What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I think I'm infected [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17 last edited
It happened from time to time and my wife had to reset the router at home. That workaround worked for several months. Probably a couple of weeks ago (i can't remember the exact date) it stopped working. Si I started suspecting about virus activity in the laptop By the way, I just noticed that some parts of the logs are in Spanish. Please let me know if you want me to translate some of this.
Post #18
Hi, Ok….are you only experiencing problems on this computer with wireless internet? Are you able to connect normally with a hard wire connection? If you have not tried please do so and let me know how it is working.
Post #19
Hi, yes this is the only computer experiencing problems, I have tried hard wired (as well I tried with a TP-Link wireless card) and it hasn't worked
Post #20
Let me look over this a bit and I will return as quickly as I can. We may need to use a System Restore Point before you noticed this all started happening. It would be a good idea to start and save any files, pictures, music that you might like to keep just in case. :)
Post #21
One quick question: Is the system restore just a last resort to get the Internet up and running again? If so then i could try reinstalling the drivers again to see if it bring it back to work one more time… I'm ok if I have to format/rebuild the whole thing but what if MBR is infected… In the meantime I'm backing up the files I need to save
Post #22

Is the system restore just a last resort to get the Internet up and running again?

Yes.

If so then i could try reinstalling the drivers again to see if it bring it back to work one more time… I'm ok if I have to format/rebuild the whole thing but what if MBR is infected…

The MBR does not look like it is infected from what I have seen so far. You could definitely try reinstalling the drivers as that is what it looks like it might be. Go ahead and give that a try and see if that fixes your internet problem.
Post #23 last edited
Ok system restored, Network is working for now. Do you want me to run aswMBR? Edit: I'm pretty sure there is some virus. After downloading and updating aswMBR the internet connection went down again :scratch: so internet is not working now….
Post #24
FRST

Download Farbar Recovery Scan Tool64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

———-
Post #25 last edited
So here is what happened: Before network going down Windows managed to download the latest patches (I restored the computer to a point back in mid-July before 2 critical updates). So this morning when I turned it on (prior to reading your post) all of those patches where installed. I let it continue and after a second reboot internet came back. I downloaded again malware bytes and removed the original threat that was found in a .exe file (PUP.OfferBundler.ST) rebooted again and internet continues working. After that I downloaded the latest network & video drivers from Dell website, updated those, rebooted and internet is still working, so it seems like the Internet issue is solved. Now we can focus on validating if the system is virus free I guess. Let me know if you still want to perform the FRST procedure Cheers Hc
Post #27
FRST log: Scan result of Farbar Recovery Scan Tool Version: 31-08-2012 01 Ran by [removed] at 31-08-2012 14:42:41 Running from E:\Whatthtech Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-25] (IDT, Inc.) HKLM\…\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.) HKLM\…\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-21] (Dell Inc.) HKLM\…\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-12-17] (Intel® Corporation) HKLM\…\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" –startup [483424 2012-02-01] () HKLM\…\Run: [BLEServicesCtrl] C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation) HKLM\…\Run: [BTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [11407120 2012-03-27] (Intel Corporation) HKLM-x32\…\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [503942 2011-04-13] (Creative Technology Ltd) HKLM-x32\…\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation) HKLM-x32\…\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\…\Run: [] [x] HKLM-x32\…\Run: [RoxWatchTray] "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions) HKLM-x32\…\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] () HKLM-x32\…\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1675160 2012-03-21] (McAfee, Inc.) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2011-09-05] (Adobe Systems Incorporated) HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-03-30] (Adobe Systems Incorporated) HKLM-x32\…\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.) HKLM-x32\…\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-10-09] (Apple Inc.) HKLM-x32\…\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.) HKLM-x32\…\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-09-01] (Research In Motion Limited) HKLM-x32\…\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard) HKLM-x32\…\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup [2835443 2012-02-01] () HKLM-x32\…\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1391272 2012-01-03] (Ask) HKLM-x32\…\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.) HKU\Patty\…\Run: [Google Update] "C:\Users\Patty\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-07-30] (Google Inc.) HKU\Patty\…\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4280184 2012-03-08] (Microsoft Corporation) HKU\Patty\…\Run: [Facebook Update] "C:\Users\Patty\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [137536 2012-07-02] (Facebook Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ==================== Services (Whitelisted) ====== 2 Bluetooth Device Monitor; "C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe" [1014096 2012-03-27] (Intel Corporation) 3 Bluetooth Media Service; "C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe" [1304912 2012-03-27] (Intel Corporation) 2 Bluetooth OBEX Service; "C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe" [1104208 2012-03-27] (Intel Corporation) 3 McAWFwk; C:\PROGRA~1\mcafee\msc\mcawfwk.exe [220528 2010-08-30] (McAfee, Inc.) 2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 mcmscsvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McNaiAnn; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McNASvc; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 3 McODS; "C:\Program Files\mcafee\VirusScan\mcods.exe" [502064 2012-08-23] (McAfee, Inc.) 4 McOobeSv; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McProxy; "C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [199272 2012-03-20] (McAfee, Inc.) 2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [210584 2012-03-20] (McAfee, Inc.) 2 mfevtp; "C:\Windows\system32\mfevtps.exe" [162192 2012-03-20] (McAfee, Inc.) 2 MSK80Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] () ==================== Drivers (Whitelisted) =================== 3 cfwids; C:\Windows\System32\Drivers\cfwids.sys [65264 2012-02-22] (McAfee, Inc.) 3 mfeapfk; C:\Windows\System32\Drivers\mfeapfk.sys [160792 2012-02-22] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\Drivers\mfeavfk.sys [229528 2012-02-22] (McAfee, Inc.) 3 mfefirek; C:\Windows\System32\Drivers\mfefirek.sys [487296 2012-02-22] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.) 1 mfenlfk; C:\Windows\System32\Drivers\mfenlfk.sys [75936 2012-02-22] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\Drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.) 0 mfewfpk; C:\Windows\System32\Drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.) 