Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with something, do not know what it is, need serious help.


  • This topic is locked This topic is locked
11 replies to this topic

#1 NineVision

NineVision

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:04:22 PM

Posted 09 November 2014 - 05:04 PM

So was browsing here and there, decided to that i wanted to watch football. Came to a site, all kinds of pop ups coming up and then my virus protection program goes off and continues to goes off. Whatever it's doing I dont know what it is. I check task manager and I have IE open 4 of them and they don't close and I can't even bring the window back up.

 

Please help me, soon as possible thanks.

 

 

 

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.17116  BrowserJavaVersion: 10.67.2
Run by Daehan1 at 16:53:11 on 2014-11-09
Microsoft Windows 7 Professional   6.1.7601.1.949.82.1033.18.4046.1639 [GMT -5:00]
.
AV: McAfee VirusScan Enterprise *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files\IDT\WDM\STacSV64.exe
C:\windows\system32\Hpservice.exe
C:\windows\system32\vcsFPService.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
C:\windows\system32\WLANExt.exe
C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe
c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe
c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe
C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\windows\system32\mfevtps.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
C:\Program Files (x86)\PDF Complete\pdfsvc.exe
C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
C:\windows\system32\SCPwrSetSvr.exe
C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
C:\Program Files (x86)\DriverUpdate\DriverUpdate.exe
C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
C:\windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE
c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe
c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\windows\system32\taskhost.exe
-k netsvcs
C:\Users\Daehan1\AppData\Roaming\FrameworkUpdate7\GoogleUpdate.exe
C:\windows\explorer.exe
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\windows\syswow64\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\windows\System32\sdiagnhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\System32\sdiagnhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\System32\sdiagnhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearch Bar = Preserve
uDefault_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=hp&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984
mStart Page = about:blank
mSearch Page = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}
mDefault_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=hp&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984
mDefault_Search_URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}
mWinlogon: Userinit = userinit.exe
BHO: File Sanitizer for HP ProtectTools: {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20140507171225.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
uRun: [GoogleUpdate] C:\Users\Daehan1\AppData\Roaming\FrameworkUpdate7\GoogleUpdate.exe
uRun: [YimjUjhuj] regsvr32.exe "C:\ProgramData\YimjUjhuj\YimjUjhuj.dat"
uRun: [CikeBfas] regsvr32.exe "C:\ProgramData\CikeBfas\CikeBfas.dat"
mRun: [File Sanitizer] C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [NUSB3MON] "c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [HPConnectionManager] c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
mRun: [HPQuickWebProxy] "c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
mRun: [IFXSPMGT] "c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe" /NotifyLogon
mRun: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe
mRun: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
mRun: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
mRun: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
StartupFolder: C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\RAINME~1.LNK - C:\Program Files\Rainmeter\Rainmeter.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-Windows\System: UseOEMBackground = dword:1
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} - hxxp://172.16.112.231/scriptX/ScriptX.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/mjss/MJSS.cab109791.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {E0FEE963-BB53-4215-81AD-B28C77384644} - hxxps://pattcw.att.motive.com/wizlet/DSLActivation/static/installer/ATTInternetInstaller64.cab
DPF: {EF3AFB74-6F3C-491F-8FF2-FBEC88ADEBE5} - hxxp://www.kiwidisk.com/app/KiwidiskCtrl.CAB
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{CB61A838-517C-4EE5-A8C6-FE8017B03616} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CB61A838-517C-4EE5-A8C6-FE8017B03616}\448435F4C40313 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CB61A838-517C-4EE5-A8C6-FE8017B03616}\448435F4C40323 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{CB61A838-517C-4EE5-A8C6-FE8017B03616}\4616568616E677962756C6563737 : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{CB61A838-517C-4EE5-A8C6-FE8017B03616}\C696E6B6379737F5F475F52303930343 : DHCPNameServer = 75.76.84.102 75.76.84.103
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\SAP\FrontEnd\SAPgui\SAPHTMLP.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Notify: DeviceNP - DeviceNP.dll
SSODL: WebCheck - <orphaned>
LSA: Notification Packages =  EpePcNp64 DPPassFilter scecli
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
x64-mStart Page = about:blank
x64-mSearch Page = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}
x64-mDefault_Page_URL = hxxp://www.dosearches.com/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=hp&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984
x64-mDefault_Search_URL = hxxp://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}
x64-mWinlogon: Userinit = C:\windows\System32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20140507171224.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll
x64-Run: [HPPowerAssistant] C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe
x64-Run: [MfeEpePcMonitor] "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe"
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - <orphaned>
x64-Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 172.16.112.231 dwp
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Daehan1\AppData\Roaming\Mozilla\Firefox\Profiles\w4l83hoq.default\
FF - prefs.js: browser.search.selectedEngine - dosearches
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Common Files\Motive\npMotive.dll
FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MfeEpeOpal;MfeEpeOpal;C:\windows\System32\drivers\MfeEpeOpal.sys [2012-2-8 100808]
R0 MfeEpePc;MfeEpePc;C:\windows\System32\drivers\MfeEpePc.sys [2012-2-8 158920]
R0 mfehidk;McAfee Inc. mfehidk;C:\windows\System32\drivers\mfehidk.sys [2014-5-7 782968]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\windows\System32\drivers\mfewfpk.sys [2014-5-7 344176]
R0 PxHlpa64;PxHlpa64;C:\windows\System32\drivers\PxHlpa64.sys [2011-3-6 55856]
R1 PersonalSecureDrive;PersonalSecureDrive;C:\windows\System32\drivers\psd.sys [2010-1-26 44576]
R2 HP Power Assistant Service;HP Power Assistant Service;C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [2011-1-26 131128]
R2 HPDayStarterService;HP DayStarter Service;C:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [2011-1-28 133688]
R2 HPFSService;File Sanitizer for HP ProtectTools;C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [2011-2-7 320000]
R2 hpHotkeyMonitor;hpHotkeyMonitor;C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [2012-6-20 523680]
R2 hpsrv;HP Service;C:\windows\System32\hpservice.exe [2012-4-25 31000]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-2-26 13336]
R2 jhi_service;Intel® Identity Protection Technology Host Interface Service;C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2010-11-29 210896]
R2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [2012-2-8 1323008]
R2 McAfeeFramework;McAfee Framework Service;C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [2013-6-25 130080]
R2 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2013-2-28 517632]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2014-5-7 242448]
R2 McTaskManager;McAfee Task Manager;C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [2014-1-15 208416]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\windows\System32\mfevtps.exe [2014-5-7 185280]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;C:\windows\System32\drivers\ArcSoftVCapture.sys [2012-2-26 32192]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\windows\System32\drivers\AtihdW76.sys [2014-6-21 94720]
R3 btwampfl;Bluetooth AMP USB Filter;C:\windows\System32\drivers\btwampfl.sys [2012-2-26 344616]
R3 btwl2cap;Bluetooth L2CAP Service;C:\windows\System32\drivers\btwl2cap.sys [2012-2-26 39464]
R3 HP ProtectTools Service;HP ProtectTools Service;C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2011-1-12 36864]
R3 hpCMSrv;HP Connection Manager 4 Service;C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-4-5 1094712]
R3 JMCR;JMCR;C:\windows\System32\drivers\jmcr.sys [2013-2-27 175928]
R3 johci;JMicron 1394 Filter Driver;C:\windows\System32\drivers\johci.sys [2013-2-27 26208]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\windows\System32\drivers\mfeavfk.sys [2014-5-7 311600]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\windows\System32\drivers\nusb3hub.sys [2010-12-10 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\windows\System32\drivers\nusb3xhc.sys [2010-12-10 181248]
S2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-11-15 89600]
S2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2014-9-15 239616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 HP Support Assistant Service;HP Support Assistant Service;"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" --> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [?]
S3 DAMDrv;DAMDrv;C:\windows\System32\drivers\DAMDrv64.sys [2011-2-7 63336]
S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;C:\Windows\SysWOW64\flcdlock.exe [2011-2-3 464480]
S3 mferkdet;McAfee Inc. mferkdet;C:\windows\System32\drivers\mferkdet.sys [2014-5-7 107032]
