What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Removing Startpins [Closed]

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Right. I have StartPins on my computer. I've only noticed it on Firefox, but then again, that's the only browser I use. I have installed AdAware, but that hasn't done anything. Here's my system: Windows 7 SP1 64-bit AMD Phenom II Quad-Core NVIDIA GeForce 560ti 8gb RAM
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #3
This is what I get back from DDS. DDS (Ver_2012-10-19.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_30 Run by [removed] at 16:54:19 on 2012-10-23 #Option Extended Search is enabled. Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.8191.6212 [GMT 1:00] . AV: Lavasoft Ad-Aware *Disabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800} SP: Lavasoft Ad-Aware *Disabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Program Files (x86)\SimracewayUpdater\SRWUpdate.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\Windows\System32\alg.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\wbem\unsecapp.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Windows\system32\wuauclt.exe C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe C:\Windows\system32\conhost.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\conhost.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.co.uk/ uWindow Title = Microsoft Internet Explorer provided by Wanadoo uDefault_Page_URL = hxxp://www.pcspecialist.co.uk/ mStart Page = hxxp://search.privitize.com/?aff=7 uURLSearchHooks: SearchHook Class: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: AP Suggestor: {D0984FD4-FA9A-46ee-9072-70B0735FF852} - C:\Program Files (x86)\AP Suggestor\APSuggestor.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Wanadoo: {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\Program Files\Wanadoo\WSBar\WSBar.dll uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun mRun: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [PrivitizeVPN] C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun mRun: [Ad-Aware Antivirus] "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" –windows-run StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: Search with Wanadoo - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {02E2473F-766B-4ce2-8FD0-C4E8071EF1C4} - {D0984FD4-FA9A-46ee-9072-70B0735FF852} - C:\Program Files (x86)\AP Suggestor\APSuggestor.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab TCP: Interfaces\{344B71B5-92C9-4ECB-8C3D-2DFF433EF2A2} : NameServer = 192.168.1.1,192.168.0.1 TCP: Interfaces\{64430373-641F-4A26-AC63-038DCFE13735} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{6623BE0C-B3D5-4F08-AACE-F6BE9038E405} : DHCPNameServer = 172.16.0.110 172.16.0.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp x64-BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab x64-DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab x64-DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - x64-SSODL: WebCheck - . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\id Software\QuakeLive\npquakezero.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll FF - ExtSQL: 2012-10-21 18:02; jid1-yZwVFzbsyfMrqQ@jetpack; C:\Users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack . ============= SERVICES / DRIVERS =============== . R0 SCMNdisP;General NDIS Protocol Driver;C:\Windows\System32\drivers\SCMNdisP.sys [2011-9-24 25312] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904] R2 Ad-Aware Service;Ad-Aware Service;C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-9-20 1236368] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-7-27 63960] R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-3-5 235752] R2 BecHelperService;BecHelperService;C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2011-9-13 1737464] R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624] R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-7-2 