Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Exploit Fake Flash Player [Type 1747]


  • This topic is locked This topic is locked
10 replies to this topic

#1 Xscape

Xscape

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:44 AM

Posted 05 July 2015 - 03:17 AM

Hello.

I have 64-bit win7 ultimate OS.
I'm getting "Exploit Fake Flash Player [Type 1747]" pop-up every time I go to youtube website.

Symptoms started from last 5-6 days.
It blocked all the Google services.
My AVG Anti-virus pops up every time I use ay Google services.

So, I formatted my C drive and re-install the win7.
Now I'm getting AVG pop-up only when I try to use youtube website.
It's showing the error: Exploit Fake Flash Player [Type 1747]

Still I'm getting this pop-up or whatever it is called

 

Attached File  avg.png   14.61KB   0 downloads


AdwCleaner scan log is:-


# AdwCleaner v4.207 - Logfile created 02/07/2015 at 12:21:44
# Updated 21/06/2015 by Xplode
# Database : 2015-07-02.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : KinG - KING-PC
# Running from : C:\Users\KinG\Downloads\adwcleaner_4.207.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wtu-secure-search.xml

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKCU\Software\Avg Secure Update
Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update

***** [ Web browsers ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v38.0.5 (x86 en-US)


*************************

AdwCleaner[R0].txt - [753 bytes] - [01/07/2015 18:33:58]
AdwCleaner[R1].txt - [811 bytes] - [01/07/2015 18:57:10]
AdwCleaner[R2].txt - [1997 bytes] - [02/07/2015 12:21:00]
AdwCleaner[S0].txt - [874 bytes] - [01/07/2015 18:57:54]
AdwCleaner[S1].txt - [1895 bytes] - [02/07/2015 12:21:44]



########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1954 bytes] ##########




And My JRT Scan log is:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.6 (07.02.2015:1)
OS: Windows 7 Ultimate x64
Ran by KinG on 02-07-2015 at 11:18:42.60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully deleted: [Service] vToolbarUpdater18.4.0



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2863353252-3341005711-1125978481-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}



~~~ Files