S3 SWDUMon;SWDUMon;C:\windows\System32\drivers\SWDUMon.sys [2013-8-2 16152]
S3 SzCCID;USB SmartCard Reader Driver;C:\windows\System32\drivers\SzCCID.sys [2013-4-25 43520]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2012-3-30 59392]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2014-11-09 20:58:09 -------- d-----w- C:\ProgramData\CikeBfas
2014-11-09 20:57:18 -------- d-----w- C:\ProgramData\YimjUjhuj
2014-11-09 20:54:15 -------- d-----w- C:\Users\Daehan1\AppData\Roaming\FrameworkUpdate7
2014-11-09 20:45:21 -------- d-----w- C:\Users\Daehan1\AppData\Local\{4F93D38E-EEBF-41CF-B9FA-0B39498F6C6D}
2014-11-08 17:32:46 -------- d-----w- C:\Users\Daehan1\AppData\Local\{6784184F-3FDF-47E2-8754-39C4DD07B639}
2014-11-07 13:38:24 11627712 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EFD30A38-B5A3-4FC7-A465-7F1E898C0BFF}\mpengine.dll
2014-11-06 13:12:28 -------- d-----w- C:\Users\Daehan1\AppData\Local\{5DE1970B-B148-4152-9AAF-D5C099B08E30}
2014-11-04 13:03:07 -------- d-----w- C:\Users\Daehan1\AppData\Local\{C49D7C19-009D-492C-8AD3-2F6767C75D86}
2014-10-31 13:00:27 -------- d-----w- C:\Users\Daehan1\AppData\Local\{FF940738-8C9D-4FF5-949E-EE0B080536D4}
2014-10-30 12:06:38 -------- d-----w- C:\Users\Daehan1\AppData\Local\{6A72FC7F-26DB-4413-BD4B-9A34D397137B}
2014-10-29 11:50:27 -------- d-----w- C:\Users\Daehan1\AppData\Local\{E0542BD6-8E07-49B3-B5D6-329B6CA58AE6}
2014-10-28 12:09:27 -------- d-----w- C:\Users\Daehan1\AppData\Local\{9C9977F5-DA00-423C-A131-8AA25493D142}
2014-10-27 11:54:25 -------- d-----w- C:\Users\Daehan1\AppData\Local\{4161004E-82AC-440C-8CA5-699C05C28E45}
2014-10-25 11:05:56 -------- d-----w- C:\Users\Daehan1\AppData\Local\{8D68863A-500B-4C04-AF11-B5231A09C4D3}
2014-10-24 12:09:23 -------- d-----w- C:\Users\Daehan1\AppData\Local\{8011F154-DAB8-4E22-9FC9-3293A13D1567}
2014-10-23 13:27:48 -------- d-----w- C:\Users\Daehan1\AppData\Local\{7FD31051-F6CC-4FEF-AA23-623F1A1AA110}
2014-10-22 02:29:08 -------- d-----w- C:\Users\Daehan1\AppData\Local\{B3CAFB18-2F6F-4FB7-AF06-5A77554BE5D7}
2014-10-21 11:46:08 -------- d-----w- C:\Users\Daehan1\AppData\Local\{3ED731C9-36AD-4688-985F-4649A6C865B6}
2014-10-20 11:37:32 -------- d-----w- C:\Users\Daehan1\AppData\Local\{51C6517C-D158-4876-BC29-27E398A1D586}
2014-10-17 11:42:12 -------- d-----w- C:\Users\Daehan1\AppData\Local\{E658AAD5-2516-496F-B0F7-E35A7D0FC31C}
2014-10-16 11:35:38 -------- d-----w- C:\Users\Daehan1\AppData\Local\{5A05FB34-F108-4A30-B1F5-EDD64A807FC5}
2014-10-15 10:54:00 3198976 ----a-w- C:\windows\System32\win32k.sys
2014-10-15 10:52:59 17920 ----a-w- C:\windows\System32\appidcertstorecheck.exe
2014-10-15 10:51:52 3241472 ----a-w- C:\windows\System32\msi.dll
2014-10-15 10:50:11 77312 ----a-w- C:\windows\System32\packager.dll
2014-10-15 10:50:10 67072 ----a-w- C:\windows\SysWow64\packager.dll
2014-10-14 10:41:32 -------- d-----w- C:\Users\Daehan1\AppData\Local\{722905CD-51F4-4718-9464-4AB77BE0C795}
2014-10-13 14:39:35 -------- d-----w- C:\Users\Daehan1\AppData\Local\{090F87C8-DA56-470A-B5E9-45F1E1B2263A}
2014-10-11 12:21:36 -------- d-----w- C:\Users\Daehan1\AppData\Local\{0951933A-284F-4D38-89FF-BFA781EFAB26}
.
==================== Find3M  ====================
.
2014-11-09 20:44:02 16152 ----a-w- C:\windows\System32\drivers\SWDUMon.sys
2014-10-28 10:34:58 275080 ------w- C:\windows\System32\MpSigStub.exe
2014-10-10 02:05:59 276480 ----a-w- C:\windows\System32\generaltel.dll
2014-10-10 02:05:42 507392 ----a-w- C:\windows\System32\aepdu.dll
2014-10-10 02:00:38 424448 ----a-w- C:\windows\System32\aeinv.dll
2014-09-25 02:08:38 371712 ----a-w- C:\windows\System32\qdvd.dll
2014-09-25 01:40:50 519680 ----a-w- C:\windows\SysWow64\qdvd.dll
2014-09-20 05:17:42 2236928 ----a-w- C:\windows\System32\wininet.dll
2014-09-20 05:16:11 3959296 ----a-w- C:\windows\System32\jscript9.dll
2014-09-20 05:16:07 67072 ----a-w- C:\windows\System32\iesetup.dll
2014-09-20 05:16:07 136704 ----a-w- C:\windows\System32\iesysprep.dll
2014-09-20 05:15:22 1508864 ----a-w- C:\windows\System32\inetcpl.cpl
2014-09-20 03:57:57 1762816 ----a-w- C:\windows\SysWow64\wininet.dll
2014-09-20 03:57:04 2861568 ----a-w- C:\windows\SysWow64\jscript9.dll
2014-09-20 03:57:01 61440 ----a-w- C:\windows\SysWow64\iesetup.dll
2014-09-20 03:57:01 109056 ----a-w- C:\windows\SysWow64\iesysprep.dll
2014-09-20 03:56:33 1440768 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2014-09-20 03:38:36 2706432 ----a-w- C:\windows\System32\mshtml.tlb
2014-09-20 03:33:44 2706432 ----a-w- C:\windows\SysWow64\mshtml.tlb
2014-09-20 02:43:32 89600 ----a-w- C:\windows\System32\RegisterIEPKEYs.exe
2014-09-20 02:35:33 71680 ----a-w- C:\windows\SysWow64\RegisterIEPKEYs.exe
2014-09-18 01:32:52 2363904 ----a-w- C:\windows\SysWow64\msi.dll
2014-09-15 22:32:00 78432 ----a-w- C:\windows\System32\atimpc64.dll
2014-09-15 22:32:00 78432 ----a-w- C:\windows\System32\amdpcom64.dll
2014-09-15 22:32:00 71704 ----a-w- C:\windows\SysWow64\atimpc32.dll
2014-09-15 22:32:00 71704 ----a-w- C:\windows\SysWow64\amdpcom32.dll
2014-09-15 22:31:50 144328 ----a-w- C:\windows\System32\atiuxp64.dll
2014-09-15 22:31:48 126848 ----a-w- C:\windows\SysWow64\atiuxpag.dll
2014-09-15 22:31:46 118096 ----a-w- C:\windows\System32\atiu9p64.dll
2014-09-15 22:31:44 100032 ----a-w- C:\windows\SysWow64\atiu9pag.dll
2014-09-15 22:31:42 1335544 ----a-w- C:\windows\System32\aticfx64.dll
2014-09-15 22:31:40 1113576 ----a-w- C:\windows\SysWow64\aticfx32.dll
2014-09-15 22:31:34 10826488 ----a-w- C:\windows\System32\atidxx64.dll
2014-09-15 22:31:30 9254184 ----a-w- C:\windows\SysWow64\atidxx32.dll
2014-09-15 22:31:22 7207592 ----a-w- C:\windows\SysWow64\atiumdva.dll
2014-09-15 22:31:16 7028336 ----a-w- C:\windows\SysWow64\atiumdag.dll
2014-09-15 22:31:06 8044976 ----a-w- C:\windows\System32\atiumd6a.dll
2014-09-15 22:31:02 8296296 ----a-w- C:\windows\System32\atiumd64.dll
2014-09-15 22:29:04 293088 ----a-w- C:\windows\System32\drivers\amdacpksd.sys
2014-09-15 22:26:58 16750080 ----a-w- C:\windows\System32\drivers\atikmdag.sys
2014-09-15 22:21:34 51200 ----a-w- C:\windows\System32\kdbsdk64.dll
2014-09-15 22:19:58 38912 ----a-w- C:\windows\SysWow64\kdbsdk32.dll
2014-09-15 22:18:06 235008 ----a-w- C:\windows\System32\clinfo.exe
2014-09-15 22:18:02 995342 ----a-w- C:\windows\SysWow64\amdocl_as32.exe
2014-09-15 22:18:02 798734 ----a-w- C:\windows\SysWow64\amdocl_ld32.exe
2014-09-15 22:18:02 1187342 ----a-w- C:\windows\System32\amdocl_as64.exe
2014-09-15 22:18:02 1061902 ----a-w- C:\windows\System32\amdocl_ld64.exe
2014-09-15 22:18:00 98816 ----a-w- C:\windows\System32\OpenVideo64.dll
2014-09-15 22:17:58 83456 ----a-w- C:\windows\SysWow64\OpenVideo.dll
2014-09-15 22:17:56 86528 ----a-w- C:\windows\System32\OVDecode64.dll
2014-09-15 22:17:56 73216 ----a-w- C:\windows\SysWow64\OVDecode.dll
2014-09-15 22:17:54 33867264 ----a-w- C:\windows\System32\amdocl64.dll
2014-09-15 22:17:04 28770304 ----a-w- C:\windows\SysWow64\amdocl.dll
2014-09-15 22:16:18 65024 ----a-w- C:\windows\System32\OpenCL.dll
2014-09-15 22:16:18 58880 ----a-w- C:\windows\SysWow64\OpenCL.dll
2014-09-15 22:13:24 27918336 ----a-w- C:\windows\System32\atio6axx.dll
2014-09-15 22:09:38 48128 ----a-w- C:\windows\System32\amdmmcl6.dll
2014-09-15 22:09:36 37888 ----a-w- C:\windows\SysWow64\amdmmcl.dll
2014-09-15 22:09:10 127488 ----a-w- C:\windows\System32\mantle64.dll
2014-09-15 22:09:04 113664 ----a-w- C:\windows\SysWow64\mantle32.dll
2014-09-15 22:09:00 5639168 ----a-w- C:\windows\System32\amdmantle64.dll
2014-09-15 22:08:08 23375360 ----a-w- C:\windows\SysWow64\atioglxx.dll
2014-09-15 22:07:48 367104 ----a-w- C:\windows\System32\atiapfxx.exe
2014-09-15 22:07:46 62464 ----a-w- C:\windows\System32\aticalrt64.dll
2014-09-15 22:07:44 52224 ----a-w- C:\windows\SysWow64\aticalrt.dll
2014-09-15 22:07:42 55808 ----a-w- C:\windows\System32\aticalcl64.dll
2014-09-15 22:07:42 49152 ----a-w- C:\windows\SysWow64\aticalcl.dll
2014-09-15 22:07:36 15716352 ----a-w- C:\windows\System32\aticaldd64.dll
2014-09-15 22:06:46 14302208 ----a-w- C:\windows\SysWow64\aticaldd.dll
2014-09-15 22:05:52 4480000 ----a-w- C:\windows\SysWow64\amdmantle32.dll
2014-09-15 22:03:28 442368 ----a-w- C:\windows\System32\atidemgy.dll
2014-09-15 22:03:26 31232 ----a-w- C:\windows\System32\atimuixx.dll
2014-09-15 22:03:24 619008 ----a-w- C:\windows\System32\atieclxx.exe
2014-09-15 22:03:18 239616 ----a-w- C:\windows\System32\atiesrxx.exe
2014-09-15 22:03:12 91648 ----a-w- C:\windows\System32\mantleaxl64.dll
2014-09-15 22:03:08 85504 ----a-w- C:\windows\SysWow64\mantleaxl32.dll
2014-09-15 22:03:04 190976 ----a-w- C:\windows\System32\atitmm64.dll
2014-09-15 21:59:40 827392 ----a-w- C:\windows\System32\coinst_14.30.dll
2014-09-15 21:59:20 1210880 ----a-w- C:\windows\System32\atiadlxx.dll
2014-09-15 21:59:16 900608 ----a-w- C:\windows\SysWow64\atiadlxy.dll
2014-09-15 21:59:14 75264 ----a-w- C:\windows\System32\atig6pxx.dll
2014-09-15 21:59:12 69632 ----a-w- C:\windows\SysWow64\atiglpxx.dll
2014-09-15 21:59:12 69632 ----a-w- C:\windows\System32\atiglpxx.dll
2014-09-15 21:59:12 146944 ----a-w- C:\windows\System32\atig6txx.dll
2014-09-15 21:59:08 133632 ----a-w- C:\windows\SysWow64\atigktxx.dll
2014-09-15 21:59:06 576000 ----a-w- C:\windows\System32\drivers\atikmpag.sys
2014-09-15 21:58:54 43520 ----a-w- C:\windows\System32\drivers\ati2erec.dll
2014-09-10 20:20:54 98216 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-09-09 22:11:04 2048 ----a-w- C:\windows\System32\tzres.dll
2014-09-09 21:47:10 2048 ----a-w- C:\windows\SysWow64\tzres.dll
2014-09-04 05:23:20 424448 ----a-w- C:\windows\System32\rastls.dll
2014-09-04 05:04:15 372736 ----a-w- C:\windows\SysWow64\rastls.dll
2014-08-23 20:30:34 71344 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-08-23 20:30:34 699568 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2014-08-23 02:07:00 404480 ----a-w- C:\windows\System32\gdi32.dll
2014-08-23 01:45:55 311808 ----a-w- C:\windows\SysWow64\gdi32.dll
2014-08-19 03:11:28 693176 ----a-w- C:\windows\System32\winload.efi
2014-08-19 03:10:10 616352 ----a-w- C:\windows\System32\winresume.efi
2014-08-19 03:08:04 503808 ----a-w- C:\windows\System32\srcore.dll
2014-08-19 03:08:04 50176 ----a-w- C:\windows\System32\srclient.dll
.
============= FINISH: 16:55:01.89 ===============