1258856] R2 sbapifs;sbapifs;C:\Windows\System32\drivers\sbapifs.sys [2011-11-29 74872] R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776] R2 Simraceway Update Service;Simraceway Update Service;C:\Program Files (x86)\SimracewayUpdater\SRWUpdate.exe [2012-7-18 1028096] R2 WSWNA3100;WSWNA3100;C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2011-9-24 285152] R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-9-2 126952] R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-6-16 389608] R3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;C:\Windows\System32\drivers\bcmwlhigh664.sys [2011-9-24 838136] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2012-10-19 189288] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-16 428136] R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264] R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648] R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960] R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376] R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496] S1 SBRE;SBRE;C:\Windows\System32\drivers\sbredrv.sys [2012-10-21 57976] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-8-26 116648] S2 SBAMSvc;Ad-Aware;C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-3 160944] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-2 250808] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2011-9-13 25832] S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-9-2 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-8-26 116648] S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 115168] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RTLE8023x64;Realtek 10/100/1000 PCI-E NIC Family NDIS XP(x64) Driver;C:\Windows\System32\drivers\Rtenic64.sys [2011-6-16 335464] S3 sbhips;sbhips;C:\Windows\System32\drivers\sbhips.sys [2012-10-21 60536] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-9-14 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-23 57184] . =============== Created Last 60 ================ . 2012-10-23 15:36:15 ——– d-sh–w- C:\$RECYCLE.BIN 2012-10-23 15:15:42 98816 —-a-w- C:\Windows\sed.exe 2012-10-23 15:15:42 256000 —-a-w- C:\Windows\PEV.exe 2012-10-23 15:15:42 208896 —-a-w- C:\Windows\MBR.exe 2012-10-23 15:15:39 ——– d-s—w- C:\ComboFix 2012-10-23 14:59:43 ——– d—–w- C:\ProgramData\Ad-Aware Antivirus 2012-10-23 02:00:33 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2012-10-21 17:13:50 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\LavasoftStatistics 2012-10-21 17:04:05 60536 —-a-w- C:\Windows\System32\drivers\sbhips.sys 2012-10-21 17:04:05 57976 —-a-w- C:\Windows\System32\drivers\sbredrv.sys 2012-10-21 17:04:05 45936 —-a-w- C:\Windows\System32\sbbd.exe 2012-10-21 17:04:04 ——– d—–w- C:\Program Files (x86)\Ad-Aware Antivirus 2012-10-21 17:01:47 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\Ad-Aware Antivirus 2012-10-19 14:49:39 9291768 ——w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{23A0D3FC-9FF2-4243-9AB6-0AEBCE0DC36E}\mpengine.dll 2012-10-13 09:08:03 96224 —-a-w- C:\Program Files (x86)\Mozilla Firefox\webapprt-stub.exe 2012-10-13 09:08:03 157272 —-a-w- C:\Program Files (x86)\Mozilla Firefox\webapp-uninstaller.exe 2012-10-13 09:08:00 14676960 —-a-w- C:\Program Files (x86)\Mozilla Firefox\xul.dll 2012-10-10 17:02:58 1659760 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2012-10-10 17:01:53 184320 —-a-w- C:\Windows\System32\cryptsvc.dll 2012-10-10 17:01:53 1464320 —-a-w- C:\Windows\System32\crypt32.dll 2012-10-10 17:01:53 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll 2012-10-10 17:01:53 140288 —-a-w- C:\Windows\System32\cryptnet.dll 2012-10-10 17:01:53 1159680 —-a-w- C:\Windows\SysWow64\crypt32.dll 2012-10-10 17:01:53 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll 2012-10-05 18:13:18 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\Awesomium 