~~~ Folders

Failed to delete: [Folder] C:\Program Files (x86)\avg web tuneup
Successfully deleted: [Folder] C:\ProgramData\avg security toolbar
Successfully deleted: [Folder] C:\ProgramData\avg web tuneup
Successfully deleted: [Folder] C:\Users\KinG\appdata\local\avg web tuneup
Successfully deleted: [Folder] C:\Users\KinG\appdata\locallow\avg web tuneup
Successfully deleted: [Folder] C:\Users\KinG\AppData\Roaming\tuneup software



~~~ FireFox






~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02-07-2015 at 11:24:26.60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


There are not many softwares installed on my pc as I formatted my C drive.
So please tell me..how to remove this virus?


Thank you.



BC AdBot (Login to Remove)

 


m

#2 Xscape

Xscape
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:44 AM

Posted 06 July 2015 - 06:23 AM

Someone help!!



#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 07 July 2015 - 08:25 AM


Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Download the version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
===

Wait for further instructions.

#4 Xscape

Xscape
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:44 AM

Posted 08 July 2015 - 04:34 AM

I did what you said. Check the attachment for Addition.txt log.

Here's the FRST.txt log

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-07-2015
Ran by KinG (administrator) on KING-PC on 08-07-2015 14:52:57
Running from C:\Users\KinG\Desktop\Farbar
Loaded Profiles: KinG (Available Profiles: KinG)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe
(Lavasoft Limited) C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_194.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_194.exe
(BitTorrent Inc.) C:\Users\KinG\AppData\Roaming\uTorrent\uTorrent.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe [9549808 2015-06-24] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-06-30] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-07-04] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\...\Run: [uTorrent] => C:\Users\KinG\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-07-03] (BitTorrent Inc.)
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1381648 2015-06-08] (Lavasoft)
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/en-in/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3632008019-2436663354-1690540117-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3632008019-2436663354-1690540117-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-07-04] (AVG)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Winsock: Catalog9 01 C:\Windows\SysWOW64\LavasoftTcpService.dll [348488 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9 02 C:\Windows\SysWOW64\LavasoftTcpService.dll [348488 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9 03 C:\Windows\SysWOW64\LavasoftTcpService.dll [348488 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9 04 C:\Windows\SysWOW64\LavasoftTcpService.dll [348488 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9 15 C:\Windows\SysWOW64\LavasoftTcpService.dll [348488 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [428880 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [428880 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [428880 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [428880 2015-07-04] (Lavasoft Limited)
Winsock: Catalog9-x64 15 C:\Windows\system32\LavasoftTcpService64.dll [428880 2015-07-04] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{FD2171D9-E337-4602-B549-09B7664C4078}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-07-03] ()
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-03] ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF SearchPlugin: C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default\searchplugins\avg-secure-search.xml [2015-07-04]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-07-04]
FF Extension: SaveFrom.net helper - C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default\Extensions\helper@savefrom.net.xpi [2015-07-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1528432 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-07-03] (SurfRight B.V.)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe [716664 2015-06-24] ()
R2 LavasoftTcpService; C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe [2751792 2015-06-08] (Lavasoft Limited)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 SearchProtectionService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [19816 2015-06-08] ()