 

 

 

 

 

 

 



BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,600 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:22 PM

Posted 14 November 2014 - 07:50 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/555433 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 NineVision

NineVision
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:04:22 PM

Posted 16 November 2014 - 05:02 PM

I still need help and I haven't touched my computer since I posted this problem

#4 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 17 November 2014 - 11:24 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

--RogueKiller--
  • Download & SAVE to your Desktop For 32bit system or For 64bit system
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller+
=======


Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.
To attach a file select the "More Reply Option" and follow the instructions.

Wait for further instructions.

#5 NineVision

NineVision
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:04:22 PM

Posted 17 November 2014 - 12:22 PM

Hello,

 

 

Thank You for helping me in this matter. Please check below.

 

RogueKiller V10.0.6.0 (x64) [Nov 13 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Daehan1 [Administrator]
Mode : Delete -- Date : 11/17/2014  11:57:22

¤¤¤ Processes : 35 ¤¤¤
[Proc.Injected] DPAgent.exe -- c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[7] -> Killed [TermProc]
[Proc.Injected] explorer.exe -- C:\windows\Explorer.EXE[7] -> Killed [TermProc]
[Proc.Injected] WLTRAY.EXE -- C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE[-] -> Killed [TermProc]
[Proc.Injected] EpePcMonitor.exe -- C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe[-] -> Killed [TermProc]
[Proc.Injected] sttray64.exe -- C:\Program Files\IDT\WDM\sttray64.exe[-] -> Killed [TermProc]
[Proc.Injected] SynTPEnh.exe -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[7] -> Killed [TermProc]
[Proc.Injected] LightScribeControlPanel.exe -- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[-] -> Killed [TermProc]
[Proc.Injected] googledrivesync.exe -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe[7] -> Killed [TermProc]
[Proc.Injected] googledrivesync.exe -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe[7] -> Killed [TermProc]
[Proc.Injected] regsvr32.exe -- C:\Windows\SysWOW64\regsvr32.exe[7] -> Killed [TermProc]
[Proc.Injected] regsvr32.exe -- C:\Windows\System32\regsvr32.exe[7] -> Killed [TermProc]
[Proc.Injected] GoogleUpdate.exe -- C:\Users\Daehan1\AppData\Roaming\FrameworkUpdate7\GoogleUpdate.exe[-] -> Killed [TermProc]
[Proc.Injected] regsvr32.exe -- C:\windows\SysWOW64\regsvr32.exe[7] -> Killed [TermProc]
[Proc.Injected] BTTray.exe -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[7] -> Killed [TermProc]
[Proc.Injected] DpAgent.exe -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[7] -> Killed [TermProc]
[Proc.Injected] coreshredder.exe -- C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe[-] -> Killed [TermProc]
[Proc.Injected] Rainmeter.exe -- C:\Program Files\Rainmeter\Rainmeter.exe[7] -> Killed [TermProc]
[Proc.Injected] IAStorIcon.exe -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe[7] -> Killed [TermProc]
[Proc.Injected] nusb3mon.exe -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[7] -> Killed [TermProc]
[Proc.Injected] hpqwutils.exe -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe[-] -> Killed [TermProc]
[Proc.Injected] QLBController.exe -- C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe[7] -> Killed [TermProc]
[Proc.Injected] RIMBBLaunchAgent.exe -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[7] -> Killed [TermProc]
[Suspicious.Path] msiexec.exe -- C:\Users\Daehan1\AppData\Local\YvltPack\msiexec.exe[-] -> Killed [TermProc]
[Proc.Injected] rundll32.exe -- C:\windows\SysWOW64\RunDll32.exe[7] -> Killed [TermProc]
[Proc.Injected] jusched.exe -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[7] -> Killed [TermProc]
[Proc.Injected] BTStackServer.exe -- C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[7] -> Killed [TermProc]
[Proc.Injected] MOM.exe -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[-] -> Killed [TermProc]
[Tr.Poweliks] dllhost.exe -- C:\windows\syswow64\dllhost.exe[7] -> Killed [TermProc]
[Proc.Injected] PSDrt.exe -- c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe[7] -> Killed [TermProc]
[Proc.Injected] BluetoothHeadsetProxy.exe -- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[7] -> Killed [TermProc]
[Proc.Injected] HPPA_Main.exe -- C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe[-] -> Killed [TermProc]
[Proc.Injected] SDKCOMServer.exe -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe[7] -> Killed [TermProc]
[Proc.Injected] HPConnectionManager.exe -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe[-] -> Killed [TermProc]
[Proc.Injected] iexplore.exe -- C:\Program Files\Internet Explorer\iexplore.exe[7] -> Killed [TermProc]
[Proc.Injected] iexplore.exe -- C:\Program Files\Internet Explorer\iexplore.exe[7] -> Killed [TermProc]

¤¤¤ Registry : 35 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YimjUjhuj : regsvr32.exe "C:\ProgramData\YimjUjhuj\YimjUjhuj.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | CikeBfas : regsvr32.exe "C:\ProgramData\CikeBfas\CikeBfas.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | AexoFkoj : regsvr32.exe "C:\ProgramData\AexoFkoj\AexoFkoj.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | UudkEgkos : regsvr32.exe "C:\ProgramData\UudkEgkos\UudkEgkos.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YpqPack : C:\Windows\SysWOW64\regsvr32.exe C:\Users\Daehan1\AppData\Local\YvltPack\UrchinUISlice.dll [x] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | PayiNzit : regsvr32.exe "C:\ProgramData\PayiNzit\PayiNzit.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | KuhwoBgodi : regsvr32.exe "C:\ProgramData\KuhwoBgodi\KuhwoBgodi.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | PefiKamof : regsvr32.exe "C:\ProgramData\PefiKamof\PefiKamof.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | DivojHuxub : regsvr32.exe "C:\ProgramData\DivojHuxub\DivojHuxub.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | AicoCtohq : regsvr32.exe "C:\ProgramData\AicoCtohq\AicoCtohq.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | IocaWajdi : regsvr32.exe "C:\ProgramData\IocaWajdi\IocaWajdi.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YumuMpud : regsvr32.exe "C:\ProgramData\YumuMpud\YumuMpud.dat" [7][-] -> Deleted
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | QizmOkow : regsvr32.exe "C:\ProgramData\QizmOkow\QizmOkow.dat" [7][-] -> Deleted
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YimjUjhuj : regsvr32.exe "C:\ProgramData\YimjUjhuj\YimjUjhuj.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | CikeBfas : regsvr32.exe "C:\ProgramData\CikeBfas\CikeBfas.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | AexoFkoj : regsvr32.exe "C:\ProgramData\AexoFkoj\AexoFkoj.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | UudkEgkos : regsvr32.exe "C:\ProgramData\UudkEgkos\UudkEgkos.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YpqPack : C:\Windows\SysWOW64\regsvr32.exe C:\Users\Daehan1\AppData\Local\YvltPack\UrchinUISlice.dll  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | PayiNzit : regsvr32.exe "C:\ProgramData\PayiNzit\PayiNzit.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | KuhwoBgodi : regsvr32.exe "C:\ProgramData\KuhwoBgodi\KuhwoBgodi.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | PefiKamof : regsvr32.exe "C:\ProgramData\PefiKamof\PefiKamof.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | DivojHuxub : regsvr32.exe "C:\ProgramData\DivojHuxub\DivojHuxub.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | AicoCtohq : regsvr32.exe "C:\ProgramData\AicoCtohq\AicoCtohq.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | IocaWajdi : regsvr32.exe "C:\ProgramData\IocaWajdi\IocaWajdi.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | YumuMpud : regsvr32.exe "C:\ProgramData\YumuMpud\YumuMpud.dat"  -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Run | QizmOkow : regsvr32.exe "C:\ProgramData\QizmOkow\QizmOkow.dat"  -> ERROR [2]
[PUM.SearchPage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : http://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}  -> Not selected
[PUM.SearchPage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : http://search.dosearches.com/web/?utm_source=b&utm_medium=ild&utm_campaign=rg&utm_content=ds&from=ild&uid=HitachiXHTS727550A9E364_J3320082G91R2AG91R2AX&ts=1383707984&type=default&q={searchTerms}  -> Not selected
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> Not selected
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Not selected
[Tr.Poweliks] (X64) HKEY_USERS\S-1-5-21-1786351023-3499971516-826020898-1001\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Deleted

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 1 ¤¤¤
[C:\windows\System32\drivers\etc\hosts]         172.16.112.231  dwp

¤¤¤ Antirootkit : 1 (Driver: Loaded) ¤¤¤
[Filter(Kernel.Filter)] \Driver\Disk @ Unknown : \Driver\MfeEpeOpal @ Unknown (\SystemRoot\system32\drivers\mfewfpk.sys)

¤¤¤ Web browsers : 3 ¤¤¤
[FIREFX:Addon] w4l83hoq.default : DigitalPersona Extension [[email protected]<script type="text/javascript"> /* */ </script>] -> Deleted
[FIREFX:Addon] w4l83hoq.default : McAfee ScriptScan for Firefox [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] -> Deleted
[FIREFX:Addon] w4l83hoq.default : VolumeSelect Class [{56597AFD-8A95-FDAF-B7DF-0726E127E574}] -> Deleted

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
--- User ---
[MBR] 1baad46bb63091dfc4ad0979d749756b
[BSP] 270e5d797478a887184f50094096aa5e : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 300 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 616448 | Size: 456210 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 934934528 | Size: 15306 MB
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 966281216 | Size: 5115 MB
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_SCN_11172014_115509.log

 

 

 

# AdwCleaner v4.101 - Report created 17/11/2014 at 12:10:04
# Updated 09/11/2014 by Xplode
# Database : 2014-11-07.1 [Local]
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Daehan1 - DAEHAN1-HP
# Running from : C:\Users\Daehan1\Desktop\adwcleaner_4.101.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled Tasks ] *****

Task Deleted : driverupdate startup

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Shortcut Disinfected : C:\Users\Daehan1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00100000-2001-0051-B4B6-006094B9D64F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00100000-2001-0054-B4B6-006094B9D64F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00100000-2001-0057-B4B6-006094B9D64F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B90F32AD-859E-4EDD-BFAE-C9216849520C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C08AB035-3820-4FA7-9420-B0259A4DA2B8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DAADF07B-7D06-4AF4-B3CA-6144830077EC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}
Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKLM\SOFTWARE\dosearchessoftware
Key Deleted : HKLM\SOFTWARE\GamesBarSetup
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\chatango.com

