Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Desperate need of help. Think I have a virus.


  • This topic is locked This topic is locked
14 replies to this topic

#1 Mookyvon1

Mookyvon1

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 11 October 2014 - 05:07 PM

So yeah. I can't run malwarebytes and this leads me to believe I may have a virus. Accidently ran combofix before seeing the warnings here... Anyway can someone help me? The log is below. ComboFix 14-10-04.01 - Jordan 1/2014 Sat 18:35:41.1.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.8098.5617 [GMT -4:00] Running from: c:\users\Jordan\Downloads\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\program files (x86)\SecureW2 c:\program files (x86)\SecureW2\sw2_res_default.bmp c:\program files (x86)\SecureW2\sw2_rsaproxy.exe c:\program files (x86)\SecureW2\sw2_service.exe c:\program files (x86)\SecureW2\sw2_tray.exe c:\program files (x86)\SecureW2\Uninstall.exe c:\programdata\Roaming . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_SW2SVC -------\Service_SW2SVC . . ((((((((((((((((((((((((( Files Created from 2014-09-11 to 2014-10-11 ))))))))))))))))))))))))))))))) . . 2014-10-11 22:14 . 2014-10-11 22:18 -------- d-----w- C:\FRST 2014-10-11 18:03 . 2014-10-11 18:05 -------- d-----w- c:\users\Jordan\AppData\Local\Popcorn-Time 2014-10-11 18:01 . 2014-10-11 20:16 -------- d-----w- c:\users\Jordan\AppData\Local\Popcorn Time 2014-10-07 03:35 . 2014-10-11 22:33 -------- d-----w- c:\users\Jordan\AppData\Roaming\Panda Security 2014-10-07 03:34 . 2014-10-11 22:51 -------- d-----w- c:\program files (x86)\Panda Security 2014-10-07 03:31 . 2014-10-11 22:33 -------- d-----w- c:\programdata\Panda Security 2014-10-07 03:10 . 2014-10-07 03:10 -------- d-s---w- c:\windows\SysWow64\Microsoft 2014-10-07 02:35 . 2014-10-07 22:52 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-10-07 02:34 . 2014-10-11 22:27 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-10-07 02:34 . 2014-10-11 20:29 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2014-10-07 02:34 . 2014-10-07 02:34 -------- d-----w- c:\programdata\Malwarebytes 2014-10-07 02:34 . 2014-05-12 11:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-10-07 02:34 . 2014-05-12 11:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-10-07 02:32 . 2010-08-30 12:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll 2014-10-07 02:25 . 2014-10-07 03:08 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin 2014-10-06 15:50 . 2014-08-17 03:58 702976 ------w- c:\program files\Internet Explorer\ieproxy.dll 2014-10-06 15:50 . 2014-08-17 03:58 2655232 ------w- c:\windows\system32\iertutil.dll 2014-10-06 15:50 . 2014-08-17 03:59 1407488 ------w- c:\windows\system32\urlmon.dll 2014-10-06 15:50 . 2014-08-17 04:00 2239488 ------w- c:\windows\system32\wininet.dll 2014-10-06 15:50 . 2014-08-17 03:57 1766400 ------w- c:\windows\SysWow64\wininet.dll 2014-10-06 15:14 . 2014-10-11 20:39 -------- d-----w- C:\AdwCleaner 2014-10-01 02:37 . 2014-10-07 02:05 -------- d-----w- c:\program files (x86)\ShadowOfMordor 2014-09-30 18:45 . 2014-09-30 18:45 -------- d-sh--w- c:\users\Jordan\AppData\Local\EmieUserList 2014-09-30 18:45 . 2014-09-30 18:45 -------- d-sh--w- c:\users\Jordan\AppData\Local\EmieSiteList 2014-09-24 14:36 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll 2014-09-24 14:36 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2014-09-23 22:20 . 2014-09-23 22:20 -------- d-----w- c:\users\Jordan\jagexcache 2014-09-23 22:16 . 2014-09-23 22:19 -------- d-----w- c:\programdata\Oracle 2014-09-23 22:13 . 2014-09-23 22:13 -------- d-----w- c:\program files (x86)\Common Files\Java 2014-09-23 22:13 . 2014-09-23 22:13 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-09-12 04:01 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll 2014-09-12 04:01 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2014-09-12 03:13 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll 2014-09-12 03:13 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll 2014-09-12 03:12 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll 2014-09-12 03:12 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll 2014-09-12 03:11 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll 2014-09-12 03:11 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll 2014-09-12 03:11 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll 2014-09-12 03:11 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll 2014-09-12 03:11 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll 2014-09-12 03:11 . 2014-09-05 02:10 578048 ----a-w- c:\windows\system32\aepdu.dll 2014-09-12 03:11 . 2014-09-05 02:05 424448 ----a-w- c:\windows\system32\aeinv.dll 2014-09-12 02:17 . 2014-09-12 02:17 -------- d-----w- c:\program files\iPod 2014-09-12 02:17 . 2014-09-12 02:18 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-09-12 02:17 . 2014-09-12 02:18 -------- d-----w- c:\program files\iTunes 2014-09-12 02:17 . 2014-09-12 02:18 -------- d-----w- c:\program files (x86)\iTunes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-09-24 19:04 . 2012-10-11 00:49 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-09-24 19:04 . 2012-02-09 21:35 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-09-15 13:06 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe 2014-09-12 04:01 . 2012-02-18 14:38 101694776 ----a-w- c:\windows\system32\MRT.exe 2014-09-09 02:05 . 2014-10-11 20:36 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{41CAE71C-5897-4EFE-9918-3CBFE811AC98}\mpengine.dll 2014-08-23 02:07 . 2014-08-27 21:09 404480 ----a-w- c:\windows\system32\gdi32.dll 2014-08-23 01:45 . 