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-07-04] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-07-04] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [67552 2015-04-14] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [281568 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [452040 2015-01-22] (BitDefender S.R.L.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-08 14:52 - 2015-07-08 14:53 - 00000000 ____D C:\FRST
2015-07-08 14:52 - 2015-07-08 14:52 - 00000000 ____D C:\Users\KinG\Desktop\Farbar
2015-07-05 16:36 - 2015-07-05 16:36 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2015-07-05 13:54 - 2015-07-08 14:51 - 00000000 ____D C:\Users\KinG\AppData\Roaming\vlc
2015-07-05 13:54 - 2015-07-05 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-07-05 13:38 - 2015-07-05 13:39 - 00380416 _____ C:\Users\KinG\Downloads\pu6dmhke.exe
2015-07-05 13:25 - 2015-04-07 12:41 - 06420600 _____ (Tim Kosse) C:\Users\KinG\Desktop\FileZilla_3.10.3_win64-setup.exe
2015-07-05 11:40 - 2015-07-05 11:40 - 00000000 ____D C:\Users\KinG\Documents\Hitman Blood Money
2015-07-05 11:39 - 2015-07-05 11:39 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-07-05 11:16 - 2015-07-05 11:16 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\27AA61AE.sys
2015-07-04 19:41 - 2015-07-04 19:42 - 00000000 ____D C:\Users\KinG\AppData\Local\Microsoft Games
2015-07-04 15:11 - 2015-07-04 16:09 - 00002848 _____ C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
2015-07-04 15:11 - 2015-07-04 16:09 - 00002848 _____ C:\Windows\system32\LavasoftTcpServiceOff.ini
2015-07-04 15:11 - 2015-07-04 15:11 - 00000000 ____D C:\Users\KinG\AppData\Roaming\LavasoftStatistics
2015-07-04 15:11 - 2015-07-04 15:11 - 00000000 ____D C:\Users\KinG\AppData\Local\Lavasoft
2015-07-04 15:11 - 2015-06-08 14:13 - 00428880 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll
2015-07-04 15:11 - 2015-06-08 14:13 - 00348488 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll
2015-07-04 15:09 - 2015-07-04 15:09 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2015-07-04 15:07 - 2015-07-04 16:13 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Lavasoft
2015-07-04 15:06 - 2015-07-08 11:29 - 00002321 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2015-07-04 15:06 - 2015-07-04 15:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-07-04 15:01 - 2015-07-04 15:01 - 00000000 ____D C:\Program Files\Lavasoft
2015-07-04 13:59 - 2015-07-04 13:59 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-07-04 13:58 - 2015-07-04 14:51 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-07-04 13:58 - 2015-07-04 14:11 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-07-04 13:58 - 2015-07-04 13:58 - 00001395 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-07-04 13:58 - 2015-07-04 13:58 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-07-04 13:58 - 2015-07-04 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-07-04 13:58 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-04 13:49 - 2015-07-04 13:49 - 00000000 ____D C:\Program Files\Common Files\Lavasoft
2015-07-04 13:45 - 2015-07-04 13:57 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\KinG\Downloads\spybot-2.4.exe
2015-07-04 13:44 - 2015-07-04 15:07 - 00000000 ____D C:\ProgramData\Lavasoft
2015-07-04 13:44 - 2015-07-04 13:44 - 02009904 _____ C:\Users\KinG\Downloads\Adaware_Installer.exe
2015-07-04 11:58 - 2015-07-04 15:58 - 00000000 ____D C:\Users\KinG\AppData\Local\AVG Web TuneUp
2015-07-04 11:58 - 2015-07-04 11:58 - 00000000 ____D C:\ProgramData\AVG Web TuneUp
2015-07-04 11:58 - 2015-07-04 11:58 - 00000000 ____D C:\ProgramData\AVG Security Toolbar
2015-07-04 11:58 - 2015-07-04 11:58 - 00000000 ____D C:\ProgramData\AVG Secure Search
2015-07-04 11:58 - 2015-07-04 11:58 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp
2015-07-03 18:40 - 2015-07-03 18:41 - 00788864 _____ C:\Users\KinG\Downloads\Setup-201507031310-[350].exe
2015-07-03 18:28 - 2015-07-03 18:28 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Macromedia
2015-07-03 18:28 - 2015-07-03 18:28 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Adobe
2015-07-03 18:28 - 2015-07-03 18:28 - 00000000 ____D C:\Users\KinG\AppData\Local\Macromedia
2015-07-03 18:27 - 2015-07-08 14:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-03 18:27 - 2015-07-03 18:27 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-03 18:27 - 2015-07-03 18:27 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-03 18:27 - 2015-07-03 18:27 - 00000000 ____D C:\Windows\system32\Macromed
2015-07-03 18:21 - 2015-07-03 18:27 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-03 18:21 - 2015-07-03 18:21 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2015-07-03 17:59 - 2015-07-04 11:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 17:59 - 2015-07-03 18:25 - 00000000 ____D C:\Users\KinG\AppData\Local\Mozilla
