luis Cobian, CobianSoft) C:\Users\A the Administrator\Downloads\cbSetup.exe

2014-06-24 12:47 - 2014-07-01 11:29 - 00000000 ____D () C:\FRST

2014-06-17 10:30 - 2014-06-17 10:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate

2014-06-17 10:29 - 2014-06-17 10:37 - 00000000 ____D () C:\Users\A the Administrator\Documents\My Digital Editions

2014-06-17 10:29 - 2014-06-17 10:29 - 00002254 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk

2014-06-17 10:29 - 2014-06-17 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2014-06-17 10:25 - 2014-06-17 10:30 - 00000000 ____D () C:\Windows\SysWOW64\Adobe

2014-06-17 10:13 - 2014-06-17 10:12 - 18816968 _____ (Bitberry Software ) C:\Users\A the Administrator\Downloads\FreeFileViewerSetup.exe

2014-06-15 22:08 - 2014-06-15 22:08 - 00005000 _____ () C:\Users\A the Administrator\AppData\Local\recently-used.xbel

2014-06-08 19:07 - 2014-06-08 19:07 - 00054270 ____N () C:\Users\A the Administrator\Documents\Cable connections TV to computer.htm

2014-06-08 19:07 - 2014-06-08 19:07 - 00000000 ____D () C:\Users\A the Administrator\Documents\Cable connections TV to computer_files

2014-06-06 12:31 - 2014-06-09 16:28 - 00000000 ___RD () C:\Users\A the Administrator\Dropbox

2014-06-06 12:30 - 2014-06-09 16:28 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\DropboxMaster

2014-06-06 12:29 - 2014-06-06 12:29 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-06-06 12:27 - 2014-06-20 17:51 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Dropbox

2014-06-05 15:23 - 2014-07-01 10:27 - 00004006 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3FD717AA-1F60-4979-A8D3-3CF186CBBF16}

 

==================== One Month Modified Files and Folders =======

 

2014-07-01 11:30 - 2014-07-01 11:29 - 00015814 _____ () C:\Users\A the Administrator\Desktop\FRST.txt

2014-07-01 11:29 - 2014-06-24 12:47 - 00000000 ____D () C:\FRST

2014-07-01 11:29 - 2009-07-13 23:45 - 00025904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-01 11:29 - 2009-07-13 23:45 - 00025904 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-01 11:28 - 2014-07-01 11:27 - 02083328 _____ (Farbar) C:\Users\A the Administrator\Desktop\FRST64.exe

2014-07-01 11:27 - 2014-05-24 11:16 - 00000924 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-01 11:25 - 2013-10-25 16:55 - 01309643 _____ () C:\Windows\WindowsUpdate.log

2014-07-01 11:23 - 2014-05-24 11:16 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-01 11:20 - 2013-11-17 13:01 - 00008216 _____ () C:\Windows\setupact.log

2014-07-01 11:20 - 2013-05-02 12:54 - 00000441 _____ () C:\Windows\system32\Drivers\etc\hosts.ics

2014-07-01 11:20 - 2012-12-23 19:01 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-01 11:20 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-01 11:18 - 2013-11-22 21:50 - 00137850 _____ () C:\Windows\PFRO.log

2014-07-01 11:14 - 2013-10-28 14:56 - 00000000 ____D () C:\AdwCleaner

2014-07-01 11:07 - 2014-07-01 11:07 - 01346519 _____ () C:\Users\A the Administrator\Desktop\adwcleaner_3.214.exe

2014-07-01 10:39 - 2014-07-01 10:39 - 00000000 ____D () C:\ProgramData\RogueKiller

2014-07-01 10:31 - 2014-07-01 10:30 - 05283416 _____ () C:\Users\A the Administrator\Desktop\RogueKillerX64.exe

2014-07-01 10:27 - 2014-06-05 15:23 - 00004006 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3FD717AA-1F60-4979-A8D3-3CF186CBBF16}

2014-07-01 10:17 - 2013-05-29 10:19 - 00000000 ____D () C:\Users\A the Administrator\Documents\misc docs

2014-07-01 10:16 - 2013-05-29 10:17 - 00000000 ____D () C:\Users\A the Administrator\Documents\COSMO

2014-07-01 10:16 - 2013-05-29 10:17 - 00000000 ____D () C:\Users\A the Administrator\Documents\Computer info

2014-07-01 10:15 - 2013-05-29 10:22 - 00000000 ____D () C:\Users\A the Administrator\Documents\Writing