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.17116

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Setting Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Setting Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v29.0.1 (en-US)

[w4l83hoq.default\prefs.js] - Line Deleted : user_pref("browser.search.defaultenginename", "dosearches");
[w4l83hoq.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "dosearches");

*************************

AdwCleaner[R0].txt - [7166 octets] - [17/11/2014 12:01:16]
AdwCleaner[S0].txt - [5241 octets] - [17/11/2014 12:10:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5301 octets] ##########

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-11-2014 03
Ran by Daehan1 (administrator) on DAEHAN1-HP on 17-11-2014 12:14:33
Running from C:\Users\Daehan1\Desktop
Loaded Profile: Daehan1 (Available profiles: Daehan1)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\BCMWLTRY.EXE
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXSPMGT.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXTCS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
() C:\Windows\System32\SCPwrSetSvr.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
() C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE
() C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPUsageTrack.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-26] (Hewlett-Packard Company)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe [7177728 2013-04-18] (Broadcom Corporation)
HKLM\...\Run: [MfeEpePcMonitor] => C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2012-02-08] ()
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-11-15] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-11-22] (Synaptics Incorporated)
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-10] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IFXSPMGT] => c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [333728 2012-06-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [337440 2013-06-25] (McAfee, Inc.)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [243560 2014-01-15] (McAfee, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...\MountPoints2: {0559f18a-3373-11e2-a7bd-402cf48ae7b9} - D:\TL_Bootstrap.exe
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...A8F59079A8D5}\localserver32:  <==== ATTENTION!
Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
InternetURL: C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> hxxp://paytordmbdekmizq.torsona.com/1vU7gfL