2014-08-27 21:09 311808 ----a-w- c:\windows\SysWow64\gdi32.dll 2014-08-23 00:59 . 2014-08-27 21:09 3163648 ----a-w- c:\windows\system32\win32k.sys 2014-08-09 13:53 . 2010-06-24 17:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-07-28 18:52 . 2014-07-28 18:52 6112072 ----a-w- c:\windows\system32\usbaaplrc.dll 2014-07-28 18:52 . 2014-07-28 18:52 54784 ----a-w- c:\windows\system32\drivers\usbaapl64.sys 2014-07-25 06:35 . 2014-07-25 06:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll 2014-07-25 03:47 . 2014-07-25 03:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll 2014-07-14 02:02 . 2014-08-15 21:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll 2014-07-14 01:40 . 2014-08-15 21:02 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll 2013-04-11 22:36 . 2013-07-12 02:40 84 ----a-w- c:\program files (x86)\update-Bioshock.bat 2013-01-24 01:04 . 2013-01-23 20:48 2753207451 ----a-w- c:\program files (x86)\Renaissance.exe 2012-05-17 00:07 . 2012-05-17 00:06 32288896 ----a-w- c:\program files (x86)\Diablo-III-Setup-enUS.exe . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [-] 2014-08-17 . EC5D850ED17252AD109CCFC8F700247C . 2239488 . . [10.00.9200.17088] .. c:\windows\system32\wininet.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "F.lux"="c:\users\Jordan\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-15 1016712] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160] "Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2014-09-04 40336] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-09-01 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-08-12 163040] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll c:\windows\SysWOW64\nvinit.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer8"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AMPPALP;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x] R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys;c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [x] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x] R3 Gun;Gun;c:\game\SoftnyxGame\GunBoundIS\Gun64.sys;c:\game\SoftnyxGame\GunBoundIS\Gun64.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x] R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R3 X6va006;X6va006;c:\users\Jordan\AppData\Local\Temp\00663A7.tmp;c:\users\Jordan\AppData\Local\Temp\00663A7.tmp [x] R3 X6va011;X6va011;c:\windows\SysWOW64\Drivers\X6va011;c:\windows\SysWOW64\Drivers\X6va011 [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x] S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x] S2 AMPPALR3;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x] S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x] S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x] S3 AMPPAL;IntelR CentrinoR Wireless BluetoothR 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x] S3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x] S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x] S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x] S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x] S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x] S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 tihub3;TI USB3 Hub Service;c:\windows\system32\DRIVERS\tihub3.sys;c:\windows\SYSNATIVE\DRIVERS\tihub3.sys [x] S3 tixhci;TI XHCI Service;c:\windows\system32\DRIVERS\tixhci.sys;c:\windows\SYSNATIVE\DRIVERS\tixhci.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-09-25 01:03 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.124\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2014-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-11 19:04] . 2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18 21:53] . 2014-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-18 21:53] . 2014-09-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-03-22 17:20] . 2014-10-11 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\pcdrcui.exe [2011-03-22 17:20] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144] "IntelTBRunOnce"="wscript.exe" [2013-10-12 168960] "BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-05-19 10365952] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2011-04-30 2055016] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\nvinitx.dll c:\windows\System32\nvinitx.dll . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com FF - ProfilePath - c:\users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default\ . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-SecureW2 Tray - c:\program files (x86)\SecureW2\sw2_tray.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file) AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe AddRemove-Skyrim Dawnguard DLC+Update v1.7706-=AviaRa=- 1.7706 - c:\users\Jordan\Desktop\skyrim\The Elder Scrolls V Skyrim\Skyrim Dawnguard DLC+Update v1.7706-=AviaRa=-\Uninstall.exe AddRemove-WildTangentGameProvider-dell-genres - c:\program files (x86)\WildTangent\Dell Games\Game Explorer Categories - genres\Uninstall.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va006] "ImagePath"="\??\c:\users\Jordan\AppData\Local\Temp\00663A7.tmp" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va011] "ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va011" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.15" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Completion time: 2014-10-11 19:01:27 - machine was rebooted ComboFix-quarantined-files.txt 2014-10-11 23:01 . Pre-Run: 310,240,817,152 bytes free Post-Run: 309,399,412,736 bytes free . - - End Of File - - 60EAE0DF0CB9C3EA29B3942FCAEE1E40 Don't know what it all means.

