Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Is this something to worry about


  • Please log in to reply
11 replies to this topic

#1 DeweyDiablo

DeweyDiablo

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 03 December 2015 - 06:09 PM

The other day I went to use my Google Chrome.  It would not load any pages, and you could not access any of the menu or settings.  I did find a tip that said to rename the google.exe file to browser.exe file.  I did that and it worked.  Along the way, there were several suggestions I found about Malware.  I ran the following programs:

 

1. Malwarebytes Anti-malware

 

I then ran

 

2. RogueKiller, which showed this (see attached file):

 

I then ran

 

3. Spy Hunter 4to try and get rid of those things that RogueKiller showed.  They will not go away.

 

Should this be addressed, Thoughts?

Attached Files



BC AdBot (Login to Remove)

 


#2 shelf life

shelf life

  • Malware Response Team
  • 2,648 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:@localhost
  • Local time:05:23 AM

Posted 04 December 2015 - 03:18 PM

Hi,

Should you be worried about having to rename a exe to run: YES

​Not everything Roguekiller shows is malware

​Spy hunter is not recommended as a antimalware app.

​See step 6 about downloading and posting a FRST log if you want to continue.

http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/


How Can I Reduce My Risk to Malware?


#3 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 04 December 2015 - 06:17 PM

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-12-2015
Ran by Dad (administrator) on DAD-PC (04-12-2015 17:52:35)
Running from C:\Users\Dad\Downloads\Malware Stuff
Loaded Profiles: Dad (Available Profiles: Dad)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(IBM Corp.) C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe
(SEIKO EPSON CORPORATION) C:\Program Files\epson\EpsonCustomerParticipation\EPCP.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Intuit) C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(IBM Corp.) C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\FAX Utility\FUFAXRCV.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_TATIHSA.EXE
(Fieldston Software) C:\Program Files\Fieldston Software\gSyncit\gsyncit.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
(Intuit Inc.) C:\Program Files\Intuit\QuickBooks 2015\QBW32.EXE
(Dropbox, Inc.) C:\Users\Dad\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intuit, Inc.) C:\Program Files\Intuit\QuickBooks 2015\QBDBMgr.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\QuickBooks\axlbridge.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\excel.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_19_0_0_245_ActiveX.exe
(iAnywhere Solutions, Inc.) C:\Program Files\Intuit\QuickBooks 2015\dbextclr11.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\Users\Dad\Downloads\Malware Stuff\RogueKiller.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\outlook.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Ilium Software, Inc.) C:\Program Files\Ilium Software\eWallet\eWallet.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\browser.exe.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [FUFAXRCV] => C:\Program Files\Epson Software\FAX Utility\FUFAXRCV.exe [495616 2011-03-08] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [FUFAXSTM] => C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe [856064 2011-03-08] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM\...\Run: [Nvtmru] => "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-11] (Avast Software s.r.o.)
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2634896 2015-07-23] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Intuit SyncManager] => C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe [3776824 2015-03-17] (Intuit Inc. All rights reserved.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157456 2015-10-16] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKU\RK_Administrator_ON_F_10F8\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\logon.scr
HKU\RK_Default User_ON_F_EF88\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\logon.scr
HKU\RK_Guest_ON_F_E6E4\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2015-08-06] (Apple Inc.)
HKU\RK_Guest_ON_F_E6E4\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\logon.scr
HKU\RK_LocalService_ON_F_247F\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\logon.scr
HKU\RK_Michelle Krill_ON_F_F652\...\Run: [H/PC Connection Agent] => "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
HKU\RK_Michelle Krill_ON_F_F652\...\Run: [PhotoShow Deluxe Media Manager] => C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe
HKU\RK_Michelle Krill_ON_F_F652\...\MountPoints2: {2f4c7088-9aa4-11dc-8c45-8000600fe800} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Michelle Krill_ON_F_F652\...\MountPoints2: {789f60b5-523b-11dc-8c2e-0018f367745c} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Michelle Krill_ON_F_F652\...\MountPoints2: {87314982-6258-11dd-8ca1-0018f370231e} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_NetworkService_ON_F_65B8\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\System32\logon.scr
HKU\RK_Richard Krill_ON_F_B8A5\...\Run: [H/PC Connection Agent] => "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
HKU\RK_Richard Krill_ON_F_B8A5\...\Run: [Uniblue RegistryBooster 2] => C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
HKU\RK_Richard Krill_ON_F_B8A5\...\Run: [Google Update] => "C:\Documents and Settings\Richard Krill\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