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKCU - DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20140507171224.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20140507171225.dll (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1663ed61-23eb-11d2-b92f-008048fdd814} http://172.16.112.231/scriptX/ScriptX.cab
DPF: HKLM-x32 {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: HKLM-x32 {4A85DBE0-BFB2-4119-8401-186A7C6EB653} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/mjss/MJSS.cab109791.cab
DPF: HKLM-x32 {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {E0FEE963-BB53-4215-81AD-B28C77384644} https://pattcw.att.motive.com/wizlet/DSLActivation/static/installer/ATTInternetInstaller64.cab
DPF: HKLM-x32 {EF3AFB74-6F3C-491F-8FF2-FBEC88ADEBE5} http://www.kiwidisk.com/app/KiwidiskCtrl.CAB
Handler-x32: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP AG, Walldorf)
Handler-x32: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files (x86)\sap\frontend\sapgui\saphtmlp.dll (SAP AG, Walldorf)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Daehan1\AppData\Roaming\Mozilla\Firefox\Profiles\w4l83hoq.default
FF Homepage: https://www.google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll (Oberon-Media )
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\dosearches.xml
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-03-06]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2014-05-07]
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-11] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-03] (Hewlett-Packard Company)
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [523680 2012-06-20] (Hewlett-Packard Company)
R2 IFXSpMgtSrv; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
R2 IFXTCS; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980320 2011-01-19] (Infineon Technologies AG)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2012-02-08] () [File not signed]
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [130080 2013-06-25] (McAfee, Inc.)
R2 McciCMService; C:\Program Files (x86)\Common Files\Motive\McciCMService.exe [319488 2010-04-30] (Alcatel-Lucent) [File not signed]
R2 McciCMService64; C:\Program Files\Common Files\Motive\McciCMService.exe [517632 2010-04-30] (Alcatel-Lucent) [File not signed]
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [242448 2014-05-07] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [208416 2014-01-15] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [185280 2014-05-07] (McAfee, Inc.)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 PersonalSecureDriveService; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe [203104 2011-01-20] (Infineon Technologies AG)
R2 SCPwrSetSvr; C:\windows\system32\SCPwrSetSvr.exe [90112 2013-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2012-11-15] (IDT, Inc.) [File not signed]
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2012-05-20] (Microsoft Corporation) [File not signed]
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [5862400 2013-04-18] (Broadcom Corporation) [File not signed]
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-02-27] (JMicron Technology Corp.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [180272 2014-05-07] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311600 2014-05-07] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [100808 2012-02-08] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158920 2012-02-08] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [782968 2014-05-07] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [107032 2014-05-07] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344176 2014-05-07] (McAfee, Inc.)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2010-01-26] (Infineon Technologies AG)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-11-17] ()
S3 SzCCID; C:\Windows\System32\DRIVERS\SzCCID.sys [43520 2013-04-25] (Generic)
S2 eamonm; system32\DRIVERS\eamonm.sys [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 12:14 - 2014-11-17 12:15 - 00023928 _____ () C:\Users\Daehan1\Desktop\FRST.txt
2014-11-17 12:14 - 2014-11-17 12:14 - 00000000 ____D () C:\FRST
2014-11-17 12:13 - 2014-11-17 12:13 - 00005433 _____ () C:\Users\Daehan1\Desktop\AdwCleaner[S0].txt
2014-11-17 12:01 - 2014-11-17 12:10 - 00000000 ____D () C:\AdwCleaner
2014-11-17 11:59 - 2014-11-17 11:59 - 00013431 _____ () C:\Users\Daehan1\Desktop\RKreport_DEL_11172014_115722.log
2014-11-17 11:46 - 2014-11-17 11:46 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\CrashDumps
2014-11-17 11:45 - 2014-11-17 11:45 - 00037624 _____ () C:\windows\system32\Drivers\TrueSight.sys
2014-11-17 11:45 - 2014-11-17 11:45 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-11-17 11:43 - 2014-11-17 11:43 - 02117120 _____ (Farbar) C:\Users\Daehan1\Desktop\FRST64.exe
2014-11-17 11:42 - 2014-11-17 11:42 - 02140160 _____ () C:\Users\Daehan1\Desktop\adwcleaner_4.101.exe
2014-11-17 11:41 - 2014-11-17 11:41 - 17535064 _____ () C:\Users\Daehan1\Desktop\RogueKillerX64.exe
2014-11-17 11:35 - 2014-11-17 11:35 - 00000000 ____D () C:\ProgramData\YumuMpud
2014-11-17 11:35 - 2014-11-17 11:35 - 00000000 ____D () C:\ProgramData\QizmOkow
2014-11-17 11:33 - 2014-11-17 11:33 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{F4709468-8079-401B-BEF1-1524EA8EB033}
2014-11-10 08:34 - 2014-11-10 08:34 - 00000000 ____D () C:\ProgramData\IocaWajdi
2014-11-10 08:34 - 2014-11-10 08:34 - 00000000 ____D () C:\ProgramData\AicoCtohq
2014-11-10 08:32 - 2014-11-10 08:32 - 00000000 ____D () C:\ProgramData\PefiKamof
2014-11-10 08:32 - 2014-11-10 08:32 - 00000000 ____D () C:\ProgramData\DivojHuxub
2014-11-10 07:22 - 2014-11-10 07:22 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{4323F6B7-7F62-4EDB-9ABC-90534500432F}
2014-11-09 20:55 - 2014-11-09 20:55 - 00000000 ____D () C:\ProgramData\PayiNzit
2014-11-09 20:55 - 2014-11-09 20:55 - 00000000 ____D () C:\ProgramData\KuhwoBgodi
2014-11-09 17:59 - 2014-11-09 17:59 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{1AD9BEA4-A7FE-49CE-99F6-AE5F998916DB}
2014-11-09 17:33 - 2014-11-09 18:37 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Igraoxek
2014-11-09 17:32 - 2014-11-17 12:00 - 00000810 _____ () C:\windows\Tasks\Security Center Update - 196672318.job
2014-11-09 17:32 - 2014-11-09 17:58 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Uqboed
2014-11-09 17:32 - 2014-11-09 17:32 - 00003822 _____ () C:\windows\System32\Tasks\Security Center Update - 196672318
2014-11-09 17:31 - 2014-11-17 11:46 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\Ilfsoft
2014-11-09 17:30 - 2014-11-17 11:49 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\YvltPack
2014-11-09 17:27 - 2014-11-09 17:27 - 00000000 ____D () C:\ProgramData\UudkEgkos
2014-11-09 17:27 - 2014-11-09 17:27 - 00000000 ____D () C:\ProgramData\AexoFkoj
2014-11-09 16:55 - 2014-11-09 16:57 - 00032964 _____ () C:\Users\Daehan1\Desktop\dds.txt
2014-11-09 16:55 - 2014-11-09 16:55 - 00015750 _____ () C:\Users\Daehan1\Desktop\attach.txt
2014-11-09 16:52 - 2014-11-09 16:52 - 00688992 ____R (Swearware) C:\Users\Daehan1\Desktop\dds.com
2014-11-09 16:41 - 2014-11-09 16:41 - 00000272 _____ () C:\Users\Daehan1\Downloads\DECRYPT_INSTRUCTION.URL
2014-11-09 16:41 - 2014-11-09 16:41 - 00000272 _____ () C:\Users\Daehan1\Documents\DECRYPT_INSTRUCTION.URL
2014-11-09 16:41 - 2014-11-09 16:41 - 00000272 _____ () C:\Users\Daehan1\Desktop\DECRYPT_INSTRUCTION.URL
2014-11-09 16:41 - 2014-11-09 16:41 - 00000272 _____ () C:\Users\Daehan1\DECRYPT_INSTRUCTION.URL
2014-11-09 16:41 - 2014-11-09 16:41 - 00000272 _____ () C:\DECRYPT_INSTRUCTION.URL
2014-11-09 16:19 - 2014-11-09 16:19 - 00000272 _____ () C:\Users\Daehan1\AppData\Roaming\DECRYPT_INSTRUCTION.URL
2014-11-09 16:19 - 2014-11-09 16:19 - 00000272 _____ () C:\Users\Daehan1\AppData\DECRYPT_INSTRUCTION.URL
2014-11-09 16:18 - 2014-11-09 16:18 - 00000272 _____ () C:\Users\Daehan1\AppData\Local\DECRYPT_INSTRUCTION.URL
2014-11-09 15:58 - 2014-11-09 15:58 - 00000000 ____D () C:\ProgramData\CikeBfas
2014-11-09 15:57 - 2014-11-09 15:57 - 00000000 ____D () C:\ProgramData\YimjUjhuj
2014-11-09 15:56 - 2014-11-09 15:56 - 00000272 _____ () C:\ProgramData\DECRYPT_INSTRUCTION.URL
2014-11-09 15:55 - 2014-11-17 11:33 - 00000408 _____ () C:\ProgramData\@system.temp
2014-11-09 15:55 - 2014-11-17 11:33 - 00000144 ____H () C:\ProgramData\@system3.att
2014-11-09 15:55 - 2014-11-09 15:55 - 00000448 ____H () C:\Users\Daehan1\AppData\Roaming\麽鎒駓覜
2014-11-09 15:54 - 2014-11-09 15:54 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\FrameworkUpdate7
2014-11-09 15:52 - 2014-11-17 11:35 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-11-09 15:45 - 2014-11-09 15:45 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{4F93D38E-EEBF-41CF-B9FA-0B39498F6C6D}