BC AdBot (Login to Remove)

 


m

#2 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 13 October 2014 - 07:53 PM

Help please



#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 14 October 2014 - 08:52 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).
  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
POST THE LOG FOR MY REVIEW.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

How is the computer running?
Wait for further instructions.

p.s.
Before proceeding with these scan please make sure that the Word Wrap is not enable in Notepad.
The each line in the logs must be terminated with A Carriage and Return.

#4 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 14 October 2014 - 03:52 PM

Computer is running fine. I just want to preface that before you replied I have done a lot of work and that super antispyware detected a trojan and removed it. How compromised is my computer from this? I have pasted that log. Also I keep getting a pop-up that says "The ordinal 591 could not be located  in the dynamic link library iertutil.dll." Working on the other ones.

 

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/12/2014 at 01:24 PM

Application Version : 6.0.1158
Database Version : 11552

Scan type       : Complete Scan
Total Scan Time : 00:41:01

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 576
Memory threats detected   : 0
Registry items scanned    : 73075
Registry threats detected : 0
File items scanned        : 28476
File threats detected     : 161

Adware.Tracking Cookie
    www.hitbox.tv [ C:\USERS\JORDAN\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\VCVBTPDJ ]
    .imrworldwide.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .imrworldwide.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .tns-counter.ru [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .dmtracker.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    008.free-counters.co.uk [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .tvtokyo.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .hit-counter.info [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .amazonlocal.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .histats.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .histats.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .msgvarsitynetwork.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .moviepilot-cdn.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    uk.sitestat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    uk.sitestat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www2.middlesexcc.edu [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .server.cpmstar.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.talkstats.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.talkstats.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    uk.sitestat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .nintendo.112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .subwayfranchiseeadvertising.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .statcounter.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .mtvn.112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .mswmwpapolloprod.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.hitbox.tv [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .stats.paypal.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .m.click2houston.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .m.click2houston.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    statse.webtrendslive.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .mmstat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .cnzz.mmstat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .doubleclick.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .ptftracking.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    fr.sitestat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    fr.sitestat.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .cbs.112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .nhlbi.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .experianservicescorp.122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .middlesexcountyhomesearcher.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .findthebest.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .elitedai.ly [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .businessfinder.nj.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .businessfinder.nj.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .amazon-adsystem.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .amazon-adsystem.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.linuxquestions.org [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.linuxquestions.org [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    counter.theconversation.edu.au [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.3dstats.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .serving-sys.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .serving-sys.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .bizrate.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .bizrate.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .bizrate.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .track.strife.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    track.strife.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.mybanktracker.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .doubleclick.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .businessfinder.nj.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .warnerbros.112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .122.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .oracle.112.2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .mediaplex.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .mediaplex.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .elitedai.ly [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .findlaw.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .statcounter.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .2o7.net [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .xiti.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    .xiti.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]
    statse.webtrendslive.com [ C:\USERS\JORDAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QKGBY0MX.DEFAULT\COOKIES.SQLITE ]

PUP.CNETInstaller
    C:\USERS\JORDAN\DOWNLOADS\CNET2_SETUPVIRTUALCLONEDRIVE5450_EXE.EXE

Trojan.Agent/Gen-Comrerop
    C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\PSPROFILER_PORTABLE[1].EXE
    C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\PSPROFILER_PORTABLE[2].EXE

============
 End of Log
============
 



#5 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 14 October 2014 - 04:25 PM

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/14/2014
Scan Time: 4:47:48 PM
Logfile: malwarebyteslog10_14.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.10.14.12
Rootkit Database: v2014.10.11.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Jordan

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 374944
Time Elapsed: 12 min, 28 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

 

 

 

 

 

# AdwCleaner v4.000 - Report created 14/10/2014 at 17:05:55
# DB v2014-10-14.6
# Updated 12/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Jordan - JORDAN-PC
# Running from : C:\Users\Jordan\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Mozilla Firefox v33.0 (x86 en-US)