HKU\RK_Richard Krill_ON_F_B8A5\...\MountPoints2: {2f4c7088-9aa4-11dc-8c45-8000600fe800} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Richard Krill_ON_F_B8A5\...\MountPoints2: {50f423d1-cb24-11db-8bef-0018f367745c} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Richard Krill_ON_F_B8A5\...\MountPoints2: {789f60b5-523b-11dc-8c2e-0018f367745c} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Richard Krill_ON_F_B8A5\...\MountPoints2: {87314982-6258-11dd-8ca1-0018f370231e} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL recycled\sys.exe
HKU\RK_Richard Krill_ON_F_B8A5\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\logon.scr
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-08-24] (Google Inc.)
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_TATIHSA.EXE [220800 2013-08-24] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\...\Run: [gSyncit] => C:\Program Files\Fieldston Software\gSyncit\gsyncit.exe [228352 2015-11-06] (Fieldston Software)
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\...\Run: [Dropbox Update] => C:\Users\Dad\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-19] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-05-09] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dad\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dad\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dad\AppData\Roaming\Dropbox\bin\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2015-06-21]
ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2015-06-21]
ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2015-06-21]
ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files\Intuit\QuickBooks 2015\QBW32.EXE (Intuit Inc.)
Startup: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-11-12]
ShortcutTarget: Dropbox.lnk -> C:\Users\Dad\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AB0F417A-89B2-414C-8799-B1518514E476}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\RK_Guest_ON_F_E6E4\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\RK_Michelle Krill_ON_F_F652\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\RK_Richard Krill_ON_F_B8A5\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\RK_Administrator_ON_F_10F8\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKU\RK_Administrator_ON_F_10F8\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\RK_Guest_ON_F_E6E4\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKU\RK_Guest_ON_F_E6E4\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\RK_Michelle Krill_ON_F_F652\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://swmail.swsd.k12.pa.us/gw/webacc
HKU\RK_Michelle Krill_ON_F_F652\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\RK_Richard Krill_ON_F_B8A5\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\RK_Richard Krill_ON_F_B8A5\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKU\RK_Guest_ON_F_E6E4 -> {E1BC9CAE-3E3F-4315-92AA-188F3118247F} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}
SearchScopes: HKU\RK_Richard Krill_ON_F_B8A5 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SOLTDF&PC=SUN1&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\RK_Richard Krill_ON_F_B8A5 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SOLTDF&PC=SUN1&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\RK_Richard Krill_ON_F_B8A5 -> {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=5miOmO4nCUyGaJJbnPPNdJBihZI?q={searchTerms}
SearchScopes: HKU\RK_Richard Krill_ON_F_B8A5 -> {ECA39587-2D5E-4A0E-BC0B-B8298780BAA7} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7GGIH_en
SearchScopes: HKU\S-1-5-21-3552867854-1951453319-4153860928-1000 -> {F0138CB2-AD83-4F27-8CD0-4A05F9227499} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-13] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-05-09] (Avast Software s.r.o.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-10-13] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
Toolbar: HKU\RK_Guest_ON_F_E6E4 -> &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\explorerframe.dll [2015-08-06] (Microsoft Corporation)
Toolbar: HKU\RK_Guest_ON_F_E6E4 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
Toolbar: HKU\RK_Guest_ON_F_E6E4 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Michelle Krill_ON_F_F652 -> &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\explorerframe.dll [2015-08-06] (Microsoft Corporation)
Toolbar: HKU\RK_Michelle Krill_ON_F_F652 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
Toolbar: HKU\RK_Michelle Krill_ON_F_F652 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Richard Krill_ON_F_B8A5 -> &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\explorerframe.dll [2015-08-06] (Microsoft Corporation)
Toolbar: HKU\RK_Richard Krill_ON_F_B8A5 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
Toolbar: HKU\RK_Richard Krill_ON_F_B8A5 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\S-1-5-21-3552867854-1951453319-4153860928-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
Handler: intu-help-qb8 - {CD17C364-2EC8-4929-91A9-C4839A20E909} - C:\Program Files\Intuit\QuickBooks 2015\HelpAsyncPluggableProtocol.dll [2015-10-15] (Intuit, Inc.)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-22] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-08-24] (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-17] (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-26] (Adobe Systems Inc.)
FF Plugin HKU\RK_Richard Krill_ON_F_B8A5: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll [No File]
FF Plugin HKU\RK_Richard Krill_ON_F_B8A5: @talk.google.com/GoogleTalkPlugin -> C:\Documents and Settings\Richard Krill\Application Data\Mozilla\plugins\npgoogletalk.dll [No File]
FF Plugin HKU\RK_Richard Krill_ON_F_B8A5: @tools.google.com/Google Update;version=8 -> C:\Documents and Settings\Richard Krill\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll [No File]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-06-01] [not signed]