0 pavboot; C:\Windows\System32\drivers\pavboot64.sys [33800 2009-06-30] (Panda Security, S.L.) 3 mfeavfk01; [x] ==================== NetSvcs (Whitelisted) ================= ==================== One Month Created Files and Folders ====================== 2012-08-31 09:51 - 2012-08-31 09:51 - 00000000 ____D C:\Program Files (x86)\AMD APP 2012-08-31 09:50 - 2012-08-31 09:50 - 00000000 ____D C:\Program Files\ATI Technologies 2012-08-31 09:50 - 2012-08-31 09:50 - 00000000 ____D C:\Program Files\ATI 2012-08-31 09:47 - 2011-08-23 03:12 - 00317440 ____A (Intel® Corporation) C:\Windows\System32\Drivers\IntcDAud.sys 2012-08-31 09:47 - 2011-08-23 03:12 - 00014848 ____A (Intel® Corporation) C:\Windows\System32\IntcDAuC.dll 2012-08-31 09:32 - 2012-08-31 09:46 - 336018312 ____A C:\Users\Hector\Downloads\Video_ATI_W7_A10_Setup-G22HG_ZPE.exe 2012-08-31 09:31 - 2012-08-31 09:34 - 48779808 ____A C:\Users\Hector\Downloads\BT_Intel_W74_A02_Setup-50PWW_ZPE.exe 2012-08-31 09:22 - 2012-08-31 09:22 - 00000000 ____D C:\Program Files (x86)\Ask.com 2012-08-31 09:12 - 2012-08-31 09:12 - 00000000 ____D C:\Users\All Users\Ask 2012-08-31 09:12 - 2012-08-31 09:12 - 00000000 ____D C:\Users\All Users\Application Data\Ask 2012-08-31 09:11 - 2012-08-31 09:11 - 00477168 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll 2012-08-31 09:11 - 2012-08-31 09:11 - 00157680 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe 2012-08-31 09:11 - 2012-08-31 09:11 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe 2012-08-31 09:11 - 2012-08-31 09:11 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe 2012-08-31 08:52 - 2012-08-31 08:52 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-31 08:52 - 2012-08-31 08:52 - 00001111 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-31 08:51 - 2012-07-03 13:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-08-31 08:50 - 2012-08-31 08:50 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Hector\Downloads\mbam-setup-1.62.0.1300.exe 2012-08-31 08:38 - 2012-06-28 22:56 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-08-31 08:38 - 2012-06-28 22:49 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-08-31 08:38 - 2012-06-28 22:49 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-08-31 08:38 - 2012-06-28 22:48 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-08-31 08:38 - 2012-06-28 22:47 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-08-31 08:38 - 2012-06-28 22:43 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-08-31 08:38 - 2012-06-28 22:42 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-08-31 08:38 - 2012-06-28 22:40 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-08-31 08:38 - 2012-06-28 22:39 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-08-31 08:38 - 2012-06-28 22:35 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-08-31 08:38 - 2012-06-28 19:09 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-08-31 08:38 - 2012-06-28 19:09 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-08-31 08:38 - 2012-06-28 19:08 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-08-31 08:38 - 2012-06-28 19:07 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-08-31 08:38 - 2012-06-28 19:04 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-08-31 08:38 - 2012-06-28 19:01 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-08-31 08:38 - 2012-06-28 19:01 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-08-31 08:38 - 2012-06-28 19:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-08-31 08:38 - 2012-06-28 18:57 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-08-31 08:37 - 2012-06-28 23:55 - 17809920 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-08-31 08:37 - 2012-06-28 23:09 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-08-31 08:37 - 2012-06-28 22:45 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-08-31 08:37 - 2012-06-28 22:44 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-08-31 08:37 - 2012-06-28 19:52 - 12317184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-08-31 08:37 - 2012-06-28 19:27 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-08-31 08:37 - 