2012-10-04 16:20:49 ——– d—–w- C:\Program Files (x86)\DoomRL 2012-09-29 13:53:11 ——– d—–w- C:\~MSSETUP.T 2012-09-29 13:47:21 255552 —-a-w- C:\Windows\SysWow64\drivers\mcdbus.sys 2012-09-29 13:47:21 255552 —-a-w- C:\Windows\System32\drivers\mcdbus.sys 2012-09-29 13:47:21 ——– d—–w- C:\Program Files (x86)\MagicDisc 2012-09-29 13:46:51 ——– d—–w- C:\Program Files (x86)\MagicISO 2012-09-28 15:33:15 ——– d—–w- C:\Program Files (x86)\uTorrent 2012-09-28 15:32:45 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\uTorrent 2012-09-28 15:29:38 ——– d—–w- C:\Program Files (x86)\PrivitizeVPN 2012-09-28 15:03:18 ——– d—–w- C:\Program Files (x86)\Just BASIC v1.01 2012-09-28 14:59:45 ——– d—–w- C:\Program Files (x86)\FreeBASIC 2012-09-26 15:18:34 245760 —-a-w- C:\Windows\System32\OxpsConverter.exe 2012-09-17 03:05:16 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\pesterchum 2012-09-17 03:04:15 ——– d—–w- C:\Pesterchum 2012-09-16 19:47:48 33240 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2012-09-16 19:47:32 ——– d—–w- C:\Program Files\iPod 2012-09-16 19:47:31 ——– d—–w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-09-16 19:47:31 ——– d—–w- C:\Program Files\iTunes 2012-09-16 19:47:31 ——– d—–w- C:\Program Files (x86)\iTunes 2012-09-15 10:26:34 ——– d—–w- C:\ProgramData\Desura 2012-09-13 15:39:01 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\ArmA 2 OA 2012-09-13 15:31:12 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\Play withSIX 2012-09-13 15:28:01 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\six-zsync 2012-09-13 15:27:52 ——– d—–w- C:\Users\Jamie Tarn\AppData\Roaming\Play withSIX 2012-09-13 15:27:09 ——– d—–w- C:\Program Files (x86)\SIX Networks 2012-09-13 15:21:20 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\DayZCommander 2012-09-13 15:20:33 ——– d—–w- C:\Program Files (x86)\Dotjosh Studios 2012-09-12 16:59:33 ——– d—–w- C:\Program Files (x86)\Capsule 2012-09-12 16:29:31 950128 —-a-w- C:\Windows\System32\drivers\ndis.sys 2012-09-12 16:29:31 574464 —-a-w- C:\Windows\System32\d3d10level9.dll 2012-09-12 16:29:31 490496 —-a-w- C:\Windows\SysWow64\d3d10level9.dll 2012-09-12 16:29:31 41472 —-a-w- C:\Windows\System32\drivers\RNDISMP.sys 2012-09-12 16:29:30 376688 —-a-w- C:\Windows\System32\drivers\netio.sys 2012-09-12 16:29:30 288624 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS 2012-09-12 16:29:30 1913200 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2012-09-11 14:48:48 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\FalloutNV 2012-08-26 15:10:09 ——– d—–w- C:\Users\Jamie Tarn\AppData\Local\Google . ==================== Find6M ==================== . 2012-10-09 17:54:02 73656 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-09 17:54:02 696760 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-10-06 09:21:34 280856 —-a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2012-10-06 09:21:34 280856 —-a-w- C:\Windows\SysWow64\PnkBstrB.exe 2012-10-02 19:51:15 3536817 —-a-w- C:\Windows\System32\nvcoproc.bin 2012-10-02 19:51:11 3293544 —-a-w- C:\Windows\System32\nvsvc64.dll 2012-10-02 19:51:04 6200680 —-a-w- C:\Windows\System32\nvcpl.dll 2012-10-02 19:50:57 891240 —-a-w- C:\Windows\System32\nvvsvc.exe 2012-10-02 19:50:57 63336 —-a-w- C:\Windows\System32\nvshext.dll 2012-10-02 19:50:57 2557800 —-a-w- C:\Windows\System32\nvsvcr.dll 2012-10-02 19:50:57 118120 —-a-w- C:\Windows\System32\nvmctray.dll 2012-09-14 19:19:29 2048 —-a-w- C:\Windows\System32\tzres.dll 2012-09-14 18:28:53 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2012-09-04 17:27:40 280856 —-a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2012-08-30 18:03:45 5559664 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-08-30 17:12:02 3968880 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:12:02 3914096 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-08-24 18:05:07 220160 —-a-w- C:\Windows\System32\wintrust.dll 