Chrome:
=======
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Chrome Web Store Payments) - C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-02]
CHR HKLM\...\Chrome\Extension: [aaffhmecfaelkngcbnfdkcckmillnoki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-09]
CHR HKU\S-1-5-21-3552867854-1951453319-4153860928-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bbjllphbppobebmjpjcijfbakobcheof] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-09] (Avast Software s.r.o.)
S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3207800 2015-05-09] (Avast Software)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1895096 2015-10-13] (Microsoft Corporation)
R2 EpsonCustomerParticipation; C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe [581104 2015-09-25] (SEIKO EPSON CORPORATION)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [921232 2015-07-23] (NVIDIA Corporation)
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1871504 2015-07-23] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [4305040 2015-07-23] (NVIDIA Corporation)
R2 QBCFMonitorService; C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2015-10-15] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2014-12-06] (Intuit Inc.) [File not signed]
R2 QBVSS; C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2014-12-06] (Intuit Inc.) [File not signed]
R2 RapportMgmtService; C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe [2255128 2015-11-12] (IBM Corp.)
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [784256 2015-12-03] (Enigma Software Group USA, LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-05-09] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [74976 2015-05-09] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-05-09] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-05-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787760 2015-05-09] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [428120 2015-06-29] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-05-09] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [209048 2015-05-09] ()
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [16432 2015-12-03] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-03] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [18576 2015-07-23] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [42344 2015-07-02] (NVIDIA Corporation)
R1 RapportCerberus_1507076; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_1507076.sys [555384 2015-11-22] (IBM Corp.)
R1 RapportEI; C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys [292280 2015-11-12] (IBM Corp.)
R0 RapportHades; C:\Windows\System32\Drivers\RapportHades.sys [70168 2015-11-12] (IBM Corp.)
S3 RapportKELL; C:\Windows\System32\Drivers\RapportKELL.sys [223000 2015-11-12] (IBM Corp.)
R1 RapportPG; C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys [349720 2015-11-12] (IBM Corp.)
R3 SNTNLUSB; C:\Windows\System32\DRIVERS\SNTNLUSB.SYS [35328 2007-04-27] (SafeNet, Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [30848 2015-12-02] ()
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220752 2015-05-09] (Avast Software)
R3 ZSMC301b; C:\Windows\System32\Drivers\usbVM31b.sys [91527 2005-02-26] (VM)
S3 PTQHBUS; system32\DRIVERS\PTQHBUS.sys [X]
S3 PTQHMDM; system32\DRIVERS\PTQHMDM.sys [X]
S3 PTQHVSP; system32\DRIVERS\PTQHVSP.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-04 17:52 - 2015-12-04 17:52 - 00000000 ____D C:\FRST
2015-12-04 17:43 - 2015-12-04 17:52 - 00000000 ____D C:\Users\Dad\Downloads\Malware Stuff
2015-12-04 11:18 - 2015-12-04 11:18 - 00231936 _____ C:\Users\Dad\Downloads\employee_template.xls
2015-12-03 17:33 - 2015-12-03 17:33 - 00000000 ____D C:\Users\Dad\AppData\Local\CrashDumps
2015-12-03 08:44 - 2015-12-03 08:44 - 00001204 _____ C:\Users\Dad\Desktop\SpyHunter.lnk
2015-12-03 08:44 - 2015-12-03 08:44 - 00000000 ____D C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2015-12-03 08:44 - 2015-12-03 08:44 - 00000000 ____D C:\Users\Dad\AppData\Roaming\Enigma Software Group
2015-12-03 08:44 - 2015-12-03 08:44 - 00000000 ____D C:\sh4ldr
2015-12-03 08:43 - 2015-12-03 08:43 - 00019984 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2015-12-03 08:43 - 2015-12-03 08:43 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-12-03 08:04 - 2015-12-03 08:04 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-02 12:21 - 2015-12-02 12:22 - 00001739 _____ C:\Users\Dad\Desktop\browser.exe - Shortcut.lnk
2015-12-02 12:07 - 2015-12-02 12:07 - 00030848 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-12-02 12:07 - 2015-12-02 12:07 - 00000000 ____D C:\ProgramData\RogueKiller