2012-06-28 19:16 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-08-31 08:37 - 2012-06-28 19:06 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-08-31 08:37 - 2012-06-28 19:04 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-08-31 08:36 - 2012-06-09 00:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-08-31 08:36 - 2012-06-08 23:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-08-31 08:36 - 2012-06-06 01:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-08-31 08:36 - 2012-06-06 01:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-08-31 08:36 - 2012-06-06 00:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2012-08-31 08:36 - 2012-06-06 00:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2012-08-31 08:36 - 2012-06-02 00:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-08-31 08:36 - 2012-06-02 00:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-08-31 08:36 - 2012-06-02 00:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys 2012-08-31 08:36 - 2012-06-02 00:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-08-31 08:36 - 2012-06-02 00:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2012-08-31 08:36 - 2012-06-01 23:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2012-08-31 08:36 - 2012-06-01 23:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2012-08-31 08:36 - 2012-06-01 23:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2012-08-31 08:36 - 2012-06-01 23:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2012-08-31 08:36 - 2012-05-05 03:36 - 00503808 ____A (Microsoft Corporation) C:\Windows\System32\srcore.dll 2012-08-31 08:36 - 2012-05-05 02:46 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2012-08-31 08:36 - 2012-02-11 01:43 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2012-08-31 08:36 - 2012-02-11 01:36 - 00559104 ____A (Microsoft Corporation) C:\Windows\System32\spoolsv.exe 2012-08-31 08:36 - 2012-02-11 01:36 - 00067072 ____A (Microsoft Corporation) C:\Windows\splwow64.exe 2012-08-31 08:36 - 2012-02-11 00:43 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2012-08-31 08:36 - 2010-06-25 22:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll 2012-08-31 08:36 - 2010-06-25 22:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2012-08-30 22:42 - 2012-07-06 15:07 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys 2012-08-30 16:07 - 2012-07-18 13:15 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-08-30 16:07 - 2012-07-04 17:16 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll 2012-08-30 16:07 - 2012-07-04 17:13 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll 2012-08-30 16:07 - 2012-07-04 17:13 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll 2012-08-30 16:07 - 2012-07-04 16:16 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll 2012-08-30 16:07 - 2012-07-04 16:14 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll 2012-08-30 16:07 - 2012-05-14 00:26 - 00956928 ____A (Microsoft Corporation) C:\Windows\System32\localspl.dll 2012-08-30 16:06 - 2012-06-06 01:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll 2012-08-30 16:06 - 2012-06-06 00:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll 2012-08-30 16:05 - 2012-08-30 16:05 - 04731392 ____A (AVAST Software) C:\Users\Hector\Downloads\aswMBR.exe 2012-08-30 16:00 - 2012-08-30 16:00 - 00000000 ____D C:\Users\Hector\AppData\Roaming\Mozilla 2012-08-30 16:00 - 2012-08-30 16:00 - 00000000 ____D C:\Users\Hector\AppData\Local\Mozilla 2012-08-30 15:59 - 2012-08-30 16:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2012-08-30 15:59 - 2012-08-30 15:59 - 00001132 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2012-08-30 15:59 - 2012-08-30 15:59 - 00001132 ____A C:\Users\All Users\Desktop\Mozilla Firefox.lnk 2012-08-30 15:59 - 2012-08-30 15:59 - 00000000 ____D C:\Users\All Users\Mozilla 2012-08-30 15:59 - 2012-08-30 15:59 - 00000000 ____D C:\Users\All Users\Application Data\Mozilla 2012-08-30 15:59 - 2012-08-30 15:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2012-08-30 15:19 - 2012-08-30 15:19 - 00000000 ____D C:\Users\Patty\AppData\Local\{35FC6AA5-63B7-4C13-9B83-CE103DF4274D} 2012-08-29 21:25 - 2012-08-29 21:27 - 00031017 ____A C:\Users\Hector\Desktop\Result.txt 2012-08-29 16:18 - 2012-08-29 16:18 - 00020811 ____A C:\ComboFix.txt 2012-08-29 15:34 - 2000-08-30 19:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-08-29 15:20 - 2012-08-30 15:50 - 00000000 ____D C:\Windows\erdnt 2012-08-29 15:20 - 2012-08-29 16:18 - 00000000 ____D C:\Qoobox 2012-08-29 12:50 - 2012-08-29 12:51 - 00002549 ____A C:\Users\Hector\Desktop\FSS.txt 2012-08-28 19:41 - 2012-08-28 19:41 - 00023580 ____A C:\Users\Hector\Desktop\DDS.txt 2012-08-28 19:40 - 2012-08-28 19:40 - 00014588 ____A C:\Users\Hector\Desktop\Attach.txt 2012-08-28 19:35 - 2012-08-30 15:50 - 00000000 ____D C:\Users\Hector\Desktop\tdsskiller 2012-08-28 19:35 - 2012-08-28 17:05 - 02193184 ____A C:\Users\Hector\Desktop\tdsskiller.zip 2012-08-28 18:56 - 2012-08-28 18:56 - 00028665 ____A C:\Users\Hector\Desktop\hijackthis.log 2012-08-28 18:53 - 2012-08-28 18:54 - 00115356 ____A C:\Users\Hector\Desktop\OTL.Txt 2012-08-28 18:53 - 2012-08-28 18:53 - 00062868 ____A C:\Users\Hector\Desktop\Extras.Txt 2012-08-28 17:18 - 2012-08-31 08:52 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-08-28 17:18 - 2012-08-28 17:18 - 00000000 ____D C:\Users\Hector\AppData\Roaming\Malwarebytes 2012-08-28 17:18 - 2012-08-28 17:18 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-08-28 17:18 - 2012-08-28 17:18 - 00000000 ____D C:\Users\All Users\Application Data\Malwarebytes 2012-08-28 17:10 - 2012-08-28 17:10 - 00000000 ____D C:\Users\Hector\AppData\Roaming\addpcs 2012-08-26 20:29 - 2012-08-26 20:29 - 00000000 ____D C:\Users\Patty\AppData\Local\{ABF57650-E3B8-49E0-B1E8-1A75C646B5CE} 2012-08-26 09:44 - 2012-08-30 16:01 - 00000000 ____D C:\Users\Hector\AppData\Roaming\HpUpdate 2012-08-24 15:44 - 2012-08-24 15:44 - 00000000 ____D C:\Users\Patty\AppData\Local\{F341577E-A8C3-48EE-A2B4-28EFA1F00979} 2012-08-23 15:25 - 2012-08-23 15:25 - 00000000 ____D C:\Users\Patty\AppData\Local\{55030080-4A4F-4C12-AAEB-2421244B0C1B} 2012-08-22 10:20 - 2012-08-22 10:20 - 00000000 ____D C:\Users\Patty\AppData\Local\{3C789C6D-8720-4667-91A4-9BCA98BBBD11} 2012-08-22 09:34 - 2012-08-22 09:34 - 00000000 ____D C:\Users\Patty\AppData\Local\{365AA98E-39A1-41B2-9DB1-C6F6D059D660} 2012-08-21 17:36 - 2012-08-21 17:36 - 00000000 ____D C:\Users\Patty\AppData\Local\{81FC8E72-92B8-4771-B9CB-0D5BB29CECB9} 2012-08-21 17:17 - 2012-08-21 17:17 - 00000000 ____D C:\Users\Patty\AppData\Local\{368E7A58-6AB2-4829-A3E0-3B66FA1D351E} 2012-08-21 17:05 - 2012-08-21 17:05 - 00000000 ____D C:\Users\Patty\AppData\Local\{49B30656-1953-4308-9B7D-BB1087F1E6C3} 2012-08-21 16:40 - 2012-08-21 16:40 - 00000000 ____D C:\Users\Patty\AppData\Local\{500D5BA0-F8A8-4157-B539-560B41699AF7} 2012-08-21 10:40 - 2012-08-21 10:40 - 00000000 ____D C:\Users\Patty\AppData\Local\{D45FF0D8-8ABC-4C8A-AAA6-2FD13A405F24} 2012-08-21 09:35 - 2012-08-21 09:35 - 00000000 ____D C:\Users\Patty\AppData\Local\{3A7E931A-16D8-4421-A6C1-85B4A7266CC7} 2012-08-21 09:24 - 2012-08-21 09:24 - 00000000 ____D C:\Users\Patty\AppData\Local\{E1D325B1-F8AB-4BF4-9AD8-0C88C41E74AE} 2012-08-20 10:23 - 2012-08-20 10:23 - 00000000 ____D C:\Users\Patty\AppData\Local\{12537520-5549-42AC-8AC1-0120DA1DA58D} 2012-08-18 12:22 - 2012-08-18 12:22 - 00000000 ____D C:\Users\Patty\AppData\Local\{90EB0F8D-0124-4C4C-BB23-AE04BB31C2D5} 2012-08-18 12:22 - 2012-08-18 12:22 - 00000000 ____D C:\Users\Patty\AppData\Local\{54D0C5C7-C358-4805-B8BB-C365E3402D2F} 2012-08-17 09:39 - 2012-08-17 09:39 - 00000000 ____D C:\Users\Patty\AppData\Local\{745BD514-D4D5-4426-8761-FF975BC00BE1} 2012-08-17 09:38 - 2012-08-17 09:39 - 00000000 ____D C:\Users\Patty\AppData\Local\{528F9DC0-00A3-4210-9F6D-AC034968335A} 2012-08-16 09:00 - 2012-08-16 09:00 - 00000000 ____D C:\Users\Patty\AppData\Local\{6965503B-3A1E-403C-B084-2045195E9A4F} 