2014-07-01 10:14 - 2013-10-22 21:24 - 00000000 ____D () C:\Users\A the Administrator\Documents\Earl

2014-07-01 10:13 - 2013-05-29 10:19 - 00000000 ____D () C:\Users\A the Administrator\Documents\Matt

2014-07-01 10:12 - 2013-12-27 17:06 - 01062400 ___SH () C:\Users\A the Administrator\Desktop\Thumbs.db

2014-07-01 03:42 - 2012-12-23 21:28 - 00000000 ____D () C:\Windows\system32\Drivers\Avg

2014-06-30 21:28 - 2013-11-21 16:07 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\CrashDumps

2014-06-29 13:00 - 2014-02-20 15:59 - 00000000 ____D () C:\writeitnow4

2014-06-26 10:44 - 2014-04-25 18:03 - 00000000 ____D () C:\Program Files (x86)\PureLeads

2014-06-25 13:37 - 2014-06-25 13:37 - 00688992 _____ (Swearware) C:\Users\A the Administrator\Downloads\dds.com

2014-06-25 06:30 - 2014-06-25 06:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe

2014-06-24 21:16 - 2014-06-24 21:16 - 00000000 _____ () C:\Users\A the Administrator\defogger_reenable

2014-06-24 21:16 - 2013-05-29 10:03 - 00000000 ____D () C:\Users\A the Administrator

2014-06-24 20:18 - 2012-12-23 19:01 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-06-24 20:18 - 2012-12-23 19:01 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-06-24 20:18 - 2012-12-23 19:01 - 00003770 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-06-24 19:21 - 2014-06-24 15:17 - 00000000 ____D () C:\A the Administrator 2014-06-24 15;17;41 (Full)

2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cobian Backup 11

2014-06-24 15:01 - 2014-06-24 15:01 - 00000000 ____D () C:\Program Files (x86)\Cobian Backup 11

2014-06-24 14:58 - 2014-06-24 14:58 - 19709440 _____ (Luis Cobian, CobianSoft) C:\Users\A the Administrator\Downloads\cbSetup.exe

2014-06-23 21:45 - 2013-05-29 10:18 - 00000000 ____D () C:\Users\A the Administrator\Documents\Home Affordable

2014-06-21 14:08 - 2014-05-30 09:54 - 00000000 ____D () C:\Users\A the Administrator\Documents\Libby

2014-06-20 17:51 - 2014-06-06 12:27 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Dropbox

2014-06-18 15:49 - 2013-05-29 10:09 - 00000000 ____D () C:\Users\A the Administrator\Documents\Carrot English

2014-06-18 12:22 - 2014-05-24 11:16 - 00003920 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-18 12:22 - 2014-05-24 11:16 - 00003668 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-18 12:06 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-06-17 10:37 - 2014-06-17 10:29 - 00000000 ____D () C:\Users\A the Administrator\Documents\My Digital Editions

2014-06-17 10:36 - 2013-12-26 22:15 - 00321536 _____ () C:\Users\A the Administrator\Documents\CHEATSHEET ONLY.xls

2014-06-17 10:30 - 2014-06-17 10:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Local\Adobe_Systems_Incorporate

2014-06-17 10:30 - 2014-06-17 10:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe

2014-06-17 10:29 - 2014-06-17 10:29 - 00002254 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk

2014-06-17 10:29 - 2014-06-17 10:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2014-06-17 10:29 - 2013-05-10 01:43 - 00000000 ____D () C:\Program Files (x86)\Adobe

2014-06-17 10:12 - 2014-06-17 10:13 - 18816968 _____ (Bitberry Software ) C:\Users\A the Administrator\Downloads\FreeFileViewerSetup.exe

2014-06-16 06:47 - 2013-05-29 11:09 - 00000000 ____D () C:\Users\A the Administrator\.gimp-2.8

2014-06-15 22:08 - 2014-06-15 22:08 - 00005000 _____ () C:\Users\A the Administrator\AppData\Local\recently-used.xbel

2014-06-09 16:28 - 2014-06-06 12:31 - 00000000 ___RD () C:\Users\A the Administrator\Dropbox

2014-06-09 16:28 - 2014-06-06 12:30 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\DropboxMaster

2014-06-08 19:07 - 2014-06-08 19:07 - 00054270 ____N () C:\Users\A the Administrator\Documents\Cable connections TV to computer.htm

2014-06-08 19:07 - 2014-06-08 19:07 - 00000000 ____D () C:\Users\A the Administrator\Documents\Cable connections TV to computer_files

