Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: REvil ransomware is back in full attack mode and leaking data

Featured Deal: Build a career in IT management with 11 certification courses for $40

Multiple unknown programs are running without my consent

Started by Blakesr17 , Nov 27 2016 08:01 PM

Please log in to reply

6 replies to this topic

#1 Blakesr17

Members
4 posts
OFFLINE

Local time:02:00 PM

Posted 27 November 2016 - 08:01 PM

2. I have a bunch of programs running that I did not allow to start. What is odd is I have not downloaded any type of program from a unknown non-trusted source in a LONG time.

So i assume it is something that has been on my computer for awhile and just decided to show up recently.

I should have probably asked for help a long time ago, but I ended up waiting for unknown reasons and hope that I am not to late to be saved.

Programs I THINK are viruses that I know I did not download:

AnonymizerLauncher.exe - (Anonymizer Gadget).

d7cdfd6647a228c2c6273ed652730ac5.exe - a lot of exe's with similar names.

proxycheck.exe - Multiple instances run at the same time. Located in AnonymizerGadget.

Itibiti.exe - Soft phone?

OpenWith.exe - multiple instances.

E92A.tmp - multiple similar files.

Note-up.exe

knsq3AE8.tmpfs

fstint.exe

I also get a lot of popup's asking me to installed programs because "google users also have downloaded these programs".

My computer in-turn slows down due to all these programs running their bleep. Earlier today, I had 3 virus programs scanning my computer. I never downloaded, let alone installed them.

A few weeks ago, I noticed my computer was at 100% for DISK, Memory, and CPU. When i managed to look at the program running, it was actively looking through my computer, whereas i did a force-shutdown on my computer and I haven't seen it since.

Although I want to keep topic similar to viruses I have, I believe by getting rid of these viruses, my browser will also get fixed (since the tutorials did not work).

Screenshots of popup's and running programs:

http://imgur.com/a/NgNVq - apps google users installed.

http://imgur.com/a/a6Lsk - this program finished installing when I never gave permission for it to start.

http://imgur.com/a/dmhoS - some of these sketchy programs just restart themselves when they are closed.

http://imgur.com/a/xdJUA - one of the virus scanners that run on a daily basis.

3. Computer Specs:

OS Name Microsoft Windows 10 Home

Version 10.0.14393 Build 14393

System Type x64-based PC

Processor AMD A10-7850K Radeon R7, 12 Compute Cores 4C+8G, 3700 Mhz, 2 Core(s), 4 Logical Processor(s)

BIOS Mode UEFI

Platform Role Desktop

Installed Physical Memory (RAM) 8.00 GB

Total Physical Memory 6.94 GB

Available Physical Memory 3.53 GB

Total Virtual Memory 10.4 GB

Available Virtual Memory 6.37 GB

Page File Space 3.42 GB

4. Steps I have taken to get rid of viruses:

-Ran a full scan in windows defender (it detected viruses and removed them - supposedly).

-Ran a quick scan in windows defender (same as full scan).

-Ran a custom scan in windows defender of files that I know are most likely infected (such as temp files)

-Ran malware bytes, but it ended up not working because of getting stuck on "needs updating".

- Used a program called "Remove on Next Reboot" to try and delete some of the EXE's that I know are viruses and won't let me get rid of them.

- Uninstalled a few of my games I do not play anymore, to clear up scan times.

I have this gut feeling like my computer will run just as it did when I first got it, if all these issues get dealt with. I also do not have a backup of my files, although I can backup pictures and music if need be, since everything else can be easily re-downloaded.

Back to top

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 TazzyOpz

Members
100 posts
OFFLINE

Gender:Male
Local time:05:00 PM

Posted 27 November 2016 - 08:59 PM

Not sure If I'm authorized to help here? However once an Advisor or Moderator comments here they can take over.
For now I'd recommend doing the following.

[-Running AdwCleaner-]
Download AdwCleaner from here and save it to your Desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile

[-Running RogueKiller-]
Download RogueKiller from here and save it to your Desktop.

Double-click RogueKiller.exe
Click the Scan button.
Once the scan is finished You can view the Scan log by clicking the Report button. Then copy and paste the scan log here.
It is recommend to post the scan log here before removing any files detected unless you know for sure the file found is infected.

Edited by TazzyOpz, 27 November 2016 - 09:02 PM.

I.T Field Technician
C#, .Net, and Python.
Head Developer of NoBot est. 2015

Back to top

#3 Blakesr17

Topic Starter

Members
4 posts
OFFLINE

Local time:02:00 PM

Posted 28 November 2016 - 07:59 AM

Not sure If I'm authorized to help here? However once an Advisor or Moderator comments here they can take over.
For now I'd recommend doing the following.

[-Running AdwCleaner-]
Download AdwCleaner from here and save it to your Desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile

[-Running RogueKiller-]
Download RogueKiller from here and save it to your Desktop.

Double-click RogueKiller.exe
Click the Scan button.
Once the scan is finished You can view the Scan log by clicking the Report button. Then copy and paste the scan log here.
It is recommend to post the scan log here before removing any files detected unless you know for sure the file found is infected.

AdwCleaner Log

Spoiler

#AdwCleaner v6.030 - Logfile created 27/11/2016 at 21:43:15

# Updated on 19/10/2016 by Malwarebytes

# Database : 2016-11-26.2 [Server]

# Operating System : Windows 10 Home (X64)

# Username : Blake - DRAGONSPC

# Running from : C:\Users\Blake\Desktop\NEW DOWNLOADS FOLDER\AdwCleaner.exe

# Mode: Clean

# Support : hxxps://www.malwarebytes.com/support

***** [ Services ] *****

[-] Service deleted: 1aba884a9bc34fe898a044cb5e348150

[-] Service deleted: 4949ca9a4e858a3f60be51795162382c

[-] Service deleted: gupojoke

[-] Service deleted: AppVerifier

[-] Service deleted: EsgScanner

***** [ Folders ] *****

[-] Folder deleted: C:\Program Files (x86)\00000000-1480289811-0000-0000-448A5B9A9CF6

[-] Folder deleted: C:\ProgramData\d7187fcf-03e3-0

[-] Folder deleted: C:\ProgramData\d7187fcf-1127-1

[-] Folder deleted: C:\Users\Blake\AppData\Local\00000000-1480273569-0000-0000-448A5B9A9CF6

[-] Folder deleted: C:\Users\Blake\.proxycheck

[-] Folder deleted: C:\Users\Blake\.AnonymizerLauncher

[-] Folder deleted: C:\Users\Blake\AppData\Local\NowUSeeItPlayer

[-] Folder deleted: C:\Users\Blake\AppData\Local\AnonymizerLauncher

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\One System Care

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\ProxyGate

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\Advancedpccare.net

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\efo

[#] Folder deleted on reboot: C:\Users\Blake\AppData\Roaming\advancedpccare.net

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\wyupdate au

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\Interstatnogui

[-] Folder deleted: C:\Program Files\Advanced PC-Care

[-] Folder deleted: C:\ProgramData\Advancedpccare.net

[-] Folder deleted: C:\ProgramData\App-verifier

[#] Folder deleted on reboot: C:\ProgramData\advancedpccare.net

[#] Folder deleted on reboot: C:\ProgramData\Application Data\Advancedpccare.net

[#] Folder deleted on reboot: C:\ProgramData\Application Data\App-verifier

[#] Folder deleted on reboot: C:\ProgramData\Application Data\advancedpccare.net

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\One System Care

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NowUSeeIt Player

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced PC-Care

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KNCTR

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnonymizerGadget

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Socia2Sear Browser Enhancer

[-] Folder deleted: C:\Program Files (x86)\GreenTree Applications

[-] Folder deleted: C:\Program Files (x86)\Itibiti Soft Phone

[-] Folder deleted: C:\Program Files (x86)\Note-up

[-] Folder deleted: C:\Program Files (x86)\OneSystemCare

[-] Folder deleted: C:\Program Files (x86)\CleanBrowser

[-] Folder deleted: C:\Program Files (x86)\NowUSeeItPlayer

[-] Folder deleted: C:\Program Files (x86)\AnonymizerGadget

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Roaming\Note-up

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Roaming\NUIns

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Roaming\Itibiti

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Roaming\DailyBee

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\AnonymizerLauncher

[-] Folder deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\DailyBee

[#] Folder deleted on reboot: C:\Users\Blake\AppData\Roaming\efo

[-] Folder deleted: C:\Users\Blake\AppData\Roaming\AGData

[-] Folder deleted: C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl

***** [ Files ] *****

[#] File deleted: C:\WINDOWS\SysNative\drivers\1aba884a9bc34fe898a044cb5e348150.sys

[-] File deleted: C:\WINDOWS\SysNative\drivers\EsgScanner.sys

[-] File deleted: C:\Users\Public\Desktop\Knctr.lnk

[-] File deleted: C:\Users\Public\Desktop\Launch One System Care.lnk

[-] File deleted: C:\Users\Public\Desktop\Advanced PC-Care.lnk

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\cap.exe

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\cap4.exe

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\ddnow.exe

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\ddnow4.exe

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\tinstall.exe

[-] File deleted: C:\WINDOWS\SysWoW64\config\systemprofile\AppData\Local\tinstall4.exe

[-] File deleted: C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nonjdcjchghhkdoolnlbekcfllmednbl_0.localstorage

[-] File deleted: C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_nonjdcjchghhkdoolnlbekcfllmednbl_0.localstorage-journal

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

[-] Shortcut disinfected: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

[-] Shortcut disinfected: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\AppVerifier

[#] Key deleted on reboot: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\AppVerifier

[-] Key deleted: HKU\.DEFAULT\Software\WajIEnhance

[-] Key deleted: HKU\.DEFAULT\Software\INSTALLPATH\STATUS

[-] Key deleted: HKU\.DEFAULT\Software\b`nl{y

[-] Key deleted: HKU\.DEFAULT\Software\AppDataLow\Software\DailyBee

[-] Key deleted: HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall\AnonymizerGadget

[-] Key deleted: HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall\REOptimizer

[-] Key deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\One System Care

[-] Key deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\NowUSeeItPlayer

[-] Key deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\advancedpccare.net

[-] Key deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Windows\CurrentVersion\Uninstall\REOptimizer

[#] Key deleted on reboot: HKU\S-1-5-18\Software\WajIEnhance

[#] Key deleted on reboot: HKU\S-1-5-18\Software\INSTALLPATH\STATUS

[#] Key deleted on reboot: HKU\S-1-5-18\Software\b`nl{y

[#] Key deleted on reboot: HKU\S-1-5-18\Software\AppDataLow\Software\DailyBee

[#] Key deleted on reboot: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Uninstall\AnonymizerGadget

[#] Key deleted on reboot: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Uninstall\REOptimizer

[#] Key deleted on reboot: HKCU\Software\One System Care

[#] Key deleted on reboot: HKCU\Software\NowUSeeItPlayer

[#] Key deleted on reboot: HKCU\Software\advancedpccare.net

[-] Key deleted: HKLM\SOFTWARE\NowUSeeItPlayer

[-] Key deleted: HKLM\SOFTWARE\b`nl{y

[-] Key deleted: HKLM\SOFTWARE\Socia2Sear Browser Enhancer

[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\REOptimizer

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Note-up

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NUIns

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OneSystemCare

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PopupProduct

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CleanBrowser

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{730E03E4-350E-48E5-9D3E-4329903D454D}

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF5B9F52-33EB-4788-9569-B402FBB81FEF}

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Itibiti_is1

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DailyBee

[#] Key deleted on reboot: [x64] HKCU\Software\One System Care

[#] Key deleted on reboot: [x64] HKCU\Software\NowUSeeItPlayer

[#] Key deleted on reboot: [x64] HKCU\Software\advancedpccare.net

[-] Key deleted: [x64] HKLM\SOFTWARE\advancedpccare.net

[-] Key deleted: [x64] HKLM\SOFTWARE\AppVerifier

[-] Key deleted: [x64] HKLM\SOFTWARE\b`nl{y

[-] Key deleted: [x64] HKLM\SOFTWARE\Socia2Sear Browser Enhancer

[-] Key deleted: [x64] HKLM\SOFTWARE\pcv-var

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\REOptimizer

[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\B7A64AC7-B828-4D74-98B2-097AFA836948_is1

[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4

[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4

[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Features\4E30E037E0535E84D9E3349209D354D4

[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4

[-] Data restored: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\Main [Search Page]

[-] Data restored: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\Main [Search Bar]

[-] Data restored: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\Main [SearchAssistant]

[-] Data restored: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

[-] Data restored: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Data restored: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [SearchAssistant]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [SearchAssistant]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Value deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[#] Value deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[-] Value deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope]

[-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]

[-] Data restored: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon [Userinit] C:\WINDOWS\system32\userinit.exe,

[-] Data restored: [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon [Userinit] C:\WINDOWS\system32\userinit.exe,

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\advancedpccare.net

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\nowuseeitplayer.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\superfish.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ui.nowuseeitplayer.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.advancedpccare.net

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\eshopcomp.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pricepeep.net

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.eshopcomp.com

[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.pricepeep00.pricepeep.net

[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\solvusoft.com

[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.solvusoft.com

[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\solvusoft.com

[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.solvusoft.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\advancedpccare.net

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\nowuseeitplayer.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\superfish.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ui.nowuseeitplayer.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.advancedpccare.net

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\eshopcomp.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pricepeep.net

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\pstatic.eshopcomp.com

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.pricepeep00.pricepeep.net

[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\solvusoft.com

[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.solvusoft.com

[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\solvusoft.com

[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.solvusoft.com

[-] Value deleted: HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run [Itibiti.exe]

[#] Value deleted on reboot: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run [Itibiti.exe]

[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Note-up]

[-] Value deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Windows\CurrentVersion\Run [NowUSeeIt Player]

[#] Value deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NowUSeeIt Player]

[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [NowUSeeIt Player]

[#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NowUSeeIt Player]

[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [AnonymizerGadget]

[-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 [AnonymizerGadget]

[-] Value deleted: HKU\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Windows\CurrentVersion\Run [Interstatnogui]

[#] Value deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Interstatnogui]

[#] Value deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Interstatnogui]

[-] Key deleted: HKLM\SOFTWARE\Classes\DesktopBackground\Shell\Add event reminder

[-] Key deleted: HKLM\SOFTWARE\Classes\Directory\Background\shell\Add event reminder

[-] Key deleted: HKLM\SOFTWARE\Classes\Directory\shell\Add event reminder

[-] Value deleted: HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION [NowUSeeItPlayer.exe]

[-] Key deleted: HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9

[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\e24b7131-d039-43cb-9e6f-ad4be601ec1f

[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\04262113-2a31-48e1-b4bb-3b42174bea0f

[#] Key deleted on reboot: HKLM\SYSTEM\ControlSet001\Control\Power\User\PowerSchemes\e24b7131-d039-43cb-9e6f-ad4be601ec1f

[#] Key deleted on reboot: HKLM\SYSTEM\ControlSet001\Control\Power\User\PowerSchemes\04262113-2a31-48e1-b4bb-3b42174bea0f

[-] Key deleted: HKLM\SOFTWARE\Classes\*\shell\Add event reminder

***** [ Web browsers ] *****

[-] [C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: nonjdcjchghhkdoolnlbekcfllmednbl

[-] [C:\Users\Blake\AppData\Local\Google\Chrome\User Data\Default] [homepage] Deleted: hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B2393LadXJcLO8eunqMgFKa8BBixgCxYiK2gEHWi5T6E1ifSVFq1dlWX7WzHFtQr2tyIXFmNdOfHPCSAxUZRg0UplhBHvdOOxPJvNH3a9ISZTr3m2lhx2I8l6v5M4edeKF02mO8vbHVZM5LnsKIzSzwUVoZFNg7Zs2fNy4T4HoaY,

*************************

:: "Tracing" keys deleted

:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [9421 Bytes] - [23/10/2016 21:12:24]

C:\AdwCleaner\AdwCleaner[C2].txt - [19147 Bytes] - [27/11/2016 21:43:15]

C:\AdwCleaner\AdwCleaner[S0].txt - [8721 Bytes] - [23/10/2016 21:05:14]

C:\AdwCleaner\AdwCleaner[S1].txt - [20074 Bytes] - [27/11/2016 21:33:42]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [19368 Bytes] ##########

RogueKiller

Spoiler

RogueKiller V12.8.2.0 (x64) [Nov 21 2016] (Free) by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/download/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version

Started in : Normal mode

User : Blake [Administrator]

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Mode : Scan -- Date : 11/27/2016 21:51:08 (Duration : 03:25:10)

¤¤¤ Processes : 1 ¤¤¤

[Suspicious.Path|VT.Unknown] buuigl.dll(3664) -- C:\Users\Blake\AppData\Local\buuigl.dll[-] -> Found

¤¤¤ Registry : 68 ¤¤¤

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Baidu -> Found

[PUP] (X64) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Baidu -> Found

[PUP] (X64) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\IM -> Found

[PUP] (X86) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Baidu -> Found

[PUP] (X86) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\IM -> Found

[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | DailyBee : C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\DailyBee\DailyBee.exe su [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | teklon : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\teklon.dll",teklon [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | dfrang : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\dfrang.dll",dfrang [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | onikfl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\onikfl.dll",onikfl [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\buuigl.dll",buuigl [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | teklon : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\teklon.dll",teklon [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | dfrang : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\dfrang.dll",dfrang [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | onikfl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\onikfl.dll",onikfl [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\buuigl.dll",buuigl [x] -> Found

[Suspicious.Path|VT.Trojan.ProxyAgent] (X64) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\Users\Blake\AppData\Local\buuigl.dll",buuigl [-] -> Found

[Suspicious.Path|VT.Trojan.ProxyAgent] (X86) HKEY_USERS\S-1-5-21-1875098634-3825317018-639482358-1003\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\Users\Blake\AppData\Local\buuigl.dll",buuigl [-] -> Found

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | teklon : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\teklon.dll",teklon [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | dfrang : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\dfrang.dll",dfrang [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | onikfl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\onikfl.dll",onikfl [x] -> Found

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\buuigl.dll",buuigl [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | teklon : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\teklon.dll",teklon [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | dfrang : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\dfrang.dll",dfrang [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | onikfl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\onikfl.dll",onikfl [x] -> Found

[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | buuigl : rundll32.exe "C:\WINDOWS\system32\config\systemprofile\AppData\Local\buuigl.dll",buuigl [x] -> Found

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7763a1c8-fea2-4f70-8457-b97145b6c0a0} | NameServer : 173.244.211.97,8.8.8.8 ([United States][-]) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {29A17836-183C-443D-BBF6-5FFC62E9C13A} : v2.25|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Windows\Temp\mstcs.exe|Name=Promo| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {960BC8CC-BBAD-47C7-803C-50AB14C2A5CD} : v2.25|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Windows\Temp\mstcs.exe|Name=Promo| [x] -> Found

[Suspicious.Path|VT.W32.Application.Opencandy!c] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{0EB44DC9-21C0-4756-AD21-A7E81C24649F}C:\users\blake\appdata\roaming\bittorrent\updates\7.9.6_42095.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\users\blake\appdata\roaming\bittorrent\updates\7.9.6_42095.exe|Name=7.9.6_42095.exe|Desc=7.9.6_42095.exe|Defer=User| [7] -> Found

[Suspicious.Path|VT.W32.Application.Opencandy!c] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{15CCF1CF-5648-4775-B999-47E0E8B99E60}C:\users\blake\appdata\roaming\bittorrent\updates\7.9.6_42095.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\users\blake\appdata\roaming\bittorrent\updates\7.9.6_42095.exe|Name=7.9.6_42095.exe|Desc=7.9.6_42095.exe|Defer=User| [7] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{12185ED8-8AA2-41D6-9B7A-4932360BFABB}C:\users\blake\appdata\roaming\baidu\baiduyunguanjia\baiduyunguanjia.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\users\blake\appdata\roaming\baidu\baiduyunguanjia\baiduyunguanjia.exe|Name=baiduyunguanjia.exe|Desc=baiduyunguanjia.exe|Defer=User| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{3D39E968-791B-4F38-870A-358C28FA269D}C:\users\blake\appdata\roaming\baidu\baiduyunguanjia\baiduyunguanjia.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\users\blake\appdata\roaming\baidu\baiduyunguanjia\baiduyunguanjia.exe|Name=baiduyunguanjia.exe|Desc=baiduyunguanjia.exe|Defer=User| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{93B270A3-39D8-4499-8D63-4EC2B88E7BE6}C:\programdata\electronic arts\need for speed world\data\nfsw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\programdata\electronic arts\need for speed world\data\nfsw.exe|Name=Need for Speed World|Desc=Need for Speed World|Defer=User| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{BC6AE62E-F2A0-4700-B71D-FF66833FB3CD}C:\programdata\electronic arts\need for speed world\data\nfsw.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\programdata\electronic arts\need for speed world\data\nfsw.exe|Name=Need for Speed World|Desc=Need for Speed World|Defer=User| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {441DA88C-3B83-4872-AC66-372128031DC3} : v2.22|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\AppEnable\bin\AppEnable.BRT.Helper.exe|Name=AppEnable.BRT.Helper.exe| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {D82C6936-F437-4106-B214-7CA8801DE6A9} : v2.22|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\AppEnable\bin\AppEnable.BRT.Helper.exe|Name=AppEnable.BRT.Helper.exe| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4806D834-8580-4B7D-9B73-F9863662C678} : v2.22|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\Program Files (x86)\AppEnable\bin\AppEnable.BRT.Helper.exe|Name=AppEnable.BRT.Helper.exe| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {E904E86D-5BF8-400C-8A74-3743C035E9EB} : v2.22|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\Program Files (x86)\AppEnable\bin\AppEnable.BRT.Helper.exe|Name=AppEnable.BRT.Helper.exe| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {84971BA6-4788-46FF-9DB6-E1CD76F62F77} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path|VT.Unknown] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {6C2242C6-BD63-4C28-8553-D466FA272D6D} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\TEMP\fstint.exe|Name=C3506025|Desc=Allow|EmbedCtxt=@C:\WINDOWS\TEMP\fstint.exe,-10000| [-] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {35B561D6-6CD2-4904-BAB9-88A73131D25C} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\3506025.exe|Name=A3506025|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\3506025.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {434B7DED-FD99-44B4-BF16-1AFD4C94BEFC} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B3506025|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {71435D00-CF07-4EC5-989A-DABAA9CFF980} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc69115613.exe|Name=DW3506025|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc69115613.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {7A4B7888-B27C-4D77-A065-86BD28926EA4} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {77E5C860-B955-4C22-931B-A41C67059B9A} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\22339856.exe|Name=A22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\22339856.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {476D1974-6603-469D-90EE-9CE430308E90} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {9093A07F-1683-4B93-9EBE-9F31810688C3} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc46125768.exe|Name=DW22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc46125768.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {613C9FF5-A68E-4801-AFFD-1F4E0944CB7E} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {0752A72D-5F4F-4B41-80A2-3C0CD26BB469} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\22339856.exe|Name=A22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\22339856.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {01E9B08A-4B80-4FF8-892C-4B1ED8BD8B51} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A488BF10-F98A-4B81-A224-B0E7C9504438} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc46125768.exe|Name=DW22339856|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc46125768.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {611158BB-9541-4F25-90D9-E07AB125B312} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {A8EAACC2-ECEC-453D-9D4E-2574F8ED6142} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\56318161.exe|Name=A56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\56318161.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {6328077B-F553-42E5-837B-5053BBAD9D3E} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {3708FEED-7DB1-4304-86E2-FE88DA79802F} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc47756331.exe|Name=DW56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc47756331.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {88BC8513-DAEC-42F1-8133-1CE74C73DF5A} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {64CE341F-23FD-4FDF-B8A4-964B78E20B75} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\56318161.exe|Name=A56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\56318161.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {887C4086-9285-440C-B941-58C21225EC24} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {B3ADEBA3-49F9-4A29-A790-DE2C189028F2} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc47756331.exe|Name=DW56318161|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc47756331.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {8960111B-DB8E-4E06-BDFE-FF1D6169A876} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {6726CF5A-C401-41B7-B298-ACA9D443A71E} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\68775226.exe|Name=A68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\68775226.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {DE2F73FD-4527-4BAF-AE4C-9150C0F19821} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {82B0F3DD-92E9-4439-8246-3DC1ED0474B8} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc87246709.exe|Name=DW68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc87246709.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {5EC9A9FD-965E-4C1D-92F2-E9992987FCFE} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe|Name=ddnowyes|Desc=Allow internet|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\ddnowyes.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {80E45250-81CA-4942-80C8-EFDDDF433FFE} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\68775226.exe|Name=A68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\68775226.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {6BA9CA4E-B02A-4990-8967-6DF0B6EF2AC1} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe|Name=B68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\tinstall.exe,-10000| [x] -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {AED31B80-BF03-4022-AB39-724679582A47} : v2.26|Action=Allow|Active=TRUE|Dir=Out|App=C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc87246709.exe|Name=DW68775226|Desc=Allow|EmbedCtxt=@C:\WINDOWS\system32\config\systemprofile\AppData\Local\sc87246709.exe,-10000| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {791E8F95-C7A3-4086-9550-247AEB58D247} : v2.26|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe|Name=Itibiti.exe| [x] -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {38C3F0D3-1197-4C58-AA69-843153F5605C} : v2.26|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe|Name=Itibiti.exe| [x] -> Found

¤¤¤ Tasks : 2 ¤¤¤

[Suspicious.Path|VT.UDS:DangerousObject.Multi.Generic] \IntelMemoryDiagnostic -- "C:\Users\Blake\AppData\Roaming\d3dx10.exe" -> Found

[Suspicious.Path] \nzwupdxtep -- C:\WINDOWS\system32\config\systemprofile\AppData\Local\Sao-Stock (/t 3952 6198) -> Found

¤¤¤ Files : 3 ¤¤¤

[Root.Wajam][File] C:\Windows\System32\drivers\1aba884a9bc34fe898a044cb5e348150.sys -> Found

[Root.Wajam][Folder] C:\Program Files\4949ca9a4e858a3f60be51795162382c -> Found

[PUP.Amonetize][File] C:\Program Files\BitTorrent\BitTorrent.exe -> Found

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤

[PUP][Firefox:Addon] t718w6ni.default : New Tab by Yahoo [jid1-G80Ec8LLEbK5fQ@jetpack] -> Found

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: TOSHIBA DT01ACA200 SATA Disk Device +++++

--- User ---

[MBR] 0086f36f0b7bc8b257f89fc226376c3d

[BSP] 9e3b3c473b1db0daa516427cdae6e1cc : Windows Vista/7/8 MBR Code

Partition table:

0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 300 MB

1 - [MAN-MOUNT] EFI system partition | Offset (sectors): 616448 | Size: 99 MB

2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 819200 | Size: 128 MB

3 - Basic data partition | Offset (sectors): 1081344 | Size: 1906750 MB

4 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 3906105344 | Size: 450 MB

User = LL1 ... OK

User = LL2 ... OK

not sure why the spoiler isn't working right.

Edited by Blakesr17, 28 November 2016 - 08:01 AM.

Back to top

#4 TazzyOpz

Members
100 posts
OFFLINE

Gender:Male
Local time:05:00 PM

Posted 28 November 2016 - 10:50 AM

Remove what both have found. I See RK picked up Bit-torrent. You can deselect that if you're using that obviously or let it remove what it needs and you can re-install it after. However it looks like it has picked up a pretty big portion of your infection. After the removal let me know if it's running any better. And we will go from there.

I.T Field Technician
C#, .Net, and Python.
Head Developer of NoBot est. 2015

Back to top

#5 Blakesr17

Topic Starter

Members
4 posts
OFFLINE

Local time:02:00 PM

Posted 28 November 2016 - 10:57 AM

I feel dumb for making this mistake. I was getting prepared to delete all the viruses and accidentally selected unselect all and only select 1 to be removed. Now I can't find out how to get into the window to delete them all.

(from roguekiller)

[Edit]: I have noticed one big thing that has been fixed since i did AdwCleaner. My internet is like 100% faster. When it took 3 hours to download a 3.5 gb game, it now takes about 30min.

Edited by Blakesr17, 28 November 2016 - 11:37 AM.

Back to top

#6 TazzyOpz

Members
100 posts
OFFLINE

Gender:Male
Local time:05:00 PM

Posted 28 November 2016 - 12:46 PM

I feel dumb for making this mistake. I was getting prepared to delete all the viruses and accidentally selected unselect all and only select 1 to be removed. Now I can't find out how to get into the window to delete them all.

(from roguekiller)

[Edit]: I have noticed one big thing that has been fixed since i did AdwCleaner. My internet is like 100% faster. When it took 3 hours to download a 3.5 gb game, it now takes about 30min.

Just run the Roguekiller scan against. It should pickup the files that are remaining.

I.T Field Technician
C#, .Net, and Python.
Head Developer of NoBot est. 2015

Back to top

#7 Blakesr17

Topic Starter

Members
4 posts
OFFLINE

Local time:02:00 PM

Posted 29 November 2016 - 04:11 PM

Alright, sorry for the long wait. School happened and I had to deal with that First. I reran Rogue Killer and got rid of the viruses it found. which were practically the same as before.