2015-12-02 11:00 - 2015-12-02 11:01 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-12-02 10:59 - 2015-12-02 10:59 - 00001024 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-12-02 10:59 - 2015-12-02 10:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-02 10:59 - 2015-12-02 10:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-02 10:59 - 2015-12-02 10:59 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-12-02 10:59 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-12-02 10:59 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-12-02 10:59 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-12-02 10:58 - 2015-12-02 10:58 - 22908888 _____ (Malwarebytes ) C:\Users\Dad\Downloads\mbam-setup-2.2.0.1024.exe
2015-12-02 10:41 - 2015-12-02 10:41 - 00002165 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-02 10:41 - 2015-12-02 10:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-22 20:49 - 2015-11-22 20:49 - 00000078 _____ C:\Windows\8825.INI
2015-11-22 20:23 - 2015-11-22 20:23 - 00000000 ____D C:\Users\Dad\AppData\Local\YSearchUtil
2015-11-22 20:20 - 2015-11-22 20:18 - 00095840 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-11-22 20:19 - 2015-11-22 20:19 - 00000000 ____D C:\Users\Dad\AppData\Roaming\Sun
2015-11-22 20:19 - 2015-11-22 20:19 - 00000000 ____D C:\Users\Dad\.oracle_jre_usage
2015-11-22 20:19 - 2015-11-22 20:19 - 00000000 ____D C:\Program Files\Common Files\Java
2015-11-22 20:15 - 2015-11-22 20:15 - 00000000 ____D C:\Users\Dad\AppData\LocalLow\Oracle
2015-11-12 09:37 - 2015-11-03 12:46 - 02386944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-12 03:04 - 2015-11-12 03:04 - 00000000 ____D C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-11-12 01:32 - 2015-11-12 01:32 - 00223000 _____ (IBM Corp.) C:\Windows\system32\Drivers\RapportKELL.sys
2015-11-12 01:32 - 2015-11-12 01:32 - 00070168 _____ (IBM Corp.) C:\Windows\system32\Drivers\RapportHades.sys
2015-11-11 08:43 - 2015-10-19 19:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-11-11 08:43 - 2015-10-19 19:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 08:43 - 2015-10-19 19:52 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 08:43 - 2015-10-19 19:52 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 08:43 - 2015-10-19 19:48 - 01308160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 08:43 - 2015-10-19 19:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 08:43 - 2015-10-19 19:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 08:43 - 2015-10-19 19:45 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 08:43 - 2015-10-19 19:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 08:43 - 2015-10-19 19:44 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 08:43 - 2015-10-19 19:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 08:43 - 2015-10-19 19:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 08:43 - 2015-10-19 19:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 08:43 - 2015-10-19 19:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 08:43 - 2015-10-19 18:29 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 08:43 - 2015-10-19 18:28 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 08:43 - 2015-10-19 18:28 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 08:43 - 2015-10-13 11:31 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 08:43 - 2015-10-13 11:31 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 08:42 - 2015-11-03 16:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 08:42 - 2015-10-30 17:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 08:42 - 2015-10-30 17:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 08:42 - 2015-10-30 17:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 08:42 - 2015-10-30 17:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 08:42 - 2015-10-30 17:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 08:42 - 2015-10-30 17:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 08:42 - 2015-10-30 17:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 08:42 - 2015-10-30 17:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 08:42 - 2015-10-30 17:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 08:42 - 2015-10-30 17:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 08:42 - 2015-10-30 17:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 08:42 - 2015-10-30 17:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 08:42 - 2015-10-30 17:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 08:42 - 2015-10-30 17:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 08:42 - 2015-10-30 17:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 08:42 - 2015-10-30 17:36 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 08:42 - 2015-10-30 17:31 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 08:42 - 2015-10-30 17:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 08:42 - 2015-10-30 17:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 08:42 - 2015-10-30 17:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 08:42 - 2015-10-30 17:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 08:42 - 2015-10-30 17:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 08:42 - 2015-10-30 17:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 08:42 - 2015-10-30 17:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 08:42 - 2015-10-30 17:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 08:42 - 2015-10-30 17:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 08:42 - 2015-10-30 17:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 08:42 - 2015-10-30 17:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 08:42 - 2015-10-30 17:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 08:42 - 2015-10-30 17:09 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 08:42 - 2015-10-30 16:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 08:42 - 2015-10-30 16:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 08:42 - 2015-10-30 16:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 08:42 - 2015-10-12 23:50 - 00712640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 08:41 - 2015-10-20 12:46 - 02955776 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 08:41 - 2015-10-20 12:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 08:41 - 2015-10-20 12:45 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 08:41 - 2015-10-20 12:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 08:41 - 2015-10-20 12:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 08:41 - 2015-10-20 12:45 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 08:41 - 2015-10-01 12:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 08:41 - 2015-10-01 12:50 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-11 08:41 - 2015-09-23 08:09 - 00371920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 08:41 - 2015-09-23 08:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-04 17:52 - 2009-07-13 21:37 - 00000000 ____D C:\Windows
2015-12-04 17:44 - 2013-08-24 20:30 - 00000000 ____D C:\Users\Dad\Documents\Outlook Files
2015-12-04 17:42 - 2009-07-13 23:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-04 17:42 - 2009-07-13 23:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-04 17:04 - 2015-06-19 16:54 - 00000910 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3552867854-1951453319-4153860928-1000UA.job
2015-12-04 16:57 - 2013-08-24 21:20 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-04 16:56 - 2013-08-24 16:14 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-04 15:56 - 2013-08-24 16:14 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-04 12:16 - 2013-08-24 21:16 - 00000000 ____D C:\Users\Dad\AppData\Local\CutePDF Writer
2015-12-04 09:39 - 2009-07-13 23:52 - 00000000 ____D C:\Windows\system32\FxsTmp
2015-12-03 19:04 - 2015-06-19 16:54 - 00000858 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3552867854-1951453319-4153860928-1000Core.job
2015-12-03 12:00 - 2014-02-01 20:37 - 00000509 _____ C:\Users\Dad\AppData\Roaming\com.iliumsoft.ewallet.plist
2015-12-02 13:18 - 2013-08-24 23:51 - 00000000 ____D C:\Users\Dad\AppData\Roaming\gSyncit
2015-12-02 10:42 - 2010-11-20 16:01 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-02 10:42 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\inf
2015-12-02 10:41 - 2013-08-24 16:14 - 00000000 ____D C:\Users\Dad\AppData\Local\Google
2015-12-02 10:40 - 2013-08-24 16:14 - 00000000 ____D C:\Program Files\Google
2015-12-02 10:39 - 2013-08-24 15:07 - 00000000 ___RD C:\Users\Dad\Documents\Dropbox
2015-12-02 10:39 - 2013-08-24 15:02 - 00000000 ____D C:\Users\Dad\AppData\Roaming\Dropbox
2015-12-02 10:37 - 2009-07-13 23:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-02 10:36 - 2013-08-24 15:04 - 00000000 ____D C:\ProgramData\NVIDIA
2015-12-02 10:33 - 2015-04-21 16:51 - 00000000 ____D C:\Program Files\Pantech
2015-12-02 10:25 - 2013-08-24 20:22 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-12-02 10:23 - 2013-08-24 20:19 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-11-22 20:29 - 2014-10-16 08:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection
2015-11-22 20:21 - 2013-11-08 10:33 - 00000000 ____D C:\ProgramData\Oracle
2015-11-22 20:20 - 2014-05-29 09:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-22 20:19 - 2013-08-24 14:58 - 00000000 ____D C:\Users\Dad
2015-11-22 20:18 - 2014-05-29 09:48 - 00278624 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-11-22 20:18 - 2013-08-24 16:28 - 00000000 ____D C:\Program Files\Java
2015-11-16 09:38 - 2013-08-24 20:28 - 00000000 ____D C:\Users\Dad\Downloads\gSyncit
2015-11-13 03:18 - 2009-07-13 23:33 - 00456416 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-12 09:12 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\rescache
2015-11-12 03:47 - 2010-11-20 19:47 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-12 03:32 - 2013-08-26 10:48 - 00000000 ____D C:\Windows\system32\MRT
2015-11-12 03:20 - 2013-08-26 10:48 - 143250520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-11 11:57 - 2013-08-24 21:20 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-11-11 11:57 - 2013-08-24 21:20 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-11-11 10:45 - 2013-08-24 16:09 - 00000090 _____ C:\Windows\QBChanUtil_Trigger.ini
2015-11-04 11:32 - 2014-01-14 14:18 - 00000000 ____D C:\Users\Dad\AppData\Local\Deployment