2014-11-08 12:32 - 2014-11-08 12:32 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{6784184F-3FDF-47E2-8754-39C4DD07B639}
2014-11-07 13:22 - 2014-11-10 08:23 - 00000000 ____D () C:\Users\Daehan1\Desktop\UMA
2014-11-06 21:30 - 2014-11-07 19:48 - 00046864 _____ () C:\Users\Daehan1\Desktop\Workinprogress.xlsx
2014-11-06 08:12 - 2014-11-06 08:12 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{5DE1970B-B148-4152-9AAF-D5C099B08E30}
2014-11-04 08:03 - 2014-11-04 08:03 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{C49D7C19-009D-492C-8AD3-2F6767C75D86}
2014-11-03 13:11 - 2014-11-03 13:11 - 00594992 _____ () C:\Users\Daehan1\Desktop\20141103.xls
2014-10-31 08:00 - 2014-10-31 08:00 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{FF940738-8C9D-4FF5-949E-EE0B080536D4}
2014-10-30 12:21 - 2014-11-07 12:50 - 01694592 _____ () C:\Users\Daehan1\Desktop\UMA Raw material status_20141025.xlsx
2014-10-30 07:06 - 2014-10-30 07:06 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{6A72FC7F-26DB-4413-BD4B-9A34D397137B}
2014-10-29 10:22 - 2014-10-29 10:22 - 02257792 _____ () C:\Users\Daehan1\Desktop\20141028.xls
2014-10-29 10:22 - 2014-10-29 10:22 - 01638048 _____ () C:\Users\Daehan1\Desktop\20141027.xls
2014-10-29 10:21 - 2014-10-29 10:21 - 02245392 _____ () C:\Users\Daehan1\Desktop\20141022.xls
2014-10-29 10:21 - 2014-10-29 10:21 - 02243824 _____ () C:\Users\Daehan1\Desktop\20141023.xls
2014-10-29 06:50 - 2014-10-29 06:50 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{E0542BD6-8E07-49B3-B5D6-329B6CA58AE6}
2014-10-28 07:09 - 2014-10-28 07:09 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{9C9977F5-DA00-423C-A131-8AA25493D142}
2014-10-27 16:19 - 2014-10-27 16:19 - 00011536 _____ () C:\Users\Daehan1\Desktop\UMA 재고 현황 20141027.xlsx
2014-10-27 06:54 - 2014-10-27 06:54 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{4161004E-82AC-440C-8CA5-699C05C28E45}
2014-10-25 06:05 - 2014-10-25 06:05 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{8D68863A-500B-4C04-AF11-B5231A09C4D3}
2014-10-24 07:09 - 2014-10-24 07:09 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{8011F154-DAB8-4E22-9FC9-3293A13D1567}
2014-10-23 11:52 - 2014-10-23 11:52 - 00050080 _____ () C:\Users\Daehan1\Desktop\Production Daily Plan 10.23..xlsx
2014-10-23 08:27 - 2014-10-23 08:27 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{7FD31051-F6CC-4FEF-AA23-623F1A1AA110}
2014-10-21 21:29 - 2014-10-21 21:29 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{B3CAFB18-2F6F-4FB7-AF06-5A77554BE5D7}
2014-10-21 09:52 - 2014-10-21 09:53 - 00014960 _____ () C:\Users\Daehan1\Desktop\Absentees 10.21..xlsx
2014-10-21 06:46 - 2014-10-21 06:46 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{3ED731C9-36AD-4688-985F-4649A6C865B6}
2014-10-20 06:37 - 2014-10-20 06:37 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\{51C6517C-D158-4876-BC29-27E398A1D586}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-17 12:13 - 2012-03-28 22:39 - 00000000 ____D () C:\Users\Daehan1\Tracing
2014-11-17 12:12 - 2012-10-20 02:15 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-17 12:12 - 2011-03-06 17:20 - 00000000 ____D () C:\ProgramData\PDFC
2014-11-17 12:12 - 2011-03-06 17:16 - 00000000 ____D () C:\ProgramData\HPQLOG
2014-11-17 12:11 - 2012-02-26 07:01 - 00263332 _____ () C:\windows\PFRO.log
2014-11-17 12:11 - 2009-07-14 00:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-17 12:11 - 2009-07-13 23:51 - 00131789 _____ () C:\windows\setupact.log
2014-11-17 12:10 - 2012-02-26 06:21 - 01954468 _____ () C:\windows\WindowsUpdate.log
2014-11-17 12:03 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\system32\NDF
2014-11-17 11:49 - 2014-05-12 10:21 - 00000000 ____D () C:\QUARANTINE
2014-11-17 11:42 - 2012-03-28 13:38 - 00003942 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{5E3E9158-35D3-43FE-96C7-297D20B969A0}
2014-11-17 11:39 - 2009-07-13 23:45 - 00025648 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-17 11:39 - 2009-07-13 23:45 - 00025648 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-17 11:38 - 2009-07-14 00:13 - 00782470 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-17 11:33 - 2012-10-20 02:15 - 00000000 ___RD () C:\Users\Daehan1\Google Drive
2014-11-17 11:32 - 2013-08-02 15:02 - 00016152 _____ () C:\windows\system32\Drivers\SWDUMon.sys
2014-11-10 08:22 - 2012-10-20 02:15 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-10 07:51 - 2013-04-03 03:34 - 00000000 ____D () C:\Users\Daehan1\Desktop\Production Plan
2014-11-09 16:41 - 2013-06-19 11:26 - 00000000 ____D () C:\Users\Daehan1\Documents\Outlook Files
2014-11-09 16:41 - 2012-05-21 11:33 - 00000000 ____D () C:\Users\Daehan1\Documents\Rainmeter
2014-11-09 16:41 - 2012-05-19 06:44 - 00000000 ____D () C:\Users\Daehan1\Desktop\아토피
2014-11-09 16:41 - 2012-05-15 23:57 - 00000000 ____D () C:\Users\Daehan1\Documents\My Received Files
2014-11-09 16:41 - 2012-04-20 06:24 - 00000000 ____D () C:\Users\Daehan1\SapWorkDir
2014-11-09 16:41 - 2012-03-28 13:23 - 00000000 ____D () C:\Users\Daehan1
2014-11-09 16:37 - 2014-08-08 14:55 - 00000000 ____D () C:\Users\Daehan1\Desktop\UMA ISO PAD TRIAL
2014-11-09 16:37 - 2013-08-15 11:29 - 00000000 ____D () C:\Users\Daehan1\Desktop\TS1694
2014-11-09 16:36 - 2013-08-16 13:57 - 00000000 ____D () C:\Users\Daehan1\Desktop\Schedule
2014-11-09 16:36 - 2012-05-20 04:41 - 00000000 ____D () C:\Users\Daehan1\Desktop\stuff
2014-11-09 16:36 - 2012-05-20 04:40 - 00000000 ____D () C:\Users\Daehan1\Desktop\Theme Tools
2014-11-09 16:32 - 2014-08-07 15:13 - 00000000 ____D () C:\Users\Daehan1\Desktop\Production Audit
2014-11-09 16:31 - 2013-10-28 14:38 - 00000000 ____D () C:\Users\Daehan1\Desktop\LABEL-Floor
2014-11-09 16:31 - 2013-09-06 15:05 - 00000000 ____D () C:\Users\Daehan1\Desktop\JK(HOT PRESS & TURN TABLE)
2014-11-09 16:31 - 2012-04-28 18:53 - 00000000 ____D () C:\Users\Daehan1\Desktop\James
2014-11-09 16:30 - 2014-05-04 10:39 - 00000000 ____D () C:\Users\Daehan1\Desktop\Desktop5042014
2014-11-09 16:19 - 2014-05-09 16:36 - 00000000 ____D () C:\Users\Daehan1\Desktop\Camera
2014-11-09 16:19 - 2013-03-02 13:30 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Research In Motion
2014-11-09 16:19 - 2012-10-06 02:49 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Mozilla
2014-11-09 16:19 - 2012-05-21 11:33 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Rainmeter
2014-11-09 16:19 - 2012-04-15 02:01 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Skype
2014-11-09 16:18 - 2014-05-07 16:13 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\McAfee
2014-11-09 16:18 - 2014-02-28 08:58 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\Skype
2014-11-09 16:18 - 2013-08-02 15:01 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\SlimWare Utilities Inc
2014-11-09 16:18 - 2013-03-02 12:36 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\Research In Motion
2014-11-09 16:18 - 2012-12-02 05:05 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\Oberon Media
2014-11-09 16:18 - 2012-10-06 02:49 - 00000000 ____D () C:\Users\Daehan1\AppData\Local\Mozilla
2014-11-09 16:18 - 2012-03-28 13:38 - 00000000 ____D () C:\Users\Daehan1\AppData\Roaming\Adobe
2014-11-09 16:04 - 2009-07-14 00:08 - 00032572 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-11-09 15:56 - 2013-02-28 18:05 - 00000000 ____D () C:\ProgramData\Motive
2014-11-09 15:56 - 2012-07-09 09:34 - 00000000 ____D () C:\ProgramData\McAfee
2014-11-09 15:56 - 2011-03-06 17:28 - 00000000 ____D () C:\ProgramData\Sonic
2014-11-09 15:56 - 2011-03-06 16:44 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-11-07 09:46 - 2012-04-05 20:39 - 00003198 _____ () C:\windows\System32\Tasks\HPCeeScheduleForDaehan1
2014-11-07 09:46 - 2012-04-05 20:39 - 00000340 _____ () C:\windows\Tasks\HPCeeScheduleForDaehan1.job
2014-11-05 19:45 - 2013-04-23 12:41 - 00122144 _____ () C:\Users\Daehan1\Desktop\Hiring Request Form (직원 채용및 배치서).xls
2014-11-05 13:55 - 2012-03-28 13:34 - 00003222 _____ () C:\windows\System32\Tasks\HPCeeScheduleForDAEHAN1-HP$
2014-11-05 13:55 - 2012-03-28 13:34 - 00000346 _____ () C:\windows\Tasks\HPCeeScheduleForDAEHAN1-HP$.job
2014-11-03 13:25 - 2012-10-20 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-11-03 11:21 - 2014-08-12 11:35 - 00070608 _____ () C:\Users\Daehan1\Desktop\Trial Build Material Tag.xlsx
2014-10-28 05:34 - 2012-03-28 13:58 - 00275080 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-10-21 21:30 - 2014-09-25 06:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-21 21:30 - 2012-04-15 02:01 - 00000000 ____D () C:\ProgramData\Skype
2014-10-20 12:17 - 2012-10-20 02:15 - 00003894 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-20 12:17 - 2012-10-20 02:15 - 00003642 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