2012-08-24 16:57:48 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2012-08-24 10:31:32 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2012-08-24 10:21:18 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-08-24 10:20:11 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-08-24 10:14:45 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-08-24 10:13:29 599040 —-a-w- C:\Windows\System32\vbscript.dll 2012-08-24 10:09:42 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-08-24 06:59:17 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-08-24 06:51:27 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-08-24 06:51:02 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-08-24 06:47:26 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-08-24 06:47:12 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2012-08-24 06:43:58 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-08-21 12:01:20 125872 —-a-w- C:\Windows\System32\GEARAspi64.dll 2012-08-21 12:01:20 106928 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2012-08-20 18:48:44 362496 —-a-w- C:\Windows\System32\wow64win.dll 2012-08-20 18:48:44 243200 —-a-w- C:\Windows\System32\wow64.dll 2012-08-20 18:48:44 13312 —-a-w- C:\Windows\System32\wow64cpu.dll 2012-08-20 18:48:43 215040 —-a-w- C:\Windows\System32\winsrv.dll 2012-08-20 18:48:37 16384 —-a-w- C:\Windows\System32\ntvdm64.dll 2012-08-20 18:48:35 424448 —-a-w- C:\Windows\System32\KernelBase.dll 2012-08-20 18:46:22 338432 —-a-w- C:\Windows\System32\conhost.exe 2012-08-20 17:40:21 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2012-08-20 17:38:44 44032 —-a-w- C:\Windows\apppatch\acwow64.dll 2012-08-20 17:38:26 25600 —-a-w- C:\Windows\SysWow64\setup16.exe 2012-08-20 17:37:19 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2012-08-20 17:37:18 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll 2012-08-20 15:38:21 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2012-08-20 15:38:20 2048 —-a-w- C:\Windows\SysWow64\user.exe 2012-08-20 15:33:28 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2012-08-20 15:33:28 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2012-08-20 15:33:28 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2012-08-20 15:33:28 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2012-08-12 13:24:43 76888 —-a-w- C:\Windows\SysWow64\PnkBstrA.exe 2012-08-11 00:56:03 715776 —-a-w- C:\Windows\System32\kerberos.dll 2012-08-10 23:56:14 542208 —-a-w- C:\Windows\SysWow64\kerberos.dll 2012-07-18 18:15:06 3148800 —-a-w- C:\Windows\System32\win32k.sys 2012-07-09 12:42:56 4547984 —-a-w- C:\Windows\System32\usbaaplrc.dll 2012-07-09 12:42:54 52736 —-a-w- C:\Windows\System32\drivers\usbaapl64.sys 2012-07-04 22:13:27 59392 —-a-w- C:\Windows\System32\browcli.dll 2012-07-04 22:13:27 136704 —-a-w- C:\Windows\System32\browser.dll 2012-07-04 21:14:34 41984 —-a-w- C:\Windows\SysWow64\browcli.dll 2012-07-03 15:25:21 31080 —-a-w- C:\Windows\System32\nvhdap64.dll 2012-07-03 15:25:16 189288 —-a-w- C:\Windows\System32\drivers\nvhda64v.sys 2012-07-03 07:37:57 1472360 —-a-w- C:\Windows\System32\nvhdagenco6420103.dll 2012-06-06 06:06:16 2004480 —-a-w- C:\Windows\System32\msxml6.dll 2012-06-06 06:06:16 1881600 —-a-w- C:\Windows\System32\msxml3.dll 2012-06-06 06:02:54 1133568 —-a-w- C:\Windows\System32\cdosys.dll 2012-06-06 05:05:52 1390080 —-a-w- C:\Windows\SysWow64\msxml6.dll 2012-06-06 05:05:52 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll 2012-06-06 05:03:06 805376 —-a-w- C:\Windows\SysWow64\cdosys.dll 2012-06-02 22:15:31 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2012-06-02 22:15:08 99840 —-a-w- C:\Windows\System32\wudriver.dll 2012-06-02 14:19:42 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2012-06-02 14:15:12 36864 —-a-w- C:\Windows\System32\wuapp.exe 2012-06-02 05:50:10 458704 —-a-w- C:\Windows\System32\drivers\cng.sys 2012-06-02 05:48:16 