2015-07-03 17:59 - 2015-07-03 18:00 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Mozilla
2015-07-03 17:59 - 2015-07-03 17:59 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-03 17:59 - 2015-07-03 17:59 - 00000000 ____D C:\ProgramData\Mozilla
2015-07-03 17:59 - 2015-07-03 17:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-03 17:50 - 2015-07-03 17:50 - 00000000 ____D C:\Users\KinG\AppData\Roaming\AVG2015
2015-07-03 17:49 - 2015-07-03 17:49 - 00000965 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-03 17:49 - 2015-07-03 17:49 - 00000000 ____D C:\Users\KinG\AppData\Roaming\TuneUp Software
2015-07-03 17:49 - 2015-07-03 17:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-07-03 17:49 - 2015-07-03 17:49 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-03 17:48 - 2015-07-03 20:32 - 00000000 ____D C:\ProgramData\AVG2015
2015-07-03 17:48 - 2015-07-03 17:48 - 00000000 ___HD C:\$AVG
2015-07-03 17:48 - 2015-07-03 17:48 - 00000000 ____D C:\Program Files (x86)\AVG
2015-07-03 16:12 - 2013-06-19 19:52 - 29706896 _____ (Foxit Corporation ) C:\Users\KinG\Desktop\FoxitReader603.0524_enu_Setup.exe
2015-07-03 15:26 - 2015-07-08 14:53 - 00000000 ____D C:\Users\KinG\AppData\Roaming\uTorrent
2015-07-03 15:26 - 2015-07-03 15:26 - 00000829 _____ C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2015-07-03 15:25 - 2015-07-03 15:25 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2015-07-03 14:18 - 2015-07-02 13:23 - 04073096 _____ (SurfRight B.V.) C:\Users\KinG\Desktop\hmpalert3.exe
2015-07-03 14:16 - 2015-07-07 19:31 - 00000000 ____D C:\Users\KinG\AppData\Roaming\WinRAR
2015-07-03 14:16 - 2015-07-03 14:17 - 00000000 ____D C:\Program Files (x86)\WinRAR
2015-07-03 14:16 - 2015-07-03 14:16 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-07-03 14:16 - 2015-07-03 14:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-07-03 14:14 - 2015-07-03 14:14 - 00000000 ____D C:\Users\KinG\AppData\Local\Avg2014
2015-07-03 14:13 - 2015-07-06 14:28 - 00000000 ____D C:\ProgramData\HitmanPro
2015-07-03 14:13 - 2015-07-03 14:13 - 00001897 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Notepad++
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\Program Files\HitmanPro
2015-07-03 14:13 - 2015-07-03 14:13 - 00000000 ____D C:\Program Files (x86)\Notepad++
2015-07-03 14:12 - 2015-07-05 13:53 - 00000000 ____D C:\Program Files\VideoLAN
2015-07-03 14:12 - 2015-07-03 18:27 - 00000000 ____D C:\Users\KinG\AppData\Local\Adobe
2015-07-03 12:05 - 2015-07-03 12:05 - 00008192 __RSH C:\BOOTSECT.BAK
2015-07-03 12:05 - 2015-07-02 22:42 - 00000000 ____D C:\Windows\Panther
2015-07-03 12:05 - 2010-11-21 08:53 - 00383786 __RSH C:\bootmgr
2015-07-03 12:00 - 2015-07-08 13:58 - 00000000 ____D C:\ProgramData\MFAData
2015-07-03 12:00 - 2015-07-03 18:13 - 00000000 ____D C:\Users\KinG\AppData\Local\Avg2015
2015-07-03 12:00 - 2015-07-03 12:00 - 00000000 ____D C:\Users\KinG\AppData\Local\MFAData
2015-07-03 11:47 - 2015-07-08 13:16 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-03 11:47 - 2015-07-03 17:36 - 00001106 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-03 11:47 - 2015-07-03 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-03 11:47 - 2015-07-03 17:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-03 11:47 - 2015-07-03 11:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-03 11:47 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-03 11:47 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-03 11:47 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-03 11:45 - 2015-07-03 11:45 - 00057560 _____ C:\Users\KinG\AppData\Local\GDIPFONTCACHEV1.DAT
2015-07-03 11:45 - 2015-07-03 11:45 - 00000000 ____D C:\Users\KinG\AppData\Roaming\ATI
2015-07-03 11:45 - 2015-07-03 11:45 - 00000000 ____D C:\Users\KinG\AppData\Local\ATI
2015-07-03 11:45 - 2015-07-03 11:45 - 00000000 ____D C:\ProgramData\ATI
2015-07-03 11:44 - 2015-07-03 11:44 - 00000000 _____ C:\Windows\ativpsrm.bin
2015-07-03 11:43 - 2015-07-03 11:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2015-07-03 11:43 - 2015-07-03 11:43 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2015-07-03 11:43 - 2015-07-03 11:43 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2015-07-03 11:43 - 2015-07-03 11:43 - 00000000 ____D C:\Program Files (x86)\ATI
2015-07-03 11:42 - 2015-07-03 11:43 - 00000000 ____D C:\Program Files\ATI Technologies
2015-07-03 11:42 - 2015-07-03 11:42 - 00000000 ____D C:\Program Files\ATI
2015-07-03 11:42 - 2015-07-03 11:42 - 00000000 ____D C:\ATI