2014-06-06 16:50 - 2009-07-14 00:13 - 00798316 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-06-06 12:29 - 2014-06-06 12:29 - 00000000 ____D () C:\Users\A the Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-06-01 17:17 - 2012-12-23 19:16 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

 

Files to move or delete:

====================

C:\Users\A the Administrator\SaveAsPDFandXPS.exe

 

 

Some content of TEMP:

====================

C:\Users\A the Administrator\AppData\Local\Temp\6_Offer_15.exe

C:\Users\A the Administrator\AppData\Local\Temp\BackupSetup.exe

C:\Users\A the Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfmowb9.dll

C:\Users\A the Administrator\AppData\Local\Temp\i4jdel0.exe

C:\Users\A the Administrator\AppData\Local\Temp\Language_Translator.gadget.exe

C:\Users\A the Administrator\AppData\Local\Temp\Mobogenie550.exe

C:\Users\A the Administrator\AppData\Local\Temp\Quarantine.exe

C:\Users\A the Administrator\AppData\Local\Temp\SpOrder.dll

C:\Users\A the Administrator\AppData\Local\Temp\Tsu3F5E7880.dll

C:\Users\A the Administrator\AppData\Local\Temp\Tsu56337359.dll

C:\Users\Guest\AppData\Local\Temp\msvcp100.dll

C:\Users\Guest\AppData\Local\Temp\msvcr100.dll

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2014-06-21 00:19

 

==================== End Of Log ============================



#8 nasdaq

nasdaq

  • Malware Response Team
  • 39,256 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:18 PM

Posted 02 July 2014 - 06:45 AM

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox
CHR HKLM-x32\...\Chrome\Extension: [cgpimkfhjdaobobdomcikioipaenlhke] - \CRE\cgpimkfhjdaobobdomcikioipaenlhke.crx []
S4 PlsvcV1; C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [91936 2014-01-23] (PureLeads)
S4 PlsvcV2; C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [24352 2014-01-23] (sendori)
S4 plsapp; C:\Program Files (x86)\PureLeads\plsapp.exe [X]
C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe
C:\Program Files (x86)\PureLeads\PureLeads.Service.exe
C:\Users\A the Administrator\SaveAsPDFandXPS.exe
C:\Users\A the Administrator\AppData\Local\Temp\6_Offer_15.exe
C:\Users\A the Administrator\AppData\Local\Temp\BackupSetup.exe
C:\Users\A the Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfmowb9.dll
C:\Users\A the Administrator\AppData\Local\Temp\i4jdel0.exe
C:\Users\A the Administrator\AppData\Local\Temp\Language_Translator.gadget.exe
C:\Users\A the Administrator\AppData\Local\Temp\Mobogenie550.exe
C:\Users\A the Administrator\AppData\Local\Temp\Quarantine.exe
C:\Users\A the Administrator\AppData\Local\Temp\SpOrder.dll
C:\Users\A the Administrator\AppData\Local\Temp\Tsu3F5E7880.dll
C:\Users\A the Administrator\AppData\Local\Temp\Tsu56337359.dll
C:\Users\Guest\AppData\Local\Temp\msvcp100.dll
C:\Users\Guest\AppData\Local\Temp\msvcr100.dll

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/

How is the computer running now?

#9 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 02 July 2014 - 03:43 PM

I can't tell you how much I appreciate this - your time & effort as a volunteer.  -  I think all is working well now but I haven't spent much time on it since the fix.  The only thing that still isn't working right is Windows Live Mail but I've done something to it - lost all my mail - years of receipts, necessary papers...... May I ask a couple questions?  I sure miss my Google toolbar.  Is that just a big hazard?  If not should I stay away from the helper and updater? -  What was causing the cross-scripting?  Do I need to be careful downloading anything from Java and Adobe?  They always seem to cause headaches.  And, one more - what were the major culprits?  I'd like to stay away from whatever I was doing that caused it.

 

Thanks again,

 

Here are the reports.

 

Amanda

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2014

Ran by A the Administrator at 2014-07-02 10:16:15 Run:1

Running from C:\Users\A the Administrator\Desktop\FRST

Boot Mode: Normal

==============================================

 


Content of fixlist:

*****************

start

HKLM-x32\...\Run: [] => [X]

ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers-x32: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File

SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

SearchScopes: HKLM-x32 - DefaultScope value is missing.

Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF HKLM\...\Firefox\Extensions: [{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}] - C:\Program Files\Updater By SweetPacks\Firefox

CHR HKLM-x32\...\Chrome\Extension: [cgpimkfhjdaobobdomcikioipaenlhke] - \CRE\cgpimkfhjdaobobdomcikioipaenlhke.crx []

S4 PlsvcV1; C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe [91936 2014-01-23] (PureLeads)

S4 PlsvcV2; C:\Program Files (x86)\PureLeads\PureLeads.Service.exe [24352 2014-01-23] (sendori)

S4 plsapp; C:\Program Files (x86)\PureLeads\plsapp.exe [X]

C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe

C:\Program Files (x86)\PureLeads\PureLeads.Service.exe

C:\Users\A the Administrator\SaveAsPDFandXPS.exe

C:\Users\A the Administrator\AppData\Local\Temp\6_Offer_15.exe

C:\Users\A the Administrator\AppData\Local\Temp\BackupSetup.exe

C:\Users\A the Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfmowb9.dll

C:\Users\A the Administrator\AppData\Local\Temp\i4jdel0.exe

C:\Users\A the Administrator\AppData\Local\Temp\Language_Translator.gadget.exe

C:\Users\A the Administrator\AppData\Local\Temp\Mobogenie550.exe

C:\Users\A the Administrator\AppData\Local\Temp\Quarantine.exe

C:\Users\A the Administrator\AppData\Local\Temp\SpOrder.dll

C:\Users\A the Administrator\AppData\Local\Temp\Tsu3F5E7880.dll

C:\Users\A the Administrator\AppData\Local\Temp\Tsu56337359.dll

C:\Users\Guest\AppData\Local\Temp\msvcp100.dll

C:\Users\Guest\AppData\Local\Temp\msvcr100.dll

 

End

*****************

 

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4' => Key deleted successfully.

'HKLM\Software\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

'HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4' => Key deleted successfully.

'HKLM\Software\Wow6432Node\Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}'=> Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

'HKCR\PROTOCOLS\Filter\text/xml' => Key deleted successfully.

'HKCR\CLSID\{807553E5-5146-11D5-A672-00B0D022E945}'=> Key not found.

'HKLM\Software\MozillaPlugins\FF Plugin: @microsoft.com/GENUINE - disabled No File'=> Key not found.

"FF Plugin: @microsoft.com/GENUINE - disabled No File" => not found.

'HKLM\Software\Wow6432Node\MozillaPlugins\FF Plugin-x32: @microsoft.com/GENUINE - disabled No File'=> Key not found.

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File not found.

HKLM\Software\Mozilla\Firefox\Extensions\\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} => value deleted successfully.

'HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cgpimkfhjdaobobdomcikioipaenlhke' => Key deleted successfully.

"\CRE\cgpimkfhjdaobobdomcikioipaenlhke.crx" => File/Directory not found.

PlsvcV1 => Service deleted successfully.

PlsvcV2 => Service deleted successfully.

plsapp => Service deleted successfully.

C:\Program Files (x86)\PureLeads\PureLeadsSvc.exe => Moved successfully.

C:\Program Files (x86)\PureLeads\PureLeads.Service.exe => Moved successfully.

C:\Users\A the Administrator\SaveAsPDFandXPS.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\6_Offer_15.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\BackupSetup.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfmowb9.dll => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\i4jdel0.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\Language_Translator.gadget.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\Mobogenie550.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\Quarantine.exe => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\SpOrder.dll => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\Tsu3F5E7880.dll => Moved successfully.

C:\Users\A the Administrator\AppData\Local\Temp\Tsu56337359.dll => Moved successfully.

C:\Users\Guest\AppData\Local\Temp\msvcp100.dll => Moved successfully.

C:\Users\Guest\AppData\Local\Temp\msvcr100.dll => Moved successfully.

 

==== End of Fixlog ====

 

 


Checkup Text

 

Results of screen317's Security Check version 0.99.85 

 Windows 7 Service Pack 1 x64 (UAC is disabled!) 

 Internet Explorer 11 

``````````````Antivirus/Firewall Check:``````````````

 Windows Firewall Enabled! 

Microsoft Security Essentials  

AVG Anti-Virus Free            

 Antivirus up to date!  

`````````Anti-malware/Other Utilities Check:`````````

 Malwarebytes Anti-Malware version 1.75.0.1300 

 Adobe Reader XI 

````````Process Check: objlist.exe by Laurent```````` 

 Microsoft Security Essentials MSMpEng.exe

 Microsoft Security Essentials msseces.exe

 AVG avgwdsvc.exe

 AVG avgtray.exe

`````````````````System Health check`````````````````

 Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````



#10 nasdaq

nasdaq

  • Malware Response Team
  • 39,256 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:18 PM

Posted 03 July 2014 - 06:47 AM

I sure miss my Google toolbar


Google Toolbar is already built into Chrome, if using Internet Explorer reinstall it.

http://www.google.com/toolbar/ie/index.html
===

What we remove is all the PUP (Potentially Unwanted Program) installed without your consent.

If you download and install a program to try it some of the freebees are adding these PUP - Unwanted program.

Malwarebytes can protect you against all know PUP malware.
===

Your Security Log is clean.

===

If all is well:

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates or get into the habit of checking Windows Update regularly. They usually have security updates every month. You can set Windows to notify you of Updates so that you can choose, but only do this if you believe you are able to understand which ones are needed. This is a crucial security measure.

Having an effective antivirus is a must for everyone.
In addition to many excellent commercial products there are plenty of good free antivirus programs available. I can recommend:

If you are satisfied with your current protection programs you can ignore the instructions on Antivirus or Firewall listed below.In addition to an antivirus I recommend using a firewall. A software firewall is a software program that helps screen out hackers, viruses, and worms that try to reach your computer over the Internet. I can recommend one of the following free products:Please note: Many installer offer third-party downloads that are installed automatically when you do not uncheck certain checkboxes. While most of the time not being malicious you usually do not want these on your computer. Be careful during the installation process and you will avoid seeing tons of new unwanted toolbars in your favorite web browser.

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:

Malwarebytes Anti-Malware (MBAM)
The free version of MBAM can be used to scan the system for traces of malware. Scanning your system regularly will make it harder for malware to reside on your system.
A tutorial on using MBAM can be found here.
Please Note: Only the paid for version has real time capabilities.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you can find out if it is a rogue here:A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.

Please keep your programs up to date. This applies to Java, Adobe Flashplayer, Adobe Reader and your Internet Browsers in particular. Vulnerabilities in these programs are often exploited in order to install malware on your PC. Visiting a prepared web page suffices to infect your system.

In general Firefox, Opera and Google Chrome are considered to be more secure than Internet Explorer. In addition there are many useful add-ons that can protect you from possible risks:
  • WOT will warn you when you try to visit sites with poor reputation. The reputation is based on user ratings and is usually very accurate.
  • Script Blocker can help blocking many attempts to infect your system via malicious websites by only allowing scripts at sites you trust.
  • NoScript is a popular Firefox addon,
  • ScriptNo a popular Google Chrome addon.
For much more useful information, please also read Tony Klein's excellent article: How did I get infected in the first place

Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help.
===

#11 accentaa

accentaa
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:04:18 PM

Posted 03 July 2014 - 11:08 AM

Thank you again for all the help, information and links – and especially your time. May I ask a few clarification questions? You’ve gone way beyond with me and I can certainly look elsewhere for the answers.

Thanks for the good link to Google toolbar – hard to find a clean one.

I believe the anti virus programs you listed were your recommended ones. I have AVG but wasn’t sure how effective it was. I also have Malware bytes – free version – so it’s not operating in real time, right? Is that the same as passive? Active programs open on start-up and passive need to be manually opened? (I’ll read the tutorial you linked.)

The differences between Malware programs, firewall and anti-virus programs has always been confusing to me and I’ve been concerned about having conflicting operations going on. Is the windows firewall insufficient? One of your recommendations more effective and is there a problem with running both?

Do Anti-virus programs not catch malware? Both are needed for better protection?

Does Windows update automatically update Java, Adobe and Browsers? I’m never sure if I’m selected the right updates, is my clue just to download updates for what’s operating on my system?

Script problems. I’ve messed with the settings before without knowing what they are or what they do. Can you point me to some basic info that will explain enough to keep me out of trouble?

I wish I could use Chrome or Firefox but can’t with my work software. Just stuck and worse, lost paid version of Office 2007 (removed by computer repair person) & dealing with the conflicts of 2003. (All he had on hand!)

Sorry for the additional work – links will work if that will take less of your time. I’m just grateful to have a comprehensive scope of issues that have confused me for ages and that ignorance causing repeated issues.

I’ll read Tony Klein’s article and anything else you suggest.

Thank you again for your valuable time and excellent, professional …..and free help!

Take care,

Amanda

#12 nasdaq

nasdaq

  • Malware Response Team
  • 39,256 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:18 PM

Posted 04 July 2014 - 08:06 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users