Some content of TEMP:
====================
C:\Users\Daehan1\AppData\Local\Temp\AtpTimerInfo.dll
C:\Users\Daehan1\AppData\Local\Temp\BNKI7PLYKK.exe
C:\Users\Daehan1\AppData\Local\Temp\conhost.exe
C:\Users\Daehan1\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Daehan1\AppData\Local\Temp\Extract.exe
C:\Users\Daehan1\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Daehan1\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Daehan1\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Daehan1\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Daehan1\AppData\Local\Temp\mvy.dll
C:\Users\Daehan1\AppData\Local\Temp\nsisos.dll
C:\Users\Daehan1\AppData\Local\Temp\Quarantine.exe
C:\Users\Daehan1\AppData\Local\Temp\Resource.exe
C:\Users\Daehan1\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Daehan1\AppData\Local\Temp\SP52437.exe
C:\Users\Daehan1\AppData\Local\Temp\SP52637.exe
C:\Users\Daehan1\AppData\Local\Temp\SP53380.exe
C:\Users\Daehan1\AppData\Local\Temp\SP53796.exe
C:\Users\Daehan1\AppData\Local\Temp\SP54614.exe
C:\Users\Daehan1\AppData\Local\Temp\sp54620.exe
C:\Users\Daehan1\AppData\Local\Temp\SP54714.exe
C:\Users\Daehan1\AppData\Local\Temp\SP56247.exe
C:\Users\Daehan1\AppData\Local\Temp\SP56290.exe
C:\Users\Daehan1\AppData\Local\Temp\SP56729.exe
C:\Users\Daehan1\AppData\Local\Temp\SP56876.exe
C:\Users\Daehan1\AppData\Local\Temp\SP56878.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57014.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57086.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57275.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57555.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57698.exe
C:\Users\Daehan1\AppData\Local\Temp\SP57879.exe
C:\Users\Daehan1\AppData\Local\Temp\SP58182.exe
C:\Users\Daehan1\AppData\Local\Temp\sp58915.exe
C:\Users\Daehan1\AppData\Local\Temp\SP59033.exe
C:\Users\Daehan1\AppData\Local\Temp\SP59043.exe
C:\Users\Daehan1\AppData\Local\Temp\SP59202.exe
C:\Users\Daehan1\AppData\Local\Temp\SP59291.exe
C:\Users\Daehan1\AppData\Local\Temp\SP59339.exe
C:\Users\Daehan1\AppData\Local\Temp\SP60365.exe
C:\Users\Daehan1\AppData\Local\Temp\SP60504.exe
C:\Users\Daehan1\AppData\Local\Temp\SP60686.exe
C:\Users\Daehan1\AppData\Local\Temp\SP60775.exe
C:\Users\Daehan1\AppData\Local\Temp\SP61138.exe
C:\Users\Daehan1\AppData\Local\Temp\SP62449.exe
C:\Users\Daehan1\AppData\Local\Temp\SP62738.exe
C:\Users\Daehan1\AppData\Local\Temp\SP63779.exe
C:\Users\Daehan1\AppData\Local\Temp\sp64126.exe
C:\Users\Daehan1\AppData\Local\Temp\spsdchgn.exe
C:\Users\Daehan1\AppData\Local\Temp\sqlite3.dll
C:\Users\Daehan1\AppData\Local\Temp\temp1475767232.exe
C:\Users\Daehan1\AppData\Local\Temp\temp3117296248.exe
C:\Users\Daehan1\AppData\Local\Temp\temp854460441.exe
C:\Users\Daehan1\AppData\Local\Temp\tuvwpona.exe
C:\Users\Daehan1\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Daehan1\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_1df814d7.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_4b5e66fc.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_4eea7061.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_59d67cf7.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_75c09995.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_d3c6ea42.exe
C:\Users\Daehan1\AppData\Local\Temp\UpdateFlashPlayer_d833b5ac.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-11-05 09:34

==================== End Of Log ============================

Attached Files



#6 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 17 November 2014 - 01:40 PM

Run this tool to clean your Temporary files/Folders.