2015-07-03 11:41 - 2011-01-26 07:05 - 00425064 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-07-03 11:41 - 2011-01-26 07:05 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-07-03 11:41 - 2011-01-26 07:05 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2015-07-03 11:40 - 2015-07-03 11:41 - 00000000 ___HD C:\Program Files (x86)\Temp
2015-07-03 11:40 - 2015-07-03 11:41 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-07-03 11:40 - 2015-07-03 11:41 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-07-03 11:40 - 2011-02-25 19:37 - 01284712 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2015-07-03 11:08 - 2015-07-03 11:08 - 00001355 _____ C:\Windows\TSSysprep.log
2015-07-03 11:08 - 2015-07-03 11:08 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2015-07-03 11:08 - 2015-07-03 11:08 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-07-02 22:45 - 2015-07-08 14:42 - 00053495 _____ C:\Windows\WindowsUpdate.log
2015-07-02 22:43 - 2015-07-02 22:43 - 00001447 _____ C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-02 22:43 - 2015-07-02 22:43 - 00001413 _____ C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-07-02 22:42 - 2015-07-02 22:42 - 00406835 __RSH C:\MVHRU
2015-07-02 22:42 - 2015-07-02 22:42 - 00000020 __RSH C:\win7.ld
2015-07-02 22:42 - 2015-07-02 22:42 - 00000020 ___SH C:\Users\KinG\ntuser.ini
2015-07-02 22:42 - 2015-07-02 22:42 - 00000000 ____D C:\Users\KinG\AppData\Local\VirtualStore
2015-07-02 22:42 - 2015-07-02 22:42 - 00000000 ____D C:\Users\KinG
2015-07-02 22:42 - 2009-07-14 10:24 - 00000000 ___RD C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-02 22:42 - 2009-07-14 10:19 - 00000000 ___RD C:\Users\KinG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-07-02 22:41 - 2015-07-02 22:41 - 00000000 __SHD C:\Recovery
2015-06-26 09:49 - 2015-06-26 09:49 - 00293296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-06-16 15:55 - 2015-06-16 15:55 - 00259040 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2015-06-10 16:38 - 2015-06-10 16:38 - 00226784 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-08 11:36 - 2009-07-14 10:15 - 00023872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-08 11:36 - 2009-07-14 10:15 - 00023872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-08 11:27 - 2009-07-14 10:38 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-08 11:27 - 2009-07-14 10:21 - 00023541 _____ C:\Windows\setupact.log
2015-07-07 18:02 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\NDF
2015-07-07 14:44 - 2009-07-14 10:43 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-04 11:40 - 2010-11-21 09:17 - 00007714 _____ C:\Windows\PFRO.log
2015-07-03 12:50 - 2009-07-14 10:39 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-03 12:05 - 2009-07-14 11:08 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2015-07-03 12:05 - 2009-07-14 11:02 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2015-07-03 12:05 - 2009-07-14 10:15 - 00000000 ____D C:\Windows\Setup
2015-07-03 11:49 - 2009-07-14 08:50 - 00000000 __RHD C:\Users\Public\Libraries
2015-07-03 11:43 - 2009-07-14 08:50 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-07-03 11:41 - 2009-07-14 11:02 - 00000000 ____D C:\Windows\system32\restore
2015-07-03 11:11 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\rescache
2015-07-03 11:10 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\oobe
2015-07-03 11:09 - 2009-07-14 10:15 - 00274320 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-03 11:08 - 2009-07-14 11:02 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-07-03 11:08 - 2009-07-14 10:16 - 00002790 _____ C:\Windows\DtcInstall.log
2015-07-03 11:08 - 2009-07-14 08:50 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-03 11:08 - 2009-07-14 08:50 - 00000000 ____D C:\Windows\system32\sysprep
2015-07-03 11:06 - 2010-11-21 12:46 - 00000000 ____D C:\Windows\CSC

Some files in TEMP:
====================
C:\Users\KinG\AppData\Local\Temp\35e01c17-81d5-4c1a-8875-015ece2b9c75.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-03 17:35

==================== End of log ============================

Attached Files



#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 08 July 2015 - 08:29 AM

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-07-04] ()
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
SearchScopes: HKU\S-1-5-21-3632008019-2436663354-1690540117-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-07-04] (AVG)
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF SearchPlugin: C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default\searchplugins\avg-secure-search.xml [2015-07-04]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-07-04]
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-07-04] (AVG Secure Search)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Users\KinG\AppData\Local\Temp\35e01c17-81d5-4c1a-8875-015ece2b9c75.exe
End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Firefox:
Reset Default Browsing settings:
https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-problems?utm_expid=65912487-41.djHNRQY0RhaLvvtvcd0BQA.2&utm_referrer=https%3A%2F%2Fwww.google.ca%2F

Clean the Firefox Cache.
https://kb.wisc.edu/page.php?id=15141

Clean your Flash cache.
https://forums.adobe.com/message/4278569
===

How is the computer running now?

#6 Xscape

Xscape
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:44 AM

Posted 08 July 2015 - 09:28 AM

Youtube or other Google Services still not working.

I'm getting "Secure Connection Failed"

 

Here's the Fixlog.txt log-

 

Fix result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by KinG at 2015-07-08 19:40:49 Run:1
Running from C:\Users\KinG\Desktop\Farbar
Loaded Profiles: KinG (Available Profiles: KinG)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-07-04] ()
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
SearchScopes: HKU\S-1-5-21-3632008019-2436663354-1690540117-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-07-04] (AVG)
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: https://mysearch.avg.com/?cid={E46EB129-12B4-4C6A-9F34-5C2CDEDF1B76}&mid=532d757b175747cdb0ce2de352ebe3e0-a72ec3c09667abe465ba8fa62aa1901ffd341ceb&lang=en&ds=AVG&coid=avgtbavg&cmpid=0615pii&pr=fr&d=2015-07-04 11:58:18&v=4.1.0.411&pid=wtu&sg=&sap=hp
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF SearchPlugin: C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default\searchplugins\avg-secure-search.xml [2015-07-04]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-07-04]
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-07-04] (AVG Secure Search)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\Users\KinG\AppData\Local\Temp\35e01c17-81d5-4c1a-8875-015ece2b9c75.exe
End
*****************

Restore point was successfully created.
Processes closed successfully.
[4048] C:\Program Files (x86)\AVG Web TuneUp\vprot.exe => process closed successfully.
[1916] C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe => process closed successfully.
[1900] C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe => process closed successfully.
[6756] C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe => process closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\vProt => value removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => key removed successfully
HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
"HKU\S-1-5-21-3632008019-2436663354-1690540117-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}" => key removed successfully
Firefox SelectedSearchEngine removed successfully
Firefox homepage removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin" => key removed successfully
C:\Users\KinG\AppData\Roaming\Mozilla\Firefox\Profiles\nnsa1fif.default\searchplugins\avg-secure-search.xml => moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml => moved successfully.
vToolbarUpdater18.4.0 => Service stopped successfully.
vToolbarUpdater18.4.0 => Service removed successfully
VGPU => Service removed successfully
C:\Users\KinG\AppData\Local\Temp\35e01c17-81d5-4c1a-8875-015ece2b9c75.exe => moved successfully.
EmptyTemp: => 90 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 19:41:48 ====



#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 08 July 2015 - 01:22 PM

Do you problems with all Browsers or just FireFox?

Try this out.
https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message

#8 Xscape

Xscape
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:44 AM

Posted 09 July 2015 - 12:52 AM

I have this problem with every browser.

 

I tried everything..disabling the plugins, troubleshooting in safe mode.

 

Can you tell me what is happening..is this a malware or what?

 

Do you think my router is infected?

 

Before I complete format my hardisk I copied some of my data in my external hardrive..is my ext hardrive also affected? (Please say no).



#9 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 09 July 2015 - 08:44 AM

Yes your router may be infected.

https://support.avg.com/supportArticleView?urlname=Exploit-Fake-Flash-Player-type-1747-detected-by-AVG-LinkScanner&l=en_US

#10 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 15 July 2015 - 07:57 AM

Are you still with me?

#11 nasdaq

nasdaq

  • Malware Response Team
  • 38,246 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:04:14 PM

Posted 21 July 2015 - 08:04 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users