-\\ Google Chrome v37.0.2062.124


*************************

AdwCleaner[R0].txt - [4841 octets] - [06/10/2014 11:14:57]
AdwCleaner[R1].txt - [2146 octets] - [06/10/2014 11:36:59]
AdwCleaner[R2].txt - [1276 octets] - [11/10/2014 16:38:06]
AdwCleaner[R3].txt - [1253 octets] - [12/10/2014 00:44:05]
AdwCleaner[R4].txt - [1215 octets] - [13/10/2014 20:56:13]
AdwCleaner[R5].txt - [1276 octets] - [14/10/2014 17:02:51]
AdwCleaner[S0].txt - [4981 octets] - [06/10/2014 11:23:49]
AdwCleaner[S1].txt - [1341 octets] - [11/10/2014 16:39:11]
AdwCleaner[S2].txt - [1122 octets] - [14/10/2014 17:05:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1182 octets] ##########
 

 

 

 

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-10-2014
Ran by Jordan (administrator) on JORDAN-PC on 14-10-2014 17:20:45
Running from C:\Users\Jordan\Downloads
Loaded Profile: Jordan (Available profiles: Jordan & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\Eap3Host.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Flux Software LLC) C:\Users\Jordan\AppData\Local\FluxSoftware\Flux\flux.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2055016 2011-04-29] ()
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-09-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\RunOnce: [Launcher] => C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-11] (Softthinks)
HKU\S-1-5-21-248914342-2356673332-3694029764-1002\...\Run: [F.lux] => C:\Users\Jordan\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-248914342-2356673332-3694029764-1002\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7767832 2014-10-01] (SUPERAntiSpyware)
HKU\S-1-5-21-248914342-2356673332-3694029764-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-08-30] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [247144 2012-08-30] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-08-30] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [202600 2012-08-30] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Jordan\AppData\Local\Citrix\Plugins\97\npappdetector.dll (Citrix Online)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npijjiautoinstallpluginff.dll (NHN USA Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: EPUBReader - C:\Users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default\Extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [2014-08-21]
FF Extension: Reddit Enhancement Suite - C:\Users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default\Extensions\jid1-xUfzOsOFlzSOXg@jetpack.xpi [2013-06-08]
FF Extension: NoScript - C:\Users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-02-15]
FF Extension: Adblock Plus - C:\Users\Jordan\AppData\Roaming\Mozilla\Firefox\Profiles\qkgby0mx.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-15]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK

Chrome:
=======
CHR Profile: C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-15]
CHR Extension: (Google Drive) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-20]
CHR Extension: (YouTube) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-15]
CHR Extension: (Google Search) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-15]
CHR Extension: (AdBlock) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-09-14]
CHR Extension: (Google Wallet) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-15]
CHR Extension: (Gmail) - C:\Users\Jordan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-15]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4816568 2014-10-13] (Emsisoft GmbH)
R2 Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [921664 2011-05-19] (Intel Corporation) [File not signed]
R3 Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [1335360 2011-05-19] (Intel Corporation) [File not signed]
R2 Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [995392 2011-05-19] (Intel Corporation) [File not signed]
S2 DellDigitalDelivery; C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [162816 2011-10-26] (Dell Products, LP.) [File not signed]
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-08-22] (Hi-Rez Studios) [File not signed]
S3 npggsvc; C:\windows\SysWOW64\GameMon.des [3804120 2011-08-07] (INCA Internet Co., Ltd.) [File not signed]
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-07-15] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
S3 Gun; C:\Game\SoftnyxGame\GunBoundIS\Gun64.sys [45176 2012-07-10] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [34304 2012-01-11] (ManyCam LLC)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-10-14] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2012-02-22] (ManyCam LLC)
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-08-02] (Apple Inc.) [File not signed]
S3 NPPTNT2; C:\windows\SysWOW64\npptNT2.sys [4682 2004-12-31] (INCA Internet Co., Ltd.) [File not signed]
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-08-30] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dump_wmimmc; \??\C:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [X]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
S3 X6va006; \??\C:\Users\Jordan\AppData\Local\Temp\00663A7.tmp [X]
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 17:20 - 2014-10-14 17:21 - 00019480 _____ () C:\Users\Jordan\Downloads\FRST.txt
2014-10-14 17:20 - 2014-10-14 17:20 - 02110464 _____ (Farbar) C:\Users\Jordan\Downloads\FRST64.exe
2014-10-14 17:06 - 2014-10-14 17:06 - 00000314 _____ () C:\windows\PFRO.log
2014-10-14 17:06 - 2014-10-14 17:06 - 00000056 _____ () C:\windows\setupact.log
2014-10-14 17:06 - 2014-10-14 17:06 - 00000000 _____ () C:\windows\setuperr.log
2014-10-14 13:43 - 2014-10-14 13:43 - 00322824 _____ () C:\Users\Jordan\Downloads\cc_20141014_134304_REGISTRY.reg
2014-10-14 13:40 - 2014-10-14 13:40 - 04965896 _____ (Piriform Ltd) C:\Users\Jordan\Downloads\ccsetup418.exe
2014-10-14 13:16 - 2014-10-14 13:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-14 00:39 - 2014-10-14 00:39 - 00000000 ____D () C:\ProgramData\Emsisoft
2014-10-13 21:04 - 2014-10-13 21:04 - 00001053 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-10-13 21:04 - 2014-10-13 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-10-13 21:03 - 2014-10-14 17:08 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-10-13 21:02 - 2014-10-13 21:03 - 233663808 _____ (Emsisoft GmbH ) C:\Users\Jordan\Downloads\EmsisoftAntiMalwareSetup.exe
2014-10-13 20:56 - 2014-10-13 20:56 - 01976320 _____ () C:\Users\Jordan\Downloads\AdwCleaner.exe
2014-10-12 00:49 - 2014-10-12 00:49 - 00001770 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-10-12 00:49 - 2014-10-12 00:49 - 00001613 _____ () C:\Users\Public\Desktop\League of Legends.lnk
2014-10-12 00:49 - 2014-10-12 00:49 - 00000000 ____D () C:\Riot Games
2014-10-12 00:49 - 2014-10-12 00:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-10-12 00:48 - 2014-10-14 17:08 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-10-12 00:48 - 2014-10-12 00:50 - 00000000 ____D () C:\Users\Jordan\AppData\Roaming\Riot Games
2014-10-12 00:48 - 2014-10-12 00:48 - 19809608 _____ (SUPERAntiSpyware) C:\Users\Jordan\Downloads\SUPERAntiSpyware.exe
2014-10-12 00:48 - 2014-10-12 00:48 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-10-12 00:47 - 2014-10-12 00:47 - 27864920 _____ (Riot Games) C:\Users\Jordan\Downloads\LeagueofLegends_NA_Installer_9_15_2014.exe
2014-10-12 00:06 - 2014-10-14 16:47 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-12 00:06 - 2014-10-12 00:06 - 00001064 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-10-12 00:05 - 2014-10-12 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-12 00:05 - 2014-10-12 00:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-12 00:05 - 2014-10-12 00:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-10-12 00:05 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-12 00:05 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-12 00:05 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-10-12 00:01 - 2014-10-12 00:01 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Jordan\Downloads\mbam-clean-2.1.1.1001.exe
2014-10-11 23:57 - 2014-10-11 23:57 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Jordan\Downloads\tdsskiller.exe
2014-10-11 23:49 - 2014-10-11 23:49 - 00000000 ____D () C:\Users\Jordan\AppData\Roaming\SUPERAntiSpyware.com
2014-10-11 19:21 - 2014-10-11 19:21 - 125977840 _____ (Microsoft Corporation) C:\Users\Jordan\Downloads\msert.exe
2014-10-11 19:11 - 2014-10-11 19:11 - 01359383 _____ () C:\Users\Jordan\Downloads\Flux30.zip
2014-10-11 19:11 - 2014-10-11 19:11 - 00000000 ____D () C:\Users\Jordan\Downloads\Flux30
2014-10-11 19:01 - 2014-10-11 19:01 - 00029167 _____ () C:\ComboFix.txt