2012-08-16 08:59 - 2012-08-16 09:00 - 00000000 ____D C:\Users\Patty\AppData\Local\{E98AF85E-A4A5-4152-82A4-F6207AC83252} 2012-08-15 13:37 - 2012-08-15 13:37 - 00042620 ____A C:\Users\Patty\Desktop\Tratamientos Derma.txt 2012-08-15 10:25 - 2012-08-15 10:25 - 00000000 ____D C:\Users\Patty\Desktop\ROBERTO ESTRADA 2012-08-15 09:07 - 2012-08-15 09:07 - 00000000 ____D C:\Users\Patty\AppData\Local\{3C751E42-EDDB-4D78-BDAA-306FE219B9EB} 2012-08-15 09:07 - 2012-08-15 09:07 - 00000000 ____D C:\Users\Patty\AppData\Local\{0035CE11-1927-4F3C-BAD6-0777B8F212D9} 2012-08-11 09:09 - 2012-08-11 09:09 - 00000000 ____D C:\Users\Patty\AppData\Local\{1A25A5BE-1BFF-4A6D-BF6F-A9150E3DBBD5} 2012-08-11 09:08 - 2012-08-11 09:09 - 00000000 ____D C:\Users\Patty\AppData\Local\{9D423B74-E149-48BB-BE57-F2585AD42F8C} 2012-08-11 09:08 - 2012-08-11 09:08 - 00000000 ____D C:\Users\Patty\AppData\Roaming\Real 2012-08-03 21:34 - 2012-08-30 15:51 - 00000000 ____D C:\Program Files (x86)\SopCast 2012-08-03 21:32 - 2012-08-03 21:32 - 00000000 ____D C:\Users\Hector\AppData\Local\Google 2012-08-03 21:32 - 2012-08-03 21:32 - 00000000 ____D C:\Program Files\Google 2012-08-03 21:31 - 2012-08-30 15:51 - 00000000 ____D C:\Program Files (x86)\Real 2012-08-03 21:31 - 2012-08-03 21:33 - 00000000 ____D C:\Users\Hector\AppData\Roaming\Real 2012-08-03 21:31 - 2012-08-03 21:32 - 00000000 ____D C:\Users\All Users\Google 2012-08-03 21:31 - 2012-08-03 21:32 - 00000000 ____D C:\Users\All Users\Application Data\Google 2012-08-03 21:31 - 2012-08-03 21:32 - 00000000 ____D C:\Program Files (x86)\Google 2012-08-03 21:30 - 2012-08-03 21:33 - 00000000 ____D C:\Users\All Users\Real 2012-08-03 21:30 - 2012-08-03 21:33 - 00000000 ____D C:\Users\All Users\Application Data\Real 2012-08-02 08:02 - 2012-08-02 08:02 - 00000000 ____D C:\Users\Patty\AppData\Local\{BA92C54D-810C-4AA3-A27B-93D7A725D673} 2012-08-02 08:02 - 2012-08-02 08:02 - 00000000 ____D C:\Users\Patty\AppData\Local\{1E3AAB94-112B-4BA8-8EC5-337F6CF1FEE5} ==================== 3 Months Modified Files ================================ 2012-08-31 14:35 - 2011-07-22 15:46 - 01528120 ____A C:\Windows\WindowsUpdate.log 2012-08-31 13:42 - 2011-07-30 15:58 - 00001046 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-770254171-4196784553-780507908-1001UA.job 2012-08-31 13:14 - 2012-07-02 22:09 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-770254171-4196784553-780507908-1001UA.job 2012-08-31 10:02 - 2009-07-13 23:45 - 00020928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-08-31 10:02 - 2009-07-13 23:45 - 00020928 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-08-31 10:00 - 2011-07-22 18:38 - 00760998 ____A C:\Windows\System32\perfh00A.dat 2012-08-31 10:00 - 2011-07-22 18:38 - 00163374 ____A C:\Windows\System32\perfc00A.dat 2012-08-31 10:00 - 2009-07-14 00:13 - 01702308 ____A C:\Windows\System32\PerfStringBackup.INI 2012-08-31 09:54 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-08-31 09:54 - 2009-07-13 23:51 - 00065229 ____A C:\Windows\setupact.log 2012-08-31 09:46 - 2012-08-31 09:32 - 336018312 ____A C:\Users\Hector\Downloads\Video_ATI_W7_A10_Setup-G22HG_ZPE.exe 2012-08-31 09:41 - 2011-07-22 16:23 - 00023510 ____A C:\Windows\DPINST.LOG 2012-08-31 09:34 - 2012-08-31 09:31 - 48779808 ____A C:\Users\Hector\Downloads\BT_Intel_W74_A02_Setup-50PWW_ZPE.exe 2012-08-31 09:11 - 2012-08-31 09:11 - 00477168 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll 2012-08-31 09:11 - 2012-08-31 09:11 - 00157680 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe 2012-08-31 09:11 - 2012-08-31 09:11 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe 2012-08-31 09:11 - 2012-08-31 09:11 - 00149488 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe 2012-08-31 09:11 - 2011-07-30 15:55 - 00473072 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll 2012-08-31 09:00 - 2010-11-20 22:47 - 00032130 ____A C:\Windows\PFRO.log 2012-08-31 08:52 - 2012-08-31 08:52 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-31 