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program.
  • TFC will close all open programs itself in order to run.
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted, it should not take long to finish.
  • Once it's finished, click OK to reboot.
  • If it does not reboot, reboot your system manually.

  • ===

    Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
    start
    
    HKLM-x32\...\Run: [] => [X]
    Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
    HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...A8F59079A8D5}\localserver32:  <==== ATTENTION!
    InternetURL: C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> hxxp://paytordmbdekmizq.torsona.com/1vU7gfL
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
    U3 mfeavfk01; No ImagePath
    S2 eamonm; system32\DRIVERS\eamonm.sys [X]
    S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
    S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
    S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
    S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
    Task: {892FA7EC-129A-4DEC-B5A9-720DE05A7876} - System32\Tasks\Security Center Update - 196672318 => C:\Users\Daehan1\AppData\Roaming\Uqboed\wamiwu.exe <==== ATTENTION
    Task: C:\windows\Tasks\Security Center Update - 196672318.job => C:\Users\Daehan1\AppData\Roaming\Uqboed\wamiwu.exe <==== ATTENTION
    AlternateDataStreams: C:\ProgramData\TEMP:AA4982C6
    
    End
    
    Save the files as fixlist.txt into the same folder as FRST

    Run FRST and click Fix only once and wait.

    Restart the computer normally to reset the registry.

    The tool will create a log Fixlog.txt please post it to your reply.
    ===

    Download Security Check by screen317 from here.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    p.s.
    If the SecurityCheck program fails to run for any reason, run it as an Administrator.

    If the site is busy or not available use this mirror site:
    http://www.bleepingcomputer.com/download/securitycheck/

    How is the computer running now?


#7 NineVision

NineVision
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:04:22 PM

Posted 17 November 2014 - 02:33 PM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-11-2014 03
Ran by Daehan1 at 2014-11-17 14:16:31 Run:1
Running from C:\Users\Daehan1\Desktop
Loaded Profile: Daehan1 (Available profiles: Daehan1)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start

HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-1786351023-3499971516-826020898-1001\...A8F59079A8D5}\localserver32:  <==== ATTENTION!
InternetURL: C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL -> hxxp://paytordmbdekmizq.torsona.com/1vU7gfL
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
U3 mfeavfk01; No ImagePath
S2 eamonm; system32\DRIVERS\eamonm.sys [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
Task: {892FA7EC-129A-4DEC-B5A9-720DE05A7876} - System32\Tasks\Security Center Update - 196672318 => C:\Users\Daehan1\AppData\Roaming\Uqboed\wamiwu.exe <==== ATTENTION
Task: C:\windows\Tasks\Security Center Update - 196672318.job => C:\Users\Daehan1\AppData\Roaming\Uqboed\wamiwu.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:AA4982C6

End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP" => Key deleted successfully.
"HKU\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key not found.
"HKU\S-1-5-21-1786351023-3499971516-826020898-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.
C:\Users\Daehan1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_INSTRUCTION.URL => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
HP Support Assistant Service => Service deleted successfully.
mfeavfk01 => Service deleted successfully.
eamonm => Service deleted successfully.
MREMP50a64 => Service deleted successfully.
MREMPR5 => Service deleted successfully.
MRENDIS5 => Service deleted successfully.
MRESP50a64 => Service deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{892FA7EC-129A-4DEC-B5A9-720DE05A7876}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{892FA7EC-129A-4DEC-B5A9-720DE05A7876}" => Key deleted successfully.
C:\Windows\System32\Tasks\Security Center Update - 196672318 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 196672318" => Key deleted successfully.
C:\windows\Tasks\Security Center Update - 196672318.job => Moved successfully.
C:\ProgramData\TEMP => ":AA4982C6" ADS removed successfully.

==== End of Fixlog ====

 

 

 

 

 

 

 Results of screen317's Security Check version 0.99.90 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
 Windows Firewall Enabled! 
McAfee VirusScan Enterprise  
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 67 
 Java version out of Date!
  Adobe Flash Player 13.0.0.214 Flash Player out of Date! 
 Mozilla Firefox 29.0.1 Firefox out of Date! 
````````Process Check: objlist.exe by Laurent```````` 
 McAfee VirusScan Enterprise VsTskMgr.exe 
 McAfee VirusScan Enterprise mfeann.exe 
 McAfee VirusScan Enterprise SHSTAT.EXE 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

 

 

 

 

Well it seems better. Alot better than before actually, I no longer get those random windows opening on chrome to random websites

 

The security keep resetting so that I can't download anything seems to be fixed.

 

Doesn't seem like it's running too hot or taking up all my CPU etc...

 

Concern through, what do i do with this decryption key crap i have all over the place?
 



#8 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 18 November 2014 - 09:37 AM

If you are talking about these you can delete them.

C:\Users\Daehan1\Downloads\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\Documents\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\Desktop\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\DECRYPT_INSTRUCTION.URL
C:\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\AppData\Roaming\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\AppData\DECRYPT_INSTRUCTION.URL
C:\Users\Daehan1\AppData\Local\DECRYPT_INSTRUCTION.URL

p.s. There could be others.

===
Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.

You can manually check your present version and update as recommended.
https://www.java.com/en/download/installed.jsp

Be careful not to install malware posing as Java update!
Important read this blog.
http://blog.trendmicro.com/trendlabs-security-intelligence/malware-poses-as-an-update-for-java-0-day-fix/

Quoted from the page.
"In light of the recent events surrounding Java, users must seriously consider their use of Java. Do they really need it? If yes, make sure that users follow the steps we recommended and get the security update directly from the official oracle website." at:
http://www.oracle.com/technetwork/java/javase/downloads/index.html

How to disable Java in your browsers
http://www.infoworld.com/t/web-browsers/how-disable-java-in-your-browsers-210882

If present remove the old version(s) of Java using the Add/Remove Programs applet.

Java 7 Update 67

===

Critical vulnerabilities have been identified in old version of Adobe Flash Player please get the latest version.

Flash test site:
http://www.adobe.com/software/flash/about/
Install the new version or if you have the latest close the windows.

Flash Player Help / Find version
http://helpx.adobe.com/flash-player/kb/find-version-flash-player.html#main_Find_the_Flash_Player_version_installed_on_your_machine
===

If all is well.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

Edited by nasdaq, 18 November 2014 - 09:39 AM.


#9 NineVision

NineVision
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:04:22 PM

Posted 18 November 2014 - 09:56 AM

Hello,

 

I have also encountered where I can no longer log into skype. I use this for work sometimes and would need to use it. Tried, uninstall and a new install with the latest version. It just crashes everytime I try to log in. Not sure if it's doing that on other programs but this i use often along with office products. However I haven't had a problem with office products.

 

Also you told me to take out any USB attached to the computer when we started. I had a USB mouse and would like to use my mouse again... this okay?



#10 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 18 November 2014 - 10:42 AM

Also you told me to take out any USB attached to the computer when we started. I had a USB mouse and would like to use my mouse again... this okay?

Yes of course, I also use aUSB mouse and I just forget about it.

===

You may need to reset your Firewall settings to get Spyke to work.

https://support.skype.com/en/faq/FA10953/how-can-i-update-my-windows-firewall-settings-after-reinstalling-or-upgrading-skype

#11 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 24 November 2014 - 09:35 AM

Are you still with me?



#12 nasdaq

nasdaq

  • Malware Response Team
  • 38,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:22 PM

Posted 30 November 2014 - 10:10 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users