2014-10-11 18:33 - 2011-06-26 02:45 - 00256000 _____ () C:\windows\PEV.exe
2014-10-11 18:33 - 2010-11-07 13:20 - 00208896 _____ () C:\windows\MBR.exe
2014-10-11 18:33 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-10-11 18:33 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-10-11 18:33 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-10-11 18:33 - 2000-08-30 20:00 - 00098816 _____ () C:\windows\sed.exe
2014-10-11 18:33 - 2000-08-30 20:00 - 00080412 _____ () C:\windows\grep.exe
2014-10-11 18:33 - 2000-08-30 20:00 - 00068096 _____ () C:\windows\zip.exe
2014-10-11 18:30 - 2014-10-11 19:01 - 00000000 ____D () C:\Qoobox
2014-10-11 18:30 - 2014-10-11 18:58 - 00000000 ____D () C:\windows\erdnt
2014-10-11 18:30 - 2014-10-11 18:30 - 05582481 ____R (Swearware) C:\Users\Jordan\Downloads\ComboFix.exe
2014-10-11 18:28 - 2014-10-11 18:28 - 00854436 _____ () C:\Users\Jordan\Downloads\SecurityCheck.exe
2014-10-11 18:27 - 2014-10-11 18:27 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Jordan\Downloads\WiNlOgOn.exe
2014-10-11 18:27 - 2014-10-11 18:27 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Jordan\Downloads\WiNlOgOn64.exe
2014-10-11 18:14 - 2014-10-14 17:20 - 00000000 ____D () C:\FRST
2014-10-11 18:14 - 2014-10-11 19:31 - 00000000 ____D () C:\Users\Jordan\Downloads\FRST
2014-10-11 18:04 - 2014-10-11 18:27 - 00001420 _____ () C:\Users\Jordan\Desktop\Rkill.txt
2014-10-11 18:04 - 2014-10-11 18:04 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Jordan\Downloads\rkill.exe
2014-10-11 16:35 - 2014-09-24 22:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-11 16:35 - 2014-09-24 21:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2014-10-11 15:46 - 2014-10-11 15:51 - 00000000 ____D () C:\Users\Jordan\Downloads\The Shield Season 1, 2, 3, 4, 5, 6 & 7 Deluxe DVD Box Set HDTV + Extras (Extra Episode, Extended Episodes, Behind the Scenes etc.)
2014-10-11 14:03 - 2014-10-11 14:05 - 00000000 ____D () C:\Users\Jordan\AppData\Local\Popcorn-Time
2014-10-11 14:02 - 2014-10-11 16:16 - 00000000 ____D () C:\Users\Jordan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn Time
2014-10-11 14:01 - 2014-10-11 16:16 - 00000000 ____D () C:\Users\Jordan\AppData\Local\Popcorn Time
2014-10-06 23:51 - 2014-10-06 23:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-10-06 23:35 - 2014-10-11 18:33 - 00000000 ____D () C:\Users\Jordan\AppData\Roaming\Panda Security
2014-10-06 23:34 - 2014-10-11 18:51 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2014-10-06 23:31 - 2014-10-11 18:33 - 00000000 ____D () C:\ProgramData\Panda Security
2014-10-06 23:31 - 2014-10-06 23:31 - 01329312 _____ () C:\Users\Jordan\Downloads\PANDAFREEAV.exe
2014-10-06 22:33 - 2014-10-12 00:05 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jordan\Downloads\mbam-setup-2.0.2.1012.exe
2014-10-06 22:32 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\SysWOW64\sqlite3.dll
2014-10-06 22:25 - 2014-10-06 23:08 - 00000000 __SHD () C:\windows\SysWOW64\AI_RecycleBin
2014-10-06 22:21 - 2014-10-06 22:22 - 02178048 _____ (Reason Software Company Inc.) C:\Users\Jordan\Downloads\ShouldIRemoveIt_Setup.exe
2014-10-06 11:50 - 2014-08-17 00:00 - 02239488 ____N (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-06 11:50 - 2014-08-16 23:59 - 01407488 ____N (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-06 11:50 - 2014-08-16 23:58 - 02655232 ____N (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-06 11:50 - 2014-08-16 23:57 - 02055168 ____N (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-06 11:50 - 2014-08-16 23:57 - 01766400 ____N (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-06 11:50 - 2014-08-16 23:57 - 01180672 ____N (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-06 11:14 - 2014-10-14 17:05 - 00000000 ____D () C:\AdwCleaner
2014-10-05 14:14 - 2014-10-05 15:31 - 00015871 _____ () C:\Users\Jordan\Documents\Ops HW2.xlsx
2014-10-01 17:50 - 2014-10-01 17:56 - 00000000 ____D () C:\Users\Jordan\Downloads\Shield.HQ.x264.ac3-Season.2-MCH
2014-09-30 22:37 - 2014-10-06 22:05 - 00000000 ____D () C:\Program Files (x86)\ShadowOfMordor
2014-09-30 14:45 - 2014-09-30 14:45 - 00000000 __SHD () C:\Users\Jordan\AppData\Local\EmieUserList
2014-09-30 14:45 - 2014-09-30 14:45 - 00000000 __SHD () C:\Users\Jordan\AppData\Local\EmieSiteList
2014-09-30 12:51 - 2014-10-06 22:05 - 00000000 ____D () C:\Users\Jordan\Downloads\Middle-earth Shadow of Mordor [Steam-Rip]
2014-09-27 17:37 - 2014-09-27 18:40 - 00009966 _____ () C:\Users\Jordan\Documents\Mang info sys hw2.xlsx
2014-09-26 19:18 - 2014-09-26 19:23 - 00000000 ____D () C:\Users\Jordan\Downloads\Shield.HQ.x264.ac3-Season.1-MCH
2014-09-24 10:36 - 2014-09-09 18:11 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-09-24 10:36 - 2014-09-09 17:47 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-09-23 18:20 - 2014-09-23 18:28 - 00000024 _____ () C:\Users\Jordan\random.dat
2014-09-23 18:20 - 2014-09-23 18:24 - 00000045 _____ () C:\Users\Jordan\jagex_cl_runescape_LIVE.dat
2014-09-23 18:20 - 2014-09-23 18:20 - 00000000 ____D () C:\Users\Jordan\jagexcache
2014-09-23 18:16 - 2014-09-23 18:19 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-23 18:13 - 2014-10-06 22:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-23 18:13 - 2014-09-23 18:13 - 00272808 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-09-23 18:13 - 2014-09-23 18:13 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-09-23 18:13 - 2014-09-23 18:13 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-09-23 18:13 - 2014-09-23 18:13 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-09-23 18:11 - 2014-09-23 18:11 - 00918952 _____ (Oracle Corporation) C:\Users\Jordan\Downloads\jxpiinstall.exe
2014-09-20 16:14 - 2014-09-20 19:23 - 00015508 _____ () C:\Users\Jordan\Documents\Ops HW1.xlsx