08:52 - 2012-08-31 08:52 - 00001111 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2012-08-31 08:50 - 2012-08-31 08:50 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Hector\Downloads\mbam-setup-1.62.0.1300.exe 2012-08-31 08:44 - 2009-07-13 23:45 - 00349216 ____A C:\Windows\System32\FNTCACHE.DAT 2012-08-30 22:14 - 2012-07-02 22:09 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-770254171-4196784553-780507908-1001Core.job 2012-08-30 16:05 - 2012-08-30 16:05 - 04731392 ____A (AVAST Software) C:\Users\Hector\Downloads\aswMBR.exe 2012-08-30 15:59 - 2012-08-30 15:59 - 00001132 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2012-08-30 15:59 - 2012-08-30 15:59 - 00001132 ____A C:\Users\All Users\Desktop\Mozilla Firefox.lnk 2012-08-29 21:27 - 2012-08-29 21:25 - 00031017 ____A C:\Users\Hector\Desktop\Result.txt 2012-08-29 16:18 - 2012-08-29 16:18 - 00020811 ____A C:\ComboFix.txt 2012-08-29 12:51 - 2012-08-29 12:50 - 00002549 ____A C:\Users\Hector\Desktop\FSS.txt 2012-08-28 19:41 - 2012-08-28 19:41 - 00023580 ____A C:\Users\Hector\Desktop\DDS.txt 2012-08-28 19:40 - 2012-08-28 19:40 - 00014588 ____A C:\Users\Hector\Desktop\Attach.txt 2012-08-28 18:56 - 2012-08-28 18:56 - 00028665 ____A C:\Users\Hector\Desktop\hijackthis.log 2012-08-28 18:54 - 2012-08-28 18:53 - 00115356 ____A C:\Users\Hector\Desktop\OTL.Txt 2012-08-28 18:53 - 2012-08-28 18:53 - 00062868 ____A C:\Users\Hector\Desktop\Extras.Txt 2012-08-28 17:05 - 2012-08-28 19:35 - 02193184 ____A C:\Users\Hector\Desktop\tdsskiller.zip 2012-08-15 13:37 - 2012-08-15 13:37 - 00042620 ____A C:\Users\Patty\Desktop\Tratamientos Derma.txt 2012-08-03 21:23 - 2011-08-07 18:05 - 00080920 ____A C:\Users\Hector\AppData\Local\GDIPFONTCACHEV1.DAT 2012-08-03 04:27 - 2012-01-04 15:11 - 62134624 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-07-18 13:15 - 2012-08-30 16:07 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-07-06 15:07 - 2012-08-30 22:42 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys 2012-07-04 17:16 - 2012-08-30 16:07 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll 2012-07-04 17:13 - 2012-08-30 16:07 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll 2012-07-04 17:13 - 2012-08-30 16:07 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll 2012-07-04 16:16 - 2012-08-30 16:07 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll 2012-07-04 16:14 - 2012-08-30 16:07 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll 2012-07-03 13:46 - 2012-08-31 08:51 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-07-02 23:42 - 2011-07-30 15:58 - 00000994 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-770254171-4196784553-780507908-1001Core.job 2012-07-02 22:09 - 2012-07-02 22:09 - 00493520 ____A (Facebook Inc.) C:\Users\Patty\Downloads\FacebookVideoCallSetup_v1.2.203.0.exe 2012-07-02 21:56 - 2011-07-30 15:59 - 00002401 ____A C:\Users\Patty\Desktop\Google Chrome.lnk 2012-06-28 23:55 - 2012-08-31 08:37 - 17809920 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-06-28 23:09 - 2012-08-31 08:37 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-06-28 22:56 - 2012-08-31 08:38 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-06-28 22:49 - 2012-08-31 08:38 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-06-28 22:49 - 2012-08-31 08:38 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-06-28 22:48 - 2012-08-31 08:38 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-06-28 22:47 - 2012-08-31 08:38 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-06-28 22:45 - 2012-08-31 08:37 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-06-28 22:44 - 2012-08-31 08:37 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-06-28 22:43 - 2012-08-31 08:38 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-06-28 22:42 - 2012-08-31 08:38 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-06-28 22:40 - 2012-08-31 08:38 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-06-28 