==================== Files in the root of some directories =======

2014-02-01 20:37 - 2015-12-03 12:00 - 0000509 _____ () C:\Users\Dad\AppData\Roaming\com.iliumsoft.ewallet.plist

Some files in TEMP:
====================
C:\Users\Dad\AppData\Local\Temp\Abspdf.exe
C:\Users\Dad\AppData\Local\Temp\acfpdfu.dll
C:\Users\Dad\AppData\Local\Temp\acfpdfuamd64.dll
C:\Users\Dad\AppData\Local\Temp\acfpdfui.dll
C:\Users\Dad\AppData\Local\Temp\acfpdfuia64.dll
C:\Users\Dad\AppData\Local\Temp\acfpdfuiamd64.dll
C:\Users\Dad\AppData\Local\Temp\acfpdfuiia64.dll
C:\Users\Dad\AppData\Local\Temp\aiw69491004.EXE
C:\Users\Dad\AppData\Local\Temp\cdintf.dll
C:\Users\Dad\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Dad\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphr6pjk.dll
C:\Users\Dad\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\Dad\AppData\Local\Temp\i4jdel0.exe
C:\Users\Dad\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Dad\AppData\Local\Temp\jre-8u66-windows-au.exe
C:\Users\Dad\AppData\Local\Temp\MSIZAP.EXE
C:\Users\Dad\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Dad\AppData\Local\Temp\nvStInst.exe
C:\Users\Dad\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Dad\AppData\Local\Temp\PDFPRT400.exe
C:\Users\Dad\AppData\Local\Temp\ryeupcs4.dll
C:\Users\Dad\AppData\Local\Temp\setupproplusretail.x86.en-us_TX_PR_act_1_.exe
C:\Users\Dad\AppData\Local\Temp\stlport_r50.dll
C:\Users\Dad\AppData\Local\Temp\xmllite.dll
C:\Users\Dad\AppData\Local\Temp\ytb.exe
C:\Users\Dad\AppData\Local\Temp\_is753.exe
C:\Users\Dad\AppData\Local\Temp\{D0E678A9-A69D-4E9F-AE30-D8416A0EBF1D}-DropboxClient_3.10.7.exe
C:\Users\Dad\AppData\Local\Temp\{E3065721-03DE-4404-B061-7F895EB6891C}-DropboxClient_3.10.11.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-30 09:11

==================== End of FRST.txt ============================



#4 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 04 December 2015 - 06:18 PM

Attached is the Addition Log.  Thank you.

Attached Files



#5 shelf life

shelf life

  • Malware Response Team
  • 2,648 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:@localhost
  • Local time:05:23 AM

Posted 04 December 2015 - 09:52 PM

ok thanks for the info. dont see awhole lot to worry about. Looks like you have limited accounts set up on the machine for two users. Did malwarebytes come up clean?

 

We will use FRST to tidy up. Please copy/paste whats below into notepad.

Save it as fixlist.txt in the same location that you have FRST located.

Start FRST like before except this time click on the fix button once. Machine may reboot to finish the process. Upon reboot you will find a new log, fixlog.txt in the same location as FRST. Please post the log in your reply and we will go from there.

S3 PTQHBUS; system32\DRIVERS\PTQHBUS.sys [X]
S3 PTQHMDM; system32\DRIVERS\PTQHMDM.sys [X]
S3 PTQHVSP; system32\DRIVERS\PTQHVSP.sys [X]
Toolbar: HKU\RK_Guest_ON_F_E6E4 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Michelle Krill_ON_F_F652 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Richard Krill_ON_F_B8A5 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
EmptyTemp:

How Can I Reduce My Risk to Malware?


#6 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 05 December 2015 - 11:34 AM

Below is the log after the reboot.  Attached is an image that comes up when I ran FRST.

 

Fix result of Farbar Recovery Scan Tool (x86) Version:05-12-2015
Ran by Dad (2015-12-05 11:19:39) Run:1
Running from C:\Users\Dad\Downloads\Malware Stuff
Loaded Profiles: Dad (Available Profiles: Dad)
Boot Mode: Normal

==============================================

fixlist content:
*****************
S3 PTQHBUS; system32\DRIVERS\PTQHBUS.sys [X]
S3 PTQHMDM; system32\DRIVERS\PTQHMDM.sys [X]
S3 PTQHVSP; system32\DRIVERS\PTQHVSP.sys [X]
Toolbar: HKU\RK_Guest_ON_F_E6E4 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Michelle Krill_ON_F_F652 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
Toolbar: HKU\RK_Richard Krill_ON_F_B8A5 -> No Name - {981FE6A8-260C-4930-960F-C3BC82746CB0} -  No File
EmptyTemp:
*****************

PTQHBUS => service removed successfully.
PTQHMDM => service removed successfully.
PTQHVSP => service removed successfully.
HKU\RK_Guest_ON_F_E6E4\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{981FE6A8-260C-4930-960F-C3BC82746CB0} => value not found.
HKCR\CLSID\{981FE6A8-260C-4930-960F-C3BC82746CB0} => key not found.
HKU\RK_Michelle Krill_ON_F_F652\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{981FE6A8-260C-4930-960F-C3BC82746CB0} => value not found.
HKCR\CLSID\{981FE6A8-260C-4930-960F-C3BC82746CB0} => key not found.
HKU\RK_Richard Krill_ON_F_B8A5\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{981FE6A8-260C-4930-960F-C3BC82746CB0} => value not found.
HKCR\CLSID\{981FE6A8-260C-4930-960F-C3BC82746CB0} => key not found.
EmptyTemp: => 3.9 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:22:53 ====

Attached Files



#7 shelf life

shelf life

  • Malware Response Team
  • 2,648 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:@localhost
  • Local time:05:23 AM

Posted 05 December 2015 - 04:21 PM

Looks like FRST wasnt able to back up some stuff based on the screenshot. It did remove what was in the fixlist. Is malwarebytes coming up clean after a scan?


How Can I Reduce My Risk to Malware?


#8 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 05 December 2015 - 05:25 PM

Malwarebytes came up clean.  Attached are the results.  I also tried running Google Chrome form the original icon on my desktop.  It starts from there now using the chrome.exe  It did not originally which is what started me down this whole path.  Should there be any other things I should do or look at to make sure things are up to snuff?

Attached Files



#9 shelf life

shelf life

  • Malware Response Team
  • 2,648 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:@localhost
  • Local time:05:23 AM

Posted 06 December 2015 - 11:07 AM

Thanks for the info. Based on the logs, thing look good. MBAM also clean. I would say your good to go. You can delete the FRST icon and its logs as well as the FRST folder located in root drive C:

Happy safe surfing.


How Can I Reduce My Risk to Malware?


#10 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 06 December 2015 - 12:49 PM

Thanks for helping out.  One last question.  What anti-virus anti-malware apps should I be running.  I am using windows firewall, free avast, spyhunter seems to be running now also, and malwarebytes.  Is any of this stuff redundant?  I also had spyhunter find something which I allowed.  Is that ok?

Attached Files



#11 DeweyDiablo

DeweyDiablo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:04:23 AM

Posted 06 December 2015 - 12:51 PM

Plus it looks like Windows Defender

Attached Files



#12 shelf life

shelf life

  • Malware Response Team
  • 2,648 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:@localhost
  • Local time:05:23 AM

Posted 07 December 2015 - 06:28 PM

Sure, no problem I like questions.

​Ive never recommended spyhunter and I dont think any malware removing forum does for various reasons. For one thing years ago it was a listed as rogue/suspect product.

One antivirus and 2 or 3 antimalware apps are good. You have Avast as your AV, Malwarebytes and Defender as antimalware. The free version of MBAM dosnt run in the background, it has to be updated manually and a scan started manually. Defender does run in the background. So in real time AVAST is running and Defender is running. One AV and one antimalware.

 Not sure about Spyhunter, but from the picture it looks like it does run in real time. So you have a AV and two if you count Spyhunter antimalware running in real time.  This is a good configuration.

 

Nothing wrong with windows firewall either. Most likely you have a NAT router, also good in conjunction with Windows FW.

The MPSigstub.exe is a legit .exe. 


How Can I Reduce My Risk to Malware?





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users