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-14 17:15 - 2009-07-14 00:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-14 17:15 - 2009-07-14 00:45 - 00028576 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-14 17:11 - 2012-02-09 17:24 - 01419585 _____ () C:\windows\WindowsUpdate.log
2014-10-14 17:08 - 2012-10-18 17:53 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-14 17:08 - 2012-02-15 16:09 - 00000000 ____D () C:\Users\Jordan\AppData\Local\SoftThinks
2014-10-14 17:07 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-14 17:06 - 2012-05-04 06:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-14 17:06 - 2012-02-09 17:46 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-14 17:04 - 2013-05-20 11:40 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-14 17:02 - 2012-10-18 17:53 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-14 13:46 - 2012-02-15 16:34 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-14 13:45 - 2011-02-23 09:08 - 00000000 ____D () C:\windows\Panther
2014-10-14 13:40 - 2013-11-11 14:48 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-14 13:31 - 2012-04-09 13:20 - 00000000 ____D () C:\Users\Jordan\AppData\Roaming\vlc
2014-10-14 12:27 - 2012-02-15 16:12 - 00000422 _____ () C:\windows\Tasks\SystemToolsDailyTest.job
2014-10-14 12:26 - 2012-02-18 13:00 - 00003488 _____ () C:\windows\System32\Tasks\PCDEventLauncher
2014-10-14 12:26 - 2012-02-15 16:12 - 00003452 _____ () C:\windows\System32\Tasks\SystemToolsDailyTest
2014-10-12 00:40 - 2012-02-09 17:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-11 19:12 - 2013-09-29 11:34 - 00597304 _____ () C:\Users\Jordan\Downloads\flux-setup.exe
2014-10-11 19:01 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default
2014-10-11 18:53 - 2009-07-13 22:34 - 00000215 _____ () C:\windows\system.ini
2014-10-11 18:52 - 2009-07-14 00:45 - 00369128 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-11 18:51 - 2009-07-13 22:34 - 82837504 _____ () C:\windows\system32\config\SOFTWARE.bak
2014-10-11 18:51 - 2009-07-13 22:34 - 28049408 _____ () C:\windows\system32\config\SYSTEM.bak
2014-10-11 18:51 - 2009-07-13 22:34 - 01572864 _____ () C:\windows\system32\config\DEFAULT.bak
2014-10-11 18:51 - 2009-07-13 22:34 - 00262144 _____ () C:\windows\system32\config\SECURITY.bak
2014-10-11 18:51 - 2009-07-13 22:34 - 00262144 _____ () C:\windows\system32\config\SAM.bak
2014-10-11 18:42 - 2012-02-15 16:09 - 00071712 _____ () C:\Users\Jordan\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-11 16:18 - 2012-02-15 16:09 - 00000000 ____D () C:\Users\Jordan
2014-10-11 16:17 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\system32\NDF
2014-10-11 16:16 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\registration
2014-10-07 12:11 - 2009-07-14 01:13 - 00782470 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-07 12:05 - 2013-06-02 01:11 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-10-06 23:51 - 2012-04-04 16:22 - 00001028 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-10-06 22:06 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-10-06 22:05 - 2012-02-09 18:12 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-10-06 22:05 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache
2014-10-06 22:05 - 2009-07-13 23:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-02 00:31 - 2013-08-24 12:32 - 00005343 _____ () C:\Users\Jordan\Documents\Research.txt
2014-09-29 12:54 - 2012-02-15 16:28 - 00000000 ____D () C:\Users\Jordan\AppData\Local\Nero
2014-09-28 09:46 - 2012-02-15 16:12 - 00000564 _____ () C:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
2014-09-27 11:11 - 2012-02-15 16:12 - 00004272 _____ () C:\windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2014-09-24 21:05 - 2013-12-15 15:33 - 00002145 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-24 15:04 - 2013-05-20 11:40 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 15:04 - 2012-10-10 20:49 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-09-24 15:04 - 2012-02-09 17:35 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-18 22:06 - 2012-04-01 22:09 - 00001981 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-09-18 22:06 - 2012-02-09 18:16 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-09-15 09:06 - 2010-11-20 23:27 - 00278152 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-09-14 10:39 - 2009-07-14 01:08 - 00032530 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-09-14 10:39 - 2009-07-14 01:08 - 00032530 _____ () C:\windows\Tasks\SCHEDLGU(30).TXT