22:39 - 2012-08-31 08:38 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-06-28 22:35 - 2012-08-31 08:38 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-06-28 19:52 - 2012-08-31 08:37 - 12317184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-06-28 19:27 - 2012-08-31 08:37 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-06-28 19:16 - 2012-08-31 08:37 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-06-28 19:09 - 2012-08-31 08:38 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-06-28 19:09 - 2012-08-31 08:38 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-06-28 19:08 - 2012-08-31 08:38 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-06-28 19:07 - 2012-08-31 08:38 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-06-28 19:06 - 2012-08-31 08:37 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-06-28 19:04 - 2012-08-31 08:38 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-06-28 19:04 - 2012-08-31 08:37 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-06-28 19:01 - 2012-08-31 08:38 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-06-28 19:01 - 2012-08-31 08:38 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-06-28 19:00 - 2012-08-31 08:38 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-06-28 18:57 - 2012-08-31 08:38 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-06-09 00:43 - 2012-08-31 08:36 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2012-06-08 23:41 - 2012-08-31 08:36 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2012-06-06 01:06 - 2012-08-31 08:36 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2012-06-06 01:06 - 2012-08-31 08:36 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2012-06-06 01:02 - 2012-08-30 16:06 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll 2012-06-06 00:05 - 2012-08-31 08:36 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2012-06-06 00:05 - 2012-08-31 08:36 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2012-06-06 00:03 - 2012-08-30 16:06 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll 2012-06-04 18:07 - 2012-02-12 21:55 - 00000231 ____A C:\Users\Patty\AppData\Roaming\Rim.DesktopHelper.Exception.log 2012-06-04 18:07 - 2012-02-12 21:55 - 00000231 ____A C:\Users\Patty\AppData\Roaming\Rim.Desktop.Exception.log ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2012-08-26 10:24:47 Restore point made on: 2012-08-28 18:48:58 Restore point made on: 2012-08-30 15:40:01 Restore point made on: 2012-08-30 22:33:43 Restore point made on: 2012-08-31 08:37:46 Restore point made on: 2012-08-31 09:10:27 Restore point made on: 2012-08-31 09:11:53 Restore point made on: 2012-08-31 09:38:01 ==================== Memory info =========================== Percentage of memory in use: 25% Total physical RAM: 2979.18 MB Available physical RAM: 2232.67 MB Total Pagefile: 2977.38 MB Available Pagefile: 2223.04 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ==================== Partitions ============================ 1 Drive c: (OS) (Fixed) (Total:283.34 GB) (Free:237.47 GB) NTFS 3 Drive e: () (Removable) (Total:0.47 GB) (Free:0.4 GB) FAT 4 Drive f: (Recovery) (Fixed) (Total:14.65 GB) (Free:6.8 GB) NTFS ==>[System with boot components (obtained from reading drive)] 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS N£m Disco Estado Tama¤o Disp Din Gpt ———- ———- ——- ——- — — Disco 0 En l¡nea 298 GB 0 B Disco 1 En l¡nea 480 MB 0 B Saliendo de DiskPart… Last Boot: 2012-08-28 18:26 ==================== End Of Log =============================
Post #28
Ok….

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #29
Malware bytes: Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.31.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Hector :: PATTY-PC [administrator] 31/08/2012 02:59:41 p.m. mbam-log-2012-08-31 (14-59-41).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 218963 Time elapsed: 5 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI