Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

multiple infections (vundo, catchme), black screen


  • This topic is locked This topic is locked
25 replies to this topic

#1 fiftygrit

fiftygrit

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 03 August 2014 - 05:29 AM

Hello
I have really stuffed up my computer this time. My problem originated, I believe, when I downloaded HijackThis from a lookalike web site.  This may have been complicated due to trying to activate another application that suggested that I turn off the firewall (I was tired and not paying attention to what I was doing).  The following describes my situation:

  • History: Two months ago, I got malware that had significant impact to PC performance (described above).  Through 20+ scans in safe mode I was able to clean the machine (rKill, JRT, AVAST, Adwcleaner and others were used).  Please see Stopzilla log for issues revealed.  Found: Downloader C, vundo.A7, Win32.cognala, catchme, DisableRegistryTools, DisableTaskManager and others.
  • Since then I suspected that something nasty remained.  Whenever I performed an RKill and JTR, Stopzilla found DisableRegistryTools and DisableTaskManager.  I sent a diagnostic scan to Stopzilla twice and they found nothing.
  • Occasionally my weekly scans would reveal a a malware or two (I forgot which) but there was no other apparent affect on my PC.  I am not aware that my online activities would otherwise attract nasties.
  • Now: During the week, a family member was working on the PC and accepted something (does not recall what).  I turned on the PC a few hours later and the bootup process was very slow, the windows graphic appears and I hear the MS chime but the screen turns black.  This has since happened continuously in normal mode.  I have waited to see if the black screen is replaced by the user login screen (but no longer than 15 minutes).
  • In safe mode, I am able to scan using Stopzilla and the similar nasties that were discovered previously are discovered again.  This only occurs after performing other scans.  If Stopzilla scans just after a restar, nothing is found.  I attempted to perform scans using other antimalware applications and they are somehow prevented from working (AVAST, JTR, rootkitremover and RootkitBuster).  Scans using Superantispyware, Malwarebytes, EEK, Adwcleaner, Rougekiller and Combofix reveal nothing that I can see is malware.
Attached is DSS scan.  Attach and the Stopzilla event log is available.
 
Attached File  DDS 140803.txt   15.73KB   3 downloads
 
If you could assist with this, it would be appreciated.
 
Thank you
Peter
 



DDS (Ver_2012-11-20.01) - NTFS_x86 MINIMAL
Internet Explorer: 11.0.9600.17207 BrowserJavaVersion: 10.65.2
Run by peter at 19:56:31 on 2014-08-03
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3264.2239 [GMT 10:00]
.
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: STOPzilla *Enabled/Updated* {AC62CB55-407E-08AF-D405-98E9F0E32AB4}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = www.google.com
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: PDF Architect Helper: {3A2D5EBA-F86D-4BD3-A177-019765996711} - c:\program files\pdf architect\PDFIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: avast! EasyPass Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: avast! EasyPass Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
StartupFolder: c:\programdata\microsoft\windows\start menu\programs\startup\CineForm Status.lnk.disabled
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Customize Menu - C:/Program Files/Siber Systems/AI RoboForm/RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Fill Forms - C:/Program Files/Siber Systems/AI RoboForm/RoboFormComFillForms.html
IE: Save Forms - C:/Program Files/Siber Systems/AI RoboForm/RoboFormComSavePass.html
IE: Show avast! EasyPass Toolbar - C:/Program Files/Siber Systems/AI RoboForm/RoboFormComShowToolbar.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{60B6A90F-3053-464C-A27E-97D10D6DD7D5} : DHCPNameServer = 192.168.1.1
Notify: igfxcui - igfxdev.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\36.0.1985.125\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
============= SERVICES / DRIVERS ===============
.
R0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys [2013-1-31 524784]
R0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys [2013-1-31 26608]
R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys [2014-5-10 16880]
R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [2014-5-5 61328]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2014-5-10 26136]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2012-8-20 110408]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2012-8-20 331080]
R3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys [2014-5-10 361968]
R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys [2014-5-10 793072]
R3 MEI;Intel® Management Engine Interface ;c:\windows\system32\drivers\HECI.sys [2014-5-10 56432]
S0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2014-5-10 49944]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2014-5-5 61328]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\eek\run\a2ddax86.sys [2014-7-31 22056]
S1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2012-9-14 11832]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [2014-5-10 779536]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [2014-5-10 414520]
S1 VDiskBus;ASUS Disk Unlocker;c:\windows\system32\drivers\VDiskBus32.sys [2012-6-1 37664]
S2 asComSvc;ASUS Com Service;c:\program files\asus\axsp\1.01.02\atkexComSvc.exe [2013-6-4 936728]
S2 ASDiskUnlocker;ASDiskUnlocker;c:\program files\asus\disk unlocker\ASPFSVS.exe [2012-6-18 187552]
S2 asHmComSvc;ASUS HM Com Service;c:\program files\asus\aahm\1.00.22\aaHMSvc.exe [2013-6-13 945664]
S2 AsusFanControlService;AsusFanControlService;c:\program files\asus\asusfancontrolservice\1.02.26\AsusFanControlService.exe [2014-5-10 1652024]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-5-10 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-5-10 67824]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswstm.sys [2014-5-10 71944]
S2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2014-7-19 50344]
S2 avast! Firewall;avast! Firewall;c:\program files\avast software\avast\afwServ.exe [2014-7-19 106488]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2013-1-31 15344]
S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\intel\icls client\HeciServer.exe [2013-2-13 583680]
S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files\intel\intel® management engine components\dal\Jhi_service.exe [2014-5-10 169432]
S2 MAXPCDO_SRV;MAXPCDO_SRV;c:\program files\maxpc\MAXPCDefragSrv.exe [2014-5-18 248072]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\pdf architect\HelperService.exe [2014-1-23 1335344]
S2 PDF Architect Service;PDF Architect Service;c:\program files\pdf architect\ConversionService.exe [2014-1-23 856112]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2014-5-10 33056]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2014-5-18 1153368]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2014-4-3 315008]
S3 AiChargerPlus;AiChargerPlus;c:\windows\system32\drivers\AiChargerPlus.sys [2014-5-10 13952]
S3 ASFLTDrv.sys;ASFLTDrv.sys;c:\program files\asus\disk unlocker\ASFLTDrv.sys [2010-9-16 17408]
S3 ASUSFILTER;ASUSFILTER;c:\windows\system32\drivers\ASUSFILTER.sys [2011-9-20 37448]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 cleanhlp;cleanhlp;c:\eek\run\cleanhlp32.sys [2014-7-31 50200]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2014-5-21 12400]
S3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;c:\program files\intel\intel® integrated clock controller service\ICCProxy.exe [2014-5-10 171632]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2014-7-9 108032]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2014-5-10 359936]
S3 Intel® Capability Licensing Service TCP IP Interface;Intel® Capability Licensing Service TCP IP Interface;c:\program files\intel\icls client\SocketHeciServer.exe [2013-2-13 637912]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2014-5-11 14848]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2014-5-10 614624]
S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.20);c:\windows\system32\drivers\RtTeam620.sys [2014-5-10 49808]
S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\drivers\RtVlan620.sys [2014-5-10 27792]
S3 Sony PC Companion;Sony PC Companion;c:\program files\sony\sony pc companion\PCCService.exe [2014-5-17 155824]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2014-5-17 13464]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2014-5-11 49152]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2014-5-10 1343400]
.
=============== Created Last 30 ================
.
2014-08-02 08:06:34 -------- d-sh--w- C:\$RECYCLE.BIN
2014-08-01 12:10:11 -------- d-----w- c:\users\peter\appdata\local\CrashDumps
2014-07-31 12:49:00 205072 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2014-07-31 12:24:28 -------- d-----w- C:\EEK
2014-07-31 11:05:15 -------- d-----w- c:\users\peter\appdata\local\temp
2014-07-31 10:59:56 98816 ----a-w- c:\windows\sed.exe
2014-07-31 10:59:56 208896 ----a-w- c:\windows\MBR.exe
2014-07-30 20:00:36 8217224 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b4d7a330-1d3c-4f4e-aadb-749b59e85112}\mpengine.dll
2014-07-20 07:38:24 -------- d-----r- c:\program files\Skype
2014-07-19 03:10:04 43152 ----a-w- c:\windows\avastSS.scr
2014-07-16 12:41:39 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-07-13 03:08:03 -------- d-----w- c:\users\peter\appdata\roaming\RoboForm
2014-07-13 03:03:43 -------- d-----w- c:\program files\Siber Systems
2014-07-09 12:07:38 868864 ----a-w- c:\program files\common files\microsoft shared\ink\tipskins.dll
2014-07-08 10:51:05 536576 ----a-w- c:\windows\system32\sqlite3.dll
2014-07-08 10:44:39 -------- d-----w- c:\users\peter\appdata\local\Google
.
==================== Find3M ====================
.
2014-08-02 12:02:52 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-02 12:02:33 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-02 07:55:07 29160 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-07-19 03:10:05 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-07-19 03:10:05 779536 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-07-19 03:10:05 71944 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-07-19 03:10:05 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-07-19 03:10:05 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-07-19 03:10:05 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-07-19 03:10:05 192352 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-07-19 03:09:53 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-07-10 11:19:06 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-10 11:19:06 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-06-30 01:40:16 404480 ----a-w- c:\windows\system32\aepdu.dll
2014-06-30 01:36:00 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-06-18 23:56:37 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-06-18 23:56:03 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-06-18 23:38:40 455168 ----a-w- c:\windows\system32\vbscript.dll
2014-06-18 23:37:23 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-06-18 23:36:35 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-06-18 23:35:55 62464 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-06-18 23:23:27 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-06-18 23:23:24 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-06-18 23:22:40 592896 ----a-w- c:\windows\system32\jscript9diag.dll
2014-06-18 23:16:33 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-06-18 23:06:10 32256 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-18 22:52:18 4254720 ----a-w- c:\windows\system32\jscript9.dll
2014-06-18 22:46:23 1068032 ----a-w- c:\windows\system32\mshtmlmedia.dll
2014-06-18 22:45:59 1964544 ----a-w- c:\windows\system32\inetcpl.cpl
2014-06-18 22:13:59 1791488 ----a-w- c:\windows\system32\wininet.dll
2014-06-18 01:51:32 646144 ----a-w- c:\windows\system32\osk.exe
2014-06-18 00:52:00 2350080 ----a-w- c:\windows\system32\win32k.sys
2014-06-06 09:44:17 509440 ----a-w- c:\windows\system32\qedit.dll
2014-06-05 14:26:50 1059840 ----a-w- c:\windows\system32\lsasrv.dll
2014-05-30 07:52:51 172032 ----a-w- c:\windows\system32\wdigest.dll
2014-05-30 07:52:49 65536 ----a-w- c:\windows\system32\TSpkg.dll
2014-05-30 07:52:45 247808 ----a-w- c:\windows\system32\schannel.dll
2014-05-30 07:52:41 220160 ----a-w- c:\windows\system32\ncrypt.dll
2014-05-30 07:52:40 259584 ----a-w- c:\windows\system32\msv1_0.dll
2014-05-30 07:52:36 550912 ----a-w- c:\windows\system32\kerberos.dll
2014-05-30 07:52:30 17408 ----a-w- c:\windows\system32\credssp.dll
2014-05-30 06:36:07 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2014-05-21 07:58:16 25200 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2014-05-21 07:58:16 12400 ----a-w- c:\windows\system32\drivers\ggflt.sys
2014-05-17 05:01:43 13464 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2014-05-11 21:26:08 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-11 21:25:54 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-11 02:02:06 1505280 ----a-w- c:\windows\system32\d3d11.dll
2014-05-11 01:13:38 152576 ----a-w- c:\windows\system32\msclmd.dll
2014-05-10 12:51:58 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400194620831
2014-05-10 12:51:58 411552 ----a-w- c:\windows\system32\drivers\aswsp.sys.1400194620831
2014-05-10 12:51:57 269728 ----a-w- c:\windows\system32\drivers\aswndisflt.sys.1400194620831
2014-05-10 11:51:56 16896 ----a-w- c:\windows\AsTaskSched.dll
2014-05-08 09:06:54 2742784 ----a-w- c:\windows\system32\rdpcorets.dll
2014-05-08 09:06:54 13824 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
.
============= FINISH: 19:57:02.54 ===============

Edited by Oh My!, 11 August 2014 - 06:09 PM.
Log posted


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:20 PM

Posted 08 August 2014 - 05:30 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/543177 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 09 August 2014 - 08:22 PM

Thank you Help bot -

I and my computer still need help.

1) I believe that the problem description provided includes (what I believe is) the pertinant information. Otherwise I could blather on.  If there are questions though, please ask.

2) The DDS file provided is still current. I have not done anything with the computer other than back up files.  Otherwise the computer is turned-off waiting for triage.

3) I have original windows DVD for the operating system

4) I and my computer lookforward to assistance.

 

Thank you

Peter



#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 11 August 2014 - 06:12 PM

Greetings Peter and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that. :thumbup2:

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. While I review our situation please run the below for me.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
  • Boot your computer into Safe Mode with Networking
  • Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your desktop <<< Important
  • If you are unsure if you have 32 bit or 64 bit simply download and try one. If that doesn't run properly the other one should
  • Double click the icon
  • Click Yes to the disclaimer
  • Make sure the Addition.txt box is checked
  • Click Scan and allow the program to run
  • Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
  • 2 Notepad documents should now be open on your desktop.
  • Please copy and paste the contents of both in your reply
  • ===================================================

    System Summary Information

    --------------------
    • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
    • Type msinfo32 and press Enter
    • Left click on System Summary
    • Click File, Save, and name the file Summary
    • Zip and attach the file to your reply
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
    • FRST results
    • Addition log
    • System Summary Information

Edited by Oh My!, 11 August 2014 - 06:19 PM.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 12 August 2014 - 06:17 AM

Hi Gary

 

Thank you.  Please see FRST, Addition and Summary results.

 

FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:12-08-2014
Ran by peter (administrator) on POE-PC on 12-08-2014 20:56:58
Running from C:\Users\peter\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CineForm Status.lnk.disabled
ShortcutTarget: CineForm Status.lnk.disabled -> C:\Program Files\CineForm\Tools\GoProCineFormStatusViewer.exe (GoPro)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncBackSE.lnk
ShortcutTarget: SyncBackSE.lnk -> C:\Program Files\2BrightSparks\SyncBackSE\SyncBackSE.exe (2BrightSparks Pte Ltd)
Startup: C:\Users\Peter_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk.disabled
ShortcutTarget: Dropbox.lnk.disabled -> C:\Users\Peter_2\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7194FBD84D6CCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKCU - {E5DE9D9F-9FB8-4D08-9741-9BCBDD7A06C1} URL = https://www.google.com/search?q={searchTerms}
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\a7ublsx1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: sony.com/MediaGoDetector -> C:\Program Files\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-10]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-17]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-06-26]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HomePage:
CHR Extension: (Google Docs) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-08]
CHR Extension: (Google Drive) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-08]
CHR Extension: (YouTube) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-08]
CHR Extension: (Google Search) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-08]
CHR Extension: (avast! EasyPass) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\egjenocndklfkoihpolcfmgcpfdlbdln [2014-07-13]
CHR Extension: (avast! Online Security) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-07-08]
CHR Extension: (Google Wallet) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-08]
CHR Extension: (Gmail) - C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-08]
CHR HKLM\...\Chrome\Extension: [egjenocndklfkoihpolcfmgcpfdlbdln] - C:\Program Files\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2014-07-13]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-19]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 asComSvc; C:\Program Files\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-06-04] ()
S2 ASDiskUnlocker; C:\Program Files\ASUS\Disk Unlocker\ASPFSVS.exe [187552 2012-06-18] (ASUSTeK Computer Inc.)
S2 asHmComSvc; C:\Program Files\ASUS\AAHM\1.00.22\aaHMSvc.exe [945664 2013-06-13] (ASUSTeK Computer Inc.) [File not signed]
S2 AsusFanControlService; C:\Program Files\ASUS\AsusFanControlService\1.02.26\AsusFanControlService.exe [1652024 2013-06-25] (ASUSTeK Computer Inc.)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-19] (AVAST Software)
S2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [106488 2014-07-19] (AVAST Software)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2013-05-24] (Intel Corporation)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-23] (Hewlett-Packard Co.) [File not signed]
S2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]
S2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-23] (Hewlett-Packard Co.) [File not signed]
S3 ICCS; C:\Program Files\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [171632 2013-01-02] (Intel Corporation)
S2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [583680 2013-02-13] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-02-13] (Intel® Corporation)
S2 jhi_service; C:\Program Files\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)
S2 MAXPCDO_SRV; C:\Program Files\MAXpc\MAXPCDefragSrv.exe [248072 2010-01-12] (iS3, Inc.)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1335344 2014-01-23] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [856112 2014-01-23] (pdfforge GmbH)
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
S2 szserver; C:\Program Files\STOPzilla!\SZServer.exe [57136 2014-05-05] (iS3, Inc.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 A2DDA; C:\EEK\RUN\a2ddax86.sys [22056 2014-07-31] (Emsisoft GmbH)
S3 AiChargerPlus; C:\Windows\System32\drivers\AiChargerPlus.sys [13952 2013-01-28] (ASUSTek Computer Inc.)
S1 AsIO; C:\Windows\System32\drivers\AsIO.sys [14720 2012-08-22] ()
R3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [110408 2012-08-20] (ASMedia Technology Inc)
R3 asmtxhci; C:\Windows\System32\DRIVERS\asmtxhci.sys [331080 2012-08-20] (ASMedia Technology Inc)
S1 AsUpIO; C:\Windows\System32\drivers\AsUpIO.sys [11832 2012-09-14] ()
S3 ASUSFILTER; C:\Windows\System32\drivers\ASUSFILTER.sys [37448 2011-09-20] (MCCI Corporation)
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-07-19] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-07-19] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-07-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-07-19] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-07-19] ()
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-07-19] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-07-19] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-07-19] (AVAST Software)
S3 cleanhlp; C:\EEK\Run\cleanhlp32.sys [50200 2014-07-31] (Emsisoft GmbH)
R0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [524784 2013-01-31] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [26608 2013-01-31] (Intel Corporation)
S0 is3srv; C:\Windows\System32\drivers\is3srv.sys [61328 2014-05-05] (iS3 Inc.)
R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-04-26] (Intel Corporation)
R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [361968 2013-04-26] (Intel Corporation)
R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [793072 2013-04-26] (Intel Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-03-12] (Intel Corporation)
S2 RtNdPt60; C:\Windows\System32\DRIVERS\RtNdPt60.sys [33056 2011-06-15] (Realtek                                            )
S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam620.sys [49808 2012-07-03] (Realtek Corporation)
S3 RTVLANPT; C:\Windows\System32\DRIVERS\RtVlan620.sys [27792 2012-09-01] (Realtek Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-05-17] ()
R0 szkg5; C:\Windows\System32\DRIVERS\szkg.sys [61328 2014-05-05] (iS3 Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [29160 2014-08-02] ()
S1 VDiskBus; C:\Windows\System32\DRIVERS\VDiskBus32.sys [37664 2012-06-01] (ASUSTeK Computer Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S0 aswNdisFlt; system32\DRIVERS\aswNdisFlt.sys [X]
S3 aswVmm; \??\C:\Users\peter\AppData\Local\Temp\aswVmm.sys [X]
S3 MbswMailbox; \??\C:\Program Files\ASUS\AI Suite III\b06fc778-761f-45dd-a325-72477445b572.sys [X]
S3 MFE_RR; \??\C:\Users\peter\AppData\Local\Temp\mfe_rr.sys [X]
S0 szkgfs; system32\drivers\szkgfs.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 20:56 - 2014-08-12 20:57 - 00014700 _____ () C:\Users\peter\Desktop\FRST.txt
2014-08-12 20:56 - 2014-08-12 20:57 - 00000000 ____D () C:\FRST
2014-08-12 20:56 - 2014-08-12 20:53 - 01091584 _____ (Farbar) C:\Users\peter\Desktop\FRST.exe
2014-08-02 22:02 - 2014-08-02 22:28 - 00000000 ____D () C:\Users\peter\Desktop\mbar
2014-08-02 18:11 - 2014-08-02 18:11 - 00001796 _____ () C:\sc-cleaner.txt
2014-08-02 18:06 - 2014-08-02 18:06 - 00020578 _____ () C:\ComboFix.txt
2014-08-02 18:02 - 2014-08-02 18:02 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140802_180252.log
2014-08-02 13:36 - 2014-08-02 13:42 - 00114610 _____ () C:\Users\peter\Desktop\Show-Hidden.txt
2014-08-02 10:21 - 2014-08-02 12:34 - 00895431 _____ () C:\Users\peter\Downloads\FixVundo.log
2014-08-01 22:10 - 2014-08-02 17:50 - 00000000 ____D () C:\Users\peter\AppData\Local\CrashDumps
2014-07-31 22:49 - 2014-07-31 22:49 - 00205072 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2014-07-31 22:48 - 2014-07-31 22:48 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140731_224837.log
2014-07-31 22:24 - 2014-07-31 22:24 - 00000546 _____ () C:\Users\peter\Desktop\Emsisoft Emergency Kit.lnk
2014-07-31 22:24 - 2014-07-31 22:24 - 00000000 ____D () C:\EEK
2014-07-31 22:20 - 2014-07-31 22:20 - 00004153 _____ () C:\Users\peter\Downloads\gmer report 140731.log
2014-07-31 21:29 - 2014-07-31 21:29 - 00002066 _____ () C:\Users\peter\Documents\aswMBR.txt
2014-07-31 21:29 - 2014-07-31 21:29 - 00000512 _____ () C:\Users\peter\Documents\MBR.dat
2014-07-31 20:59 - 2010-11-08 03:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-31 20:59 - 2000-08-31 10:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-31 20:59 - 2000-08-31 10:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-31 20:59 - 2000-08-31 10:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-31 20:54 - 2014-07-31 20:54 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140731_205455.log
2014-07-31 20:53 - 2014-07-31 20:53 - 00000000 ____D () C:\Users\peter\Downloads\TMRBLog
2014-07-31 20:53 - 2014-07-31 20:53 - 00000000 ____D () C:\Users\peter\Downloads\log
2014-07-31 20:30 - 2014-07-31 20:18 - 08656400 _____ (Trend Micro Inc.) C:\Users\peter\Downloads\RootkitBuster_v5_1061.exe
2014-07-31 20:30 - 2014-07-31 20:14 - 01472131 _____ () C:\Users\peter\Downloads\vba32arkit.zip
2014-07-31 20:30 - 2014-07-31 20:13 - 00783120 _____ (McAfee, Inc.) C:\Users\peter\Downloads\rootkitremover.exe
2014-07-31 20:30 - 2014-07-31 20:08 - 05185536 _____ (AVAST Software) C:\Users\peter\Downloads\aswMBR.exe
2014-07-31 20:30 - 2014-07-31 20:06 - 00380416 _____ () C:\Users\peter\Downloads\vnxtzhvr.exe
2014-07-31 20:30 - 2014-07-31 20:03 - 208648368 _____ () C:\Users\peter\Downloads\EmsisoftEmergencyKit.exe
2014-07-31 20:30 - 2014-07-31 20:01 - 00688992 ____R (Swearware) C:\Users\peter\Downloads\dds.com
2014-07-31 20:30 - 2014-07-31 19:56 - 00037888 _____ (Soeperman Enterprises Ltd.) C:\Users\peter\Downloads\ADSSpy.exe
2014-07-31 20:30 - 2014-07-31 19:47 - 18500704 _____ (SUPERAntiSpyware) C:\Users\peter\Downloads\SUPERAntiSpyware.exe
2014-07-31 20:30 - 2014-07-31 19:47 - 06081842 _____ (Treexy ) C:\Users\peter\Downloads\driver_fusion_1.2.0.exe
2014-07-31 20:30 - 2014-07-31 19:45 - 01678013 _____ () C:\Users\peter\Downloads\pc-decrapifier-2.3.1.exe
2014-07-31 20:30 - 2014-07-31 19:39 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\sc-cleaner.exe
2014-07-31 20:30 - 2014-07-31 19:37 - 01016261 _____ (Thisisu) C:\Users\peter\Downloads\JRT.exe
2014-07-31 20:30 - 2014-07-31 19:36 - 05566187 ____R (Swearware) C:\Users\peter\Downloads\ComboFix.exe
2014-07-31 20:30 - 2014-07-31 19:36 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\rkill.exe
2014-07-31 20:30 - 2014-07-31 19:36 - 01361309 _____ () C:\Users\peter\Downloads\AdwCleaner.exe
2014-07-31 20:30 - 2014-07-31 19:35 - 00386464 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\show-hidden.exe
2014-07-26 15:42 - 2014-08-02 14:30 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-07-21 20:21 - 2014-07-21 20:21 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP
2014-07-20 17:53 - 2014-07-20 17:53 - 00000000 ____D () C:\Users\Gail\AppData\Local\Skype
2014-07-20 17:52 - 2014-08-02 17:53 - 00000000 ____D () C:\Users\Gail\AppData\Roaming\Skype
2014-07-20 17:38 - 2014-07-20 17:52 - 00002503 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-20 17:38 - 2014-07-20 17:52 - 00000000 ____D () C:\ProgramData\Skype
2014-07-20 17:38 - 2014-07-20 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-20 17:38 - 2014-07-20 17:51 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Skype
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ___RD () C:\Program Files\Skype
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ____D () C:\Users\Peter_2\AppData\Local\Skype
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-07-20 17:37 - 2014-07-20 17:37 - 01677928 _____ (Skype Technologies S.A.) C:\Users\Peter_2\Downloads\SkypeSetup.exe
2014-07-20 15:01 - 2014-06-02 06:18 - 00000042 _____ () C:\Windows\system32\Drivers\etc\hosts.20140720-150117.backup
2014-07-20 14:59 - 2014-07-20 14:59 - 00001238 _____ () C:\Users\Peter_2\Desktop\Spybot - Search & Destroy.lnk
2014-07-20 14:55 - 2014-07-20 17:51 - 00000000 ___RD () C:\Users\Peter_2\Dropbox
2014-07-20 14:55 - 2014-07-20 15:00 - 00001021 _____ () C:\Users\Peter_2\Desktop\Dropbox.lnk
2014-07-19 13:19 - 2014-07-31 05:41 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-19 13:19 - 2014-07-31 05:41 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Dropbox
2014-07-19 13:11 - 2014-07-19 13:11 - 00002053 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-07-19 13:10 - 2014-07-19 13:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-07-16 22:41 - 2014-07-16 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-16 22:41 - 2014-07-16 22:41 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-16 22:41 - 2014-07-11 03:02 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-07-16 22:41 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-16 22:41 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-16 22:41 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-13 14:36 - 2014-07-16 22:41 - 00000000 ____D () C:\Program Files\Java
2014-07-13 14:28 - 2014-07-13 14:29 - 18732144 _____ (Adobe Systems Inc.) C:\Users\Peter_2\Downloads\AdobeAIRInstaller (1).exe
2014-07-13 13:08 - 2014-07-13 13:08 - 00000000 ____D () C:\Users\peter\AppData\Roaming\RoboForm
2014-07-13 13:04 - 2014-07-13 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! EasyPass
2014-07-13 13:03 - 2014-07-13 13:03 - 00000000 ____D () C:\Program Files\Siber Systems
2014-07-13 12:57 - 2014-07-13 12:57 - 16766424 _____ (Siber Systems) C:\Users\peter\Downloads\avast_easypass_setup (1).exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 20:57 - 2014-08-12 20:56 - 00014700 _____ () C:\Users\peter\Desktop\FRST.txt
2014-08-12 20:57 - 2014-08-12 20:56 - 00000000 ____D () C:\FRST
2014-08-12 20:56 - 2014-05-10 21:50 - 00787118 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-12 20:53 - 2014-08-12 20:56 - 01091584 _____ (Farbar) C:\Users\peter\Desktop\FRST.exe
2014-08-09 22:17 - 2014-05-17 12:32 - 00000000 ____D () C:\ProgramData\STOPzilla!
2014-08-03 20:52 - 2009-07-14 14:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-03 20:52 - 2009-07-14 14:39 - 00046280 _____ () C:\Windows\setupact.log
2014-08-03 19:57 - 2009-01-01 00:05 - 00016111 _____ () C:\Users\peter\Desktop\dds.txt
2014-08-03 19:57 - 2009-01-01 00:05 - 00015134 _____ () C:\Users\peter\Desktop\attach.txt
2014-08-02 22:37 - 2014-05-10 21:47 - 01290563 _____ () C:\Windows\WindowsUpdate.log
2014-08-02 22:37 - 2009-07-14 14:34 - 00015824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-02 22:37 - 2009-07-14 14:34 - 00015824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-02 22:28 - 2014-08-02 22:02 - 00000000 ____D () C:\Users\peter\Desktop\mbar
2014-08-02 22:28 - 2014-06-08 16:24 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-08-02 22:02 - 2014-07-02 20:38 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-02 22:02 - 2014-07-02 20:38 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-02 22:02 - 2014-06-01 23:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-02 18:19 - 2014-05-11 05:08 - 00106362 _____ () C:\Windows\PFRO.log
2014-08-02 18:11 - 2014-08-02 18:11 - 00001796 _____ () C:\sc-cleaner.txt
2014-08-02 18:08 - 2014-06-02 00:04 - 00000000 ____D () C:\AdwCleaner
2014-08-02 18:06 - 2014-08-02 18:06 - 00020578 _____ () C:\ComboFix.txt
2014-08-02 18:06 - 2014-06-02 00:17 - 00000000 ____D () C:\Qoobox
2014-08-02 18:06 - 2009-07-14 12:04 - 00000215 _____ () C:\Windows\system.ini
2014-08-02 18:02 - 2014-08-02 18:02 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140802_180252.log
2014-08-02 17:55 - 2014-06-08 16:31 - 00029160 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-08-02 17:53 - 2014-07-20 17:52 - 00000000 ____D () C:\Users\Gail\AppData\Roaming\Skype
2014-08-02 17:50 - 2014-08-01 22:10 - 00000000 ____D () C:\Users\peter\AppData\Local\CrashDumps
2014-08-02 14:30 - 2014-07-26 15:42 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-08-02 13:42 - 2014-08-02 13:36 - 00114610 _____ () C:\Users\peter\Desktop\Show-Hidden.txt
2014-08-02 12:34 - 2014-08-02 10:21 - 00895431 _____ () C:\Users\peter\Downloads\FixVundo.log
2014-08-02 10:12 - 2014-06-01 23:54 - 00005366 _____ () C:\Users\peter\Desktop\Rkill.txt
2014-08-01 21:53 - 2014-06-03 06:46 - 00000000 ____D () C:\Windows\pss
2014-07-31 22:49 - 2014-07-31 22:49 - 00205072 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys
2014-07-31 22:48 - 2014-07-31 22:48 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140731_224837.log
2014-07-31 22:24 - 2014-07-31 22:24 - 00000546 _____ () C:\Users\peter\Desktop\Emsisoft Emergency Kit.lnk
2014-07-31 22:24 - 2014-07-31 22:24 - 00000000 ____D () C:\EEK
2014-07-31 22:20 - 2014-07-31 22:20 - 00004153 _____ () C:\Users\peter\Downloads\gmer report 140731.log
2014-07-31 21:29 - 2014-07-31 21:29 - 00002066 _____ () C:\Users\peter\Documents\aswMBR.txt
2014-07-31 21:29 - 2014-07-31 21:29 - 00000512 _____ () C:\Users\peter\Documents\MBR.dat
2014-07-31 20:54 - 2014-07-31 20:54 - 00000404 _____ () C:\Users\peter\Downloads\RootkitRemover_20140731_205455.log
2014-07-31 20:53 - 2014-07-31 20:53 - 00000000 ____D () C:\Users\peter\Downloads\TMRBLog
2014-07-31 20:53 - 2014-07-31 20:53 - 00000000 ____D () C:\Users\peter\Downloads\log
2014-07-31 20:18 - 2014-07-31 20:30 - 08656400 _____ (Trend Micro Inc.) C:\Users\peter\Downloads\RootkitBuster_v5_1061.exe
2014-07-31 20:14 - 2014-07-31 20:30 - 01472131 _____ () C:\Users\peter\Downloads\vba32arkit.zip
2014-07-31 20:13 - 2014-07-31 20:30 - 00783120 _____ (McAfee, Inc.) C:\Users\peter\Downloads\rootkitremover.exe
2014-07-31 20:08 - 2014-07-31 20:30 - 05185536 _____ (AVAST Software) C:\Users\peter\Downloads\aswMBR.exe
2014-07-31 20:06 - 2014-07-31 20:30 - 00380416 _____ () C:\Users\peter\Downloads\vnxtzhvr.exe
2014-07-31 20:03 - 2014-07-31 20:30 - 208648368 _____ () C:\Users\peter\Downloads\EmsisoftEmergencyKit.exe
2014-07-31 20:01 - 2014-07-31 20:30 - 00688992 ____R (Swearware) C:\Users\peter\Downloads\dds.com
2014-07-31 19:56 - 2014-07-31 20:30 - 00037888 _____ (Soeperman Enterprises Ltd.) C:\Users\peter\Downloads\ADSSpy.exe
2014-07-31 19:54 - 2014-07-05 12:17 - 01402880 _____ () C:\Users\peter\Downloads\HiJackThis.msi
2014-07-31 19:47 - 2014-07-31 20:30 - 18500704 _____ (SUPERAntiSpyware) C:\Users\peter\Downloads\SUPERAntiSpyware.exe
2014-07-31 19:47 - 2014-07-31 20:30 - 06081842 _____ (Treexy ) C:\Users\peter\Downloads\driver_fusion_1.2.0.exe
2014-07-31 19:45 - 2014-07-31 20:30 - 01678013 _____ () C:\Users\peter\Downloads\pc-decrapifier-2.3.1.exe
2014-07-31 19:41 - 2014-06-08 16:31 - 04806744 _____ () C:\Users\peter\Downloads\RogueKiller.exe
2014-07-31 19:39 - 2014-07-31 20:30 - 00441592 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\sc-cleaner.exe
2014-07-31 19:37 - 2014-07-31 20:30 - 01016261 _____ (Thisisu) C:\Users\peter\Downloads\JRT.exe
2014-07-31 19:36 - 2014-07-31 20:30 - 05566187 ____R (Swearware) C:\Users\peter\Downloads\ComboFix.exe
2014-07-31 19:36 - 2014-07-31 20:30 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\rkill.exe
2014-07-31 19:36 - 2014-07-31 20:30 - 01361309 _____ () C:\Users\peter\Downloads\AdwCleaner.exe
2014-07-31 19:35 - 2014-07-31 20:30 - 00386464 _____ (Bleeping Computer, LLC) C:\Users\peter\Downloads\show-hidden.exe
2014-07-31 18:20 - 2014-07-05 13:40 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-31 05:42 - 2009-01-01 02:28 - 00000000 ____D () C:\Users\Peter_2
2014-07-31 05:41 - 2014-07-19 13:19 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-31 05:41 - 2014-07-19 13:19 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Dropbox
2014-07-31 05:41 - 2014-05-18 12:13 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-07-31 05:41 - 2014-05-12 00:25 - 00000000 ____D () C:\Users\Gail
2014-07-31 05:41 - 2014-05-10 21:47 - 00000000 ____D () C:\Users\peter
2014-07-31 05:41 - 2009-07-14 12:37 - 00000000 ____D () C:\Windows\system32\wfp
2014-07-31 05:41 - 2009-07-14 12:37 - 00000000 ____D () C:\Windows\registration
2014-07-27 18:22 - 2014-05-13 22:07 - 00000000 ____D () C:\Users\Peter_2\Documents\My Avast EasyPass Data
2014-07-25 18:43 - 2014-05-17 12:32 - 00000000 ____D () C:\Program Files\STOPzilla!
2014-07-24 21:45 - 2014-07-05 13:40 - 00000888 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-24 21:19 - 2014-06-08 17:40 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-24 20:22 - 2014-05-11 12:41 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 20:21 - 2014-05-11 12:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-21 20:21 - 2014-07-21 20:21 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP
2014-07-20 17:53 - 2014-07-20 17:53 - 00000000 ____D () C:\Users\Gail\AppData\Local\Skype
2014-07-20 17:52 - 2014-07-20 17:38 - 00002503 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-20 17:52 - 2014-07-20 17:38 - 00000000 ____D () C:\ProgramData\Skype
2014-07-20 17:52 - 2014-07-20 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-20 17:51 - 2014-07-20 17:38 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Skype
2014-07-20 17:51 - 2014-07-20 14:55 - 00000000 ___RD () C:\Users\Peter_2\Dropbox
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ___RD () C:\Program Files\Skype
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ____D () C:\Users\Peter_2\AppData\Local\Skype
2014-07-20 17:38 - 2014-07-20 17:38 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-07-20 17:37 - 2014-07-20 17:37 - 01677928 _____ (Skype Technologies S.A.) C:\Users\Peter_2\Downloads\SkypeSetup.exe
2014-07-20 15:00 - 2014-07-20 14:55 - 00001021 _____ () C:\Users\Peter_2\Desktop\Dropbox.lnk
2014-07-20 14:59 - 2014-07-20 14:59 - 00001238 _____ () C:\Users\Peter_2\Desktop\Spybot - Search & Destroy.lnk
2014-07-19 16:15 - 2009-07-14 12:37 - 00000000 ____D () C:\Windows\rescache
2014-07-19 13:11 - 2014-07-19 13:11 - 00002053 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-07-19 13:10 - 2014-07-19 13:10 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-07-19 13:10 - 2014-05-10 22:52 - 00779536 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00414520 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00276432 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-07-19 13:10 - 2014-05-10 22:52 - 00192352 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00071944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00067824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-07-19 13:10 - 2014-05-10 22:52 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-07-19 13:09 - 2014-05-10 22:52 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-07-19 10:49 - 2014-07-05 13:40 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-16 22:41 - 2014-07-16 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-07-16 22:41 - 2014-07-16 22:41 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-07-16 22:41 - 2014-07-13 14:36 - 00000000 ____D () C:\Program Files\Java
2014-07-16 22:41 - 2014-05-11 13:11 - 00000000 ____D () C:\ProgramData\Oracle
2014-07-13 20:29 - 2014-05-18 11:23 - 00000000 ____D () C:\Windows\system32\config\RCCBakup
2014-07-13 14:29 - 2014-07-13 14:28 - 18732144 _____ (Adobe Systems Inc.) C:\Users\Peter_2\Downloads\AdobeAIRInstaller (1).exe
2014-07-13 14:29 - 2014-05-18 21:40 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-07-13 14:29 - 2014-05-13 21:59 - 00000000 ____D () C:\Users\Peter_2\AppData\Local\Adobe
2014-07-13 14:29 - 2009-01-01 02:29 - 00000000 ____D () C:\Users\Peter_2\AppData\Roaming\Adobe
2014-07-13 13:08 - 2014-07-13 13:08 - 00000000 ____D () C:\Users\peter\AppData\Roaming\RoboForm
2014-07-13 13:04 - 2014-07-13 13:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! EasyPass
2014-07-13 13:03 - 2014-07-13 13:03 - 00000000 ____D () C:\Program Files\Siber Systems
2014-07-13 12:57 - 2014-07-13 12:57 - 16766424 _____ (Siber Systems) C:\Users\peter\Downloads\avast_easypass_setup (1).exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-29 16:46

==================== End Of Log ============================

 

Addition Log:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:12-08-2014
Ran by peter at 2014-08-12 20:57:43
Running from C:\Users\peter\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: STOPzilla (Enabled - Up to date) {AC62CB55-407E-08AF-D405-98E9F0E32AB4}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
8600_Help (Version: 1.00.0000 - Hewlett-Packard) Hidden
8600_Readme (Version: 1.00.0000 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft PhotoStudio 5.5 (HKLM\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version:  - ArcSoft)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.2.0 - Asmedia Technology)
ASUS PC Diagnostics (HKLM\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.3.0 - ASUSTeK Computer Inc.)
avast! EasyPass (HKLM\...\AI RoboForm) (Version: 7-9-7-133 - AVAST Software)
avast! Internet Security (HKLM\...\Avast) (Version: 9.0.2021 - AVAST Software)
BPDSoftware (Version: 130.0.000.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
Canon MP Navigator EX 1.0 (HKLM\...\MP Navigator EX 1.0) (Version:  - )
Canon Utilities PhotoStitch 3.1 (HKLM\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)
CanoScan 8800F (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4805) (Version:  - )
Copy (Version: 130.0.366.000 - Hewlett-Packard) Hidden
Creative Memories Memory Manager 3 (International - English) (HKLM\...\{055C7B5D-B655-495D-BC4B-787994519AAA}) (Version: 3.0 - Caspedia Corporation)
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
Disk Unlocker (HKLM\...\{95E18B02-E29A-4C7F-9AAB-26CFB8082F73}) (Version: 2.1.2 - ASUS)
Google Chrome (HKLM\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
GoPro Studio 2.0.1 (HKLM\...\GoPro Studio) (Version: 2.0.1 - WoodmanLabs Inc. d.b.a. GoPro)
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet Pro K8600 (HKLM\...\{5FA67C2B-DAAB-4F7B-AE09-CA97FE73EA59}) (Version: 13.0 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.002 - Hewlett-Packard)
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1323 - Intel Corporation)
Intel® Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3186 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Intel® Rapid Storage Technology (Version: 12.0.0.1083 - Intel Corporation) Hidden
Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.27.798.1 - Intel Corporation) Hidden
Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (Version: 2.1.65.20 - Oracle, Inc.) Hidden
K8600 (Version: 130.0.000.000 - Hewlett-Packard) Hidden
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
MAXpc 3.0 (HKLM\...\{CF692545-1146-42C6-AFFA-F46B3BA7FA0A}_is1) (Version:  - IS3, Inc.)
Media Go (HKLM\...\{7547239C-FA8A-4FA4-84A6-31EAC0777E1B}) (Version: 2.7.341 - Sony)
Media Go Network Downloader (HKLM\...\{73FA7631-3015-4EEC-A002-09488C47A07C}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.130.12060 (HKLM\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.130.12060 - Sony)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2007 (HKLM\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Project MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Project Standard 2007 (HKLM\...\PRJSTDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Project Standard 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
MPM (HKLM\...\{BAB0F8F5-282A-45F1-B31A-EB894827456B}) (Version: 1.00.0000 - Hewlett-Packard)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Network (Version: 130.0.579.000 - Hewlett-Packard) Hidden
Panstoria Artisan 4 (HKLM\...\{DD47CB42-15DD-471C-8CDF-72FB732C92AE}) (Version: 4.0.5044 - Panstoria, Inc.)
Panstoria Historian 4 (HKLM\...\{44816B15-5BEA-4BA9-B074-3287E9F7A1B5}) (Version: 4.1.5205 - Panstoria, Inc)
PDF Architect (HKLM\...\{86D8A96B-1911-4C3F-AA16-0B47E053E492}) (Version: 1.2.97.14551 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PhotoStitch (Version: 3.1.14 - Canon) Hidden
ProductContext (Version: 130.0.000.000 - Hewlett-Packard) Hidden
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek Ethernet Diagnostic Utility (HKLM\...\{DADC7AB0-E554-4705-9F6A-83EA82ED708E}) (Version: 2.0.2.6 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6782 - Realtek Semiconductor Corp.)
ScanSoft OmniPage SE 4 (HKLM\...\{DEE88727-779B-47A9-ACEF-F87CA5F92A65}) (Version: 15.2.0020 - Nuance Communications, Inc.)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sony Mobile Update Engine (HKLM\...\Update Engine) (Version: 2.14.8.201405281228 - Sony Mobile Communications AB)
Sony PC Companion 2.10.211 (HKLM\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.211 - Sony)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
STOPzilla AntiMalware 6.0 (HKLM\...\{C44DA855-0EC4-468C-B282-4F168AB5AE2C}) (Version: 6.1.80.57 - iS3 Inc.)
SyncBackSE (HKLM\...\SyncBackSE_is1) (Version: 6.5.30.0 - 2BrightSparks)
System Requirements Lab for Intel (HKLM\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 - Husdawg, LLC)
TagScanner 5.1.649 (HKLM\...\TagScanner_is1) (Version:  - Sergey Serkov)
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
UndeleteOnClick (HKLM\...\UndeleteOnClick_is1) (Version:  - 2BrightSparks)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Driver Package - GoPro (WinUSB) Universal Serial Bus devices  (03/07/2012 ) (HKLM\...\0B624A43DD66DBF5CF3EDFA9741A364E688062A4) (Version: 03/07/2012  - GoPro)
WinZip 17.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240D6}) (Version: 17.0.10283 - WinZip Computing, S.L. )
X-NetStat Pro 5.61 Beta 1 (HKLM\...\X-NetStat Pro) (Version: 5.61 Beta 1 - Fresh Software)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

13-07-2014 05:32:28 STOPzilla Restore Point.
13-07-2014 10:29:14 Registry Optimizer Before Optimization
16-07-2014 00:25:28 Windows Update
16-07-2014 12:40:39 Installed Java 7 Update 65
19-07-2014 00:47:27 Windows Update
19-07-2014 03:06:37 STOPzilla Restore Point.
19-07-2014 03:08:36 avast! antivirus system restore point
19-07-2014 03:10:53 Device Driver Package Install: Avast Network Service
19-07-2014 03:42:54 STOPzilla Restore Point.
23-07-2014 10:28:37 Windows Update
24-07-2014 10:20:43 Windows Update
26-07-2014 04:55:22 STOPzilla Restore Point.
29-07-2014 23:58:54 Windows Update
31-07-2014 20:16:37 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 12:04 - 2014-07-31 21:19 - 00000042 ____A C:\Windows\system32\Drivers\etc\hosts
::1 localhost
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {33CF9B74-0C82-46FE-B5B7-8ADC3805FBD9} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-19] (AVAST Software)
Task: {361DF464-F22D-40FA-BE37-72B257B84DBF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {695C5D9F-E537-4C93-9E4F-F8B4081C9FCC} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2014-07-13] (AVAST Software)
Task: {AAA253AC-41EE-4521-82F7-F88754EC3A11} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-07-05] (Google Inc.)
Task: {AC2930B8-E1C5-4DFF-A9BA-24DBACD9706F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-07-05] (Google Inc.)
Task: {D4A26112-9AC8-4143-A69F-30966C982641} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3587537355-4055296389-3146589605-1004
Task: {DB45076C-3A4D-4E90-B22E-288E0D7B3347} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)



HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\.exe: exefile =>  <===== ATTENTION!
HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Officejet Pro K8600
Description: Officejet Pro K8600
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: AMDA00 Interface
Description: AMDA00 Interface
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: ASUSTeK Computer Inc.
Service: WUDFRd
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: avast! Revert
Description: avast! Revert
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswRvrt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/12/2014 08:55:36 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:55:36 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:55:36 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:55:36 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:53:40 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:53:40 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:53:39 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/12/2014 08:53:39 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (08/09/2014 00:46:27 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Program Files\STOPzilla!\SZScanner.exe Files\STOPzilla!\SZScanner.exe" ; Description = STOPzilla Restore Point.; Error = 0x8007043c).

Error: (08/09/2014 00:45:19 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.


System errors:
=============
Error: (08/12/2014 08:55:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:42 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (08/12/2014 08:55:41 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 17%
Total physical RAM: 3263.84 MB
Available physical RAM: 2684.84 MB
Total Pagefile: 6525.98 MB
Available Pagefile: 5974.38 MB
Total Virtual: 2047.88 MB
Available Virtual: 1891.41 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:292.97 GB) (Free:211.4 GB) NTFS
Drive d: (Lexar) (Removable) (Total:7.45 GB) (Free:7.2 GB) FAT32
Drive e: (Primary Disk) (Fixed) (Total:68.36 GB) (Free:68.18 GB) NTFS
Drive f: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (Storage Disk) (Fixed) (Total:229.73 GB) (Free:165.14 GB) NTFS
Drive h: () (Fixed) (Total:97.66 GB) (Free:60.28 GB) NTFS
Drive i: (storage) (Fixed) (Total:368.01 GB) (Free:288.64 GB) NTFS
Drive l: (New Volume) (Fixed) (Total:638.44 GB) (Free:307.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 02380ABF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=293 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=638 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 1B7F973A)
Partition 1: (Active) - (Size=68 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=230 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 11805F90)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368 GB) - (Type=07 NTFS)

========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)

==================== End Of Log ============================

 

 

 

Regards

Peter



#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 12 August 2014 - 08:33 AM

Greetings Peter.

Thank you for the information. Please do this.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • While in Safe Mode press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
S0 aswNdisFlt; system32\DRIVERS\aswNdisFlt.sys [X]
S3 aswVmm; \??\C:\Users\peter\AppData\Local\Temp\aswVmm.sys [X]
S3 MbswMailbox; \??\C:\Program Files\ASUS\AI Suite III\b06fc778-761f-45dd-a325-72477445b572.sys [X]
S3 MFE_RR; \??\C:\Users\peter\AppData\Local\Temp\mfe_rr.sys [X]
S0 szkgfs; system32\drivers\szkgfs.sys [X]
HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\.exe: exefile =>  <===== ATTENTION!
HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\exefile:  <===== ATTENTION!
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
  • Attempt to reboot your computer into Normal Mode
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • Can you boot into Normal Mode?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 12 August 2014 - 04:17 PM

Hi Gary

Thank you.  Performed FRST Fix as requested (so quick!).  Here is the fixlog:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:12-08-2014
Ran by peter at 2014-08-13 07:03:41 Run:1
Running from C:\Users\peter\Desktop
Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:
*****************
S0 aswNdisFlt; system32\DRIVERS\aswNdisFlt.sys [X]
S3 aswVmm; \??\C:\Users\peter\AppData\Local\Temp\aswVmm.sys [X]
S3 MbswMailbox; \??\C:\Program Files\ASUS\AI Suite III\b06fc778-761f-45dd-a325-72477445b572.sys [X]
S3 MFE_RR; \??\C:\Users\peter\AppData\Local\Temp\mfe_rr.sys [X]
S0 szkgfs; system32\drivers\szkgfs.sys [X]
HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\.exe: exefile =>  <===== ATTENTION!
HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\exefile:  <===== ATTENTION!

*****************

aswNdisFlt => Service deleted successfully.
aswVmm => Service deleted successfully.
MbswMailbox => Service deleted successfully.
MFE_RR => Service deleted successfully.
szkgfs => Service deleted successfully.
"HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\exefile" => Key deleted successfully.
"HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\.exe" => Key deleted successfully.
"HKU\S-1-5-21-3587537355-4055296389-3146589605-1000\Software\Classes\exefile" => Key not found.

==== End of Fixlog ====

 

I then changed msconfig to boot in normal mode and rebooted twice.  No luck.  Still as before: bootup process was slow, the windows graphic appears and I hear the MS chime but the screen turns black.  But with one exception, instead of 10-15 minutes to boot, now 2-3 minutes.

 

Thank you

Peter



#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 12 August 2014 - 05:10 PM

Thanks, please do this.

===================================================

Running Startup Repair

--------------------
  • Reboot your computer and gently tap F8 to enter the Advanced Boot Options menu
  • Highlight Repair Your Computer and press Enter
  • Click Next
  • Enter the password information if necessary then click OK
  • Click Startup Repair and allow the process to complete
  • Restart the computer if required
  • Attempt to boot your computer into Normal Mode
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Results?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 13 August 2014 - 06:10 AM

Hi Gary

 

Thank you.

The computer now boots in Normal mode.  I am not sure what enabled this because the startup repair results stated that no fault had been found.

 

Issues:

  • Interestingly F8 does not work when restarting from Normal mode - the computer just restarts.  I need to configure msconfig to boot in safe mode.  Rebooting from safe mode and F8 gets me to the Advanced Boot Options Page.
  • Avast Internet Security needs to be reloaded - it appears to be broken.  This is my firewall and antivirus application.
  • The shutting down duration appears to be much longer than previous.  Before ~20 seconds, Now 90 seconds

Otherwise there are no other obvious issues.

 

I will now shut down the computer and await further instructions.

 

Thanks again

 

Peter


Edited by fiftygrit, 13 August 2014 - 06:11 AM.


#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 13 August 2014 - 03:53 PM

Hi Peter,

We are making progress. :thumbsup2:

Please do this.

===================================================

Windows Repair (All in One)

--------------------
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Download Windows Repair (All in One) and save it to your desktop
  • Double click the icon and select Run
  • Continually click Next, then Finish
  • Note: If you are unable to complete one of the steps simply continue on with the next step
  • Go to Step 3 and allow it to run See if Check Disk is Needed by clicking on the Check button:
  • If your see Errors Found On The Drive! Check Disk Is Needed click Do It in the Check Disk (If Needed) box
  • Go to Step 4 and click Do It under System File Check
  • Go to Step 5 and click Create under System Restore, then Backup under Registry Backup
  • Go to Start Repairs tab and click Start button.
  • Please make sure the following items are checked

Reset Registry Permissions
Reset File Permissions
Reset Service Permissions
Register System Files
Remove Policies Set By Infections
Remove Temp Files
Repair Windows Safe Mode
Restore Important Windows Services
Set Windows Services To Default Startup

  • Click on box next to the Restart/Shutdown System when Finished
  • Click on Restart System
  • Click on Start
  • Your computer will reboot upon completion
  • Using Windows Explorer navigate to the following file

C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs

  • Copy and paste (or attach if necessary) the contents of the log in your reply
  • Attempt to boot into Safe Mode by pressing F8
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • All in One report
  • Can you boot into Safe Mode?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 14 August 2014 - 03:31 PM

Hi Gary
 
Thank you
 
I performed the scan.  Attached is the (what I believe is the relevant) log.  
 
F8 to safe mode: TBA.
 
Some other quirks have been removed.
 
 
When can I re-install AVAST?
 
Regards
Peter


System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Home Premium
OS Architecture: 32-bit
OS Version: 6.1.7601
OS Service Pack: Service Pack 1
Computer Name: POE-PC
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Current Profile: C:\Users\Peter_2
Current Profile SID: S-1-5-21-3587537355-4055296389-3146589605-1004
Current Profile Classes: S-1-5-21-3587537355-4055296389-3146589605-1004_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Peter_2\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:28:15

Process Count: 62
Commit Total: 1.18 GB
Commit Limit: 6.37 GB
Commit Peak: 1.93 GB
Handle Count: 17558
Kernel Total: 307.91 MB
Kernel Paged: 239.93 MB
Kernel Non Paged: 67.98 MB
System Cache: 2.25 GB
Thread Count: 769
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3.19 GB
Memory Used: 874.98 MB(26.8082%)
Memory Avail.: 2.33 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3.19 GB
Memory Used: 824.69 MB(25.2674%)
Memory Avail.: 2.38 GB
--------------------------------------------------------------------------------

Starting Repairs...
Started at (14/08/2014 8:31:26 PM)

01 - Reset Registry Permissions 01/03
HKEY_CURRENT_USER & Sub Keys
Start (14/08/2014 8:31:29 PM)
Running Repair Under Current User Account
Done (14/08/2014 8:32:04 PM)

01 - Reset Registry Permissions 02/03
HKEY_LOCAL_MACHINE & Sub Keys
Start (14/08/2014 8:32:05 PM)
Running Repair Under System Account
Done (14/08/2014 8:33:49 PM)

01 - Reset Registry Permissions 03/03
HKEY_CLASSES_ROOT & Sub Keys
Start (14/08/2014 8:33:49 PM)
Running Repair Under System Account
Done (14/08/2014 8:34:23 PM)

02 - Reset File Permissions: C:
C: & Sub Folders
Start (14/08/2014 8:34:23 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 8:41:24 PM)

02 - Reset File Permissions: E:
E: & Sub Folders
Start (14/08/2014 8:41:24 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 8:41:29 PM)

02 - Reset File Permissions: F:
F: & Sub Folders
Start (14/08/2014 8:41:29 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 8:41:35 PM)

02 - Reset File Permissions: G:
G: & Sub Folders
Start (14/08/2014 8:41:35 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 8:43:42 PM)

02 - Reset File Permissions: H:
H: & Sub Folders
Start (14/08/2014 8:43:42 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 9:32:12 PM)

02 - Reset File Permissions: I:
I: & Sub Folders
Start (14/08/2014 9:32:12 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 9:34:31 PM)

02 - Reset File Permissions: L:
L: & Sub Folders
Start (14/08/2014 9:34:31 PM)
Trying To Run Repair As Trusted Installer.
You will see a Interactive Services Detection Window.
The Repair Is Running In That Window.
This Is Normal And Will Go Away Once The Repair Is Finished.
Running Repair Under Current User Account
Done (14/08/2014 9:47:48 PM)

02 - Reset File Permissions: All Profiles
C:\Users & Sub Folders
Start (14/08/2014 9:47:48 PM)
Running Repair Under System Account
Done (14/08/2014 9:49:38 PM)

02 - Reset File Permissions: Current Profile
C:\Users\Peter_2 & Sub Folders
Start (14/08/2014 9:49:39 PM)
Running Repair Under System Account
Done (14/08/2014 9:49:56 PM)

02 - Reset File Permissions: Cleanup
Repairing Restricted Folders Permissions To Avoid Infinite Loops
Start (14/08/2014 9:49:56 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:50:02 PM)

03 - Reset Service Permissions
Start (14/08/2014 9:50:02 PM)
Running Repair Under System Account
Done (14/08/2014 9:51:04 PM)

04 - Register System Files
Start (14/08/2014 9:51:04 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:51:39 PM)

05 - Repair WMI
Start (14/08/2014 9:51:39 PM)

Starting Security Center So We Can Export The Security Info.

Exporting Antivirus Info...
avast! Antivirus Exported.

Exporting AntiSpyware Info...
Windows Defender Exported.
STOPzilla Exported.
avast! Antivirus Exported.

Exporting 3rd Party Firewall Info...
avast! Antivirus Exported.

Running Repair Under Current User Account
Done (14/08/2014 9:55:11 PM)

06 - Repair Windows Firewall
Start (14/08/2014 9:55:11 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:55:53 PM)

07 - Repair Internet Explorer
Start (14/08/2014 9:55:53 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:56:31 PM)

08 - Repair MDAC/MS Jet
Start (14/08/2014 9:56:31 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:56:45 PM)

09 - Repair Hosts File
Start (14/08/2014 9:56:45 PM)
Running Repair Under System Account
Done (14/08/2014 9:56:48 PM)

10 - Remove Policies Set By Infections
Start (14/08/2014 9:56:48 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:56:54 PM)

11 - Repair Start Menu Icons Removed By Infections
Start (14/08/2014 9:56:55 PM)
Running Repair Under System Account
Done (14/08/2014 9:57:00 PM)

12 - Repair Icons
Start (14/08/2014 9:57:00 PM)
Running Repair Under Current User Account
Done (14/08/2014 9:57:03 PM)

13 - Repair Winsock & DNS Cache
Start (14/08/2014 9:57:03 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:57:24 PM)

14 - Remove Temp Files
Start (14/08/2014 9:57:24 PM)
Running Repair Under System Account
Done (14/08/2014 9:57:27 PM)

15 - Repair Proxy Settings
Start (14/08/2014 9:57:27 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:57:33 PM)

17 - Repair Windows Updates
Start (14/08/2014 9:57:33 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.
Done (14/08/2014 9:58:15 PM)

18 - Repair CD/DVD Missing/Not Working
Start (14/08/2014 9:58:15 PM)
iTunes not found, not applying UpperFilters iTunes Reg Key
Done (14/08/2014 9:58:15 PM)

19 - Repair Volume Shadow Copy Service
Start (14/08/2014 9:58:15 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:58:38 PM)

21 - Repair MSI (Windows Installer)
Start (14/08/2014 9:58:38 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:58:51 PM)

23.01 - Repair bat Association
Start (14/08/2014 9:58:51 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:58:57 PM)

23.02 - Repair cmd Association
Start (14/08/2014 9:58:57 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:03 PM)

23.03 - Repair com Association
Start (14/08/2014 9:59:03 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:09 PM)

23.04 - Repair Directory Association
Start (14/08/2014 9:59:09 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:16 PM)

23.05 - Repair Drive Association
Start (14/08/2014 9:59:16 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:22 PM)

23.06 - Repair exe Association
Start (14/08/2014 9:59:22 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:28 PM)

23.07 - Repair Folder Association
Start (14/08/2014 9:59:28 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:35 PM)

23.08 - Repair inf Association
Start (14/08/2014 9:59:35 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:41 PM)

23.09 - Repair lnk (Shortcuts) Association
Start (14/08/2014 9:59:41 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:47 PM)

23.10 - Repair msc Association
Start (14/08/2014 9:59:47 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 9:59:53 PM)

23.11 - Repair reg Association
Start (14/08/2014 9:59:53 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:00:00 PM)

23.12 - Repair scr Association
Start (14/08/2014 10:00:00 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:00:06 PM)

24 - Repair Windows Safe Mode
Start (14/08/2014 10:00:06 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:00:12 PM)

25 - Repair Print Spooler
Start (14/08/2014 10:00:12 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:00:27 PM)

26 - Restore Important Windows Services
Start (14/08/2014 10:00:27 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:00:43 PM)

27 - Set Windows Services To Default Startup
Start (14/08/2014 10:00:43 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:01:16 PM)

31 - Repair Windows 'New' Submenu
Start (14/08/2014 10:01:16 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (14/08/2014 10:01:23 PM)

Cleaning up empty logs...

All Selected Repairs Done.
Done at (14/08/2014 10:01:23 PM)
Total Repair Time: 01:29:58


...YOU MUST RESTART YOUR SYSTEM...
Running Repair Under Current User Account

Attached Files


Edited by Oh My!, 14 August 2014 - 04:45 PM.
Log posted


#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 14 August 2014 - 04:48 PM

Fell free to reinstall Avast. Let me know about Safe Mode.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 fiftygrit

fiftygrit
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 14 August 2014 - 05:27 PM

Sorry Gary

 

I had intended to finish the post but had to get to work. 

 

I tried F8 - safe mode once and did not work.  Due to lack of time, was not able to try again.

 

With the FRST fix - were all of the malware removed?

 

OK to perform malware/virus scans?

 

Thanks again

 

Peter



#14 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 14 August 2014 - 05:30 PM

Hi Peter,

Yes do a scan and post the results, however I am not sure we are done yet.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:09:20 AM

Posted 19 August 2014 - 10:22 AM

Hi Peter,

Are you still with me?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users