Files to move or delete:
====================
C:\Users\Jordan\jagex_cl_runescape_LIVE.dat
C:\Users\Jordan\random.dat


Some content of TEMP:
====================
C:\Users\Jordan\AppData\Local\Temp\Quarantine.exe
C:\Users\Jordan\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-30 18:03

==================== End Of Log ============================

 

 

 

 

Attached Files



#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 16 October 2014 - 08:25 AM

Sorry for this delay.

 

I have to rebuild my system due to a major problem.

 

If I do not answer you in the next two days please send me a personal message.

 

Sorry.



#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 17 October 2014 - 08:57 AM


Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.


start

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dump_wmimmc; \??\C:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [X]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
S3 X6va006; \??\C:\Users\Jordan\AppData\Local\Temp\00663A7.tmp [X]
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

End
Save the files as fixlist.txt into the same folder as FRST

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.

If the site is busy or not available use this mirror site:
http://www.bleepingcomputer.com/download/securitycheck/
---

How is the computer running now?

#8 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 17 October 2014 - 11:37 AM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-10-2014
Ran by Jordan at 2014-10-17 12:17:25 Run:2
Running from C:\Users\Jordan\Downloads\FRST
Loaded Profile: Jordan (Available profiles: Jordan & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dump_wmimmc; \??\C:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [X]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
S3 X6va006; \??\C:\Users\Jordan\AppData\Local\Temp\00663A7.tmp [X]
S3 X6va011; \??\C:\windows\SysWOW64\Drivers\X6va011 [X]

End
*****************

"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Key deleted successfully.
"HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}" => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully.
"HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.
"HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}" => Key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin" => Key deleted successfully.
catchme => Service deleted successfully.
dump_wmimmc => Service deleted successfully.
EagleX64 => Service deleted successfully.
X6va006 => Service deleted successfully.
X6va011 => Service deleted successfully.

==== End of Fixlog ====

 

 

Results of screen317's Security Check version 0.99.89  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 JavaFX 2.1.1    
 Java 7 Update 67  
 Adobe Flash Player 15.0.0.152  
 Adobe Reader 10.1.12 Adobe Reader out of Date!  
 Mozilla Firefox (33.0)
 Google Chrome 37.0.2062.124  
 Google Chrome 38.0.2125.104  
````````Process Check: objlist.exe by Laurent````````  
 Emsisoft Anti-Malware a2service.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 4%
````````````````````End of Log``````````````````````

 

Computer runs fine.



#9 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 17 October 2014 - 01:46 PM

Get the latest version of the Adobe Reader.
http://get.adobe.com/reader/
Before your download I suggest you unckeck the box on the top right "Yes, install McAfee Security Scan Plus - optional" this is not required if you are not a McAfee subscriber. While the installation is in progress you can also deny the installation of any other programs that may be suggested.

When installed remove your old version of the Reader using the Add/Remove Programs applet if present.
<<<>>>

If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#10 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 17 October 2014 - 04:40 PM

Is that all? No traces of any malware/trojan? I posted the superantispyware log up there and it removed a trojan.



#11 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 18 October 2014 - 09:02 AM

Trojan.Agent/Gen-Comrerop
C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\PSPROFILER_PORTABLE[1].EXE
C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\PSPROFILER_PORTABLE[2].EXE

The files were in your Temporary Internet file folder.

Files in that folder are not executed unless you run them.

#12 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 18 October 2014 - 09:21 AM

Ok. So just making sure I am clean right?



#13 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 18 October 2014 - 12:35 PM

Yes!

#14 Mookyvon1

Mookyvon1
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:32 AM

Posted 19 October 2014 - 02:05 PM

Ok thanks for all your help!



#15 nasdaq

nasdaq

  • Malware Response Team
  • 38,250 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:08:32 PM

Posted 19 October 2014 - 03:39 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users