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2012-06-02 05:48:16 151920 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2012-06-02 05:45:31 340992 —-a-w- C:\Windows\System32\schannel.dll 2012-06-02 05:44:21 307200 —-a-w- C:\Windows\System32\ncrypt.dll 2012-06-02 04:40:42 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2012-06-02 04:40:39 225280 —-a-w- C:\Windows\SysWow64\schannel.dll 2012-06-02 04:39:10 219136 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2012-06-02 04:34:09 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2012-05-31 11:25:12 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-05-15 10:48:00 949056 —-a-w- C:\Windows\System32\SET8EAB.tmp 2012-05-15 10:48:00 8105280 —-a-w- C:\Windows\SysWow64\SET9E54.tmp 2012-05-15 10:48:00 68928 —-a-w- C:\Windows\System32\OpenCL.dll 2012-05-15 10:48:00 61248 —-a-w- C:\Windows\SysWow64\OpenCL.dll 2012-05-15 10:48:00 364352 —-a-w- C:\Windows\System32\nvdecodemft.dll 2012-05-15 10:48:00 301376 —-a-w- C:\Windows\SysWow64\nvdecodemft.dll 2012-05-15 10:48:00 2741568 —-a-w- C:\Windows\System32\SET7546.tmp 2012-05-15 10:48:00 2368832 —-a-w- C:\Windows\SysWow64\SET90D1.tmp 2012-05-15 10:48:00 1738048 —-a-w- C:\Windows\System32\SET9EA4.tmp 2012-05-15 10:48:00 1468224 —-a-w- C:\Windows\System32\nvgenco64.dll 2012-05-15 10:48:00 10194752 —-a-w- C:\Windows\System32\SET9062.tmp 2012-05-15 01:21:50 423744 —-a-w- C:\Windows\SysWow64\nvStreaming.exe 2012-05-14 05:26:34 956928 —-a-w- C:\Windows\System32\localspl.dll 2012-05-05 08:36:55 503808 —-a-w- C:\Windows\System32\srcore.dll 2012-05-05 07:46:52 43008 —-a-w- C:\Windows\SysWow64\srclient.dll 2012-05-01 05:40:20 209920 —-a-w- C:\Windows\System32\profsvc.dll 2012-04-28 03:55:21 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys . ============= FINISH: 16:54:41.12 ===============

Attachments:

  • [attachment removed: attach.zip]
Post #4
Hi, Don't forget to run aswMBR and post that log as well. :) ——— Looks like you have also run ComboFix? Please post the log that was created after running that. It should be located at C:\ComboFix.txt
Post #5
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-10-23 17:55:54 —————————– 17:55:54.109 OS Version: Windows x64 6.1.7601 Service Pack 1 17:55:54.109 Number of processors: 4 586 0x403 17:55:54.109 ComputerName: JAMIETARN-PC UserName: Jamie Tarn 17:55:56.371 Initialize success 17:56:05.045 AVAST engine defs: 12102300 17:56:18.652 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 17:56:18.652 Disk 0 Vendor: WDC_WD10EARS-00MVWB0 51.0AB51 Size: 953869MB BusType: 3 17:56:18.667 Disk 0 MBR read successfully 17:56:18.683 Disk 0 MBR scan 17:56:18.698 Disk 0 Windows 7 default MBR code 17:56:18.698 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 17:56:18.714 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953767 MB offset 206848 17:56:18.714 Disk 0 scanning C:\Windows\system32\drivers 17:56:28.808 Service scanning 17:57:03.409 Modules scanning 17:57:03.409 Disk 0 trace - called modules: 17:57:03.425 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 17:57:03.425 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007aa5060] 17:57:03.924 3 CLASSPNP.SYS[fffff880018c743f] -> nt!IofCallDriver -> [0xfffffa8006af4580] 17:57:03.924 5 ACPI.sys[fffff88000e457a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8006aff060] 17:57:07.293 AVAST engine scan C:\ 22:49:37.888 File: C:\Users\Jamie Tarn\AppData\Roaming\Myurtuq\aruqha.exe **INFECTED** Win32:Spyeye-ADS [Trj] 22:50:06.935 File: C:\Users\Jamie Tarn\AppData\Roaming\Vuryqe\nimoqa.exe **INFECTED** Win32:Spyeye-ADS [Trj] 23:29:20.241 File: C:\Users\Jamie Tarn\Downloads\visual basic 6.0 enterprise edition_secure.exe **INFECTED** Win32:Adware-gen [Adw] 01:06:14.752 Scan finished successfully 15:43:06.468 Disk 0 MBR has been saved successfully to "C:\Users\Jamie Tarn\Desktop\MBR.dat" 15:43:06.468 The log file has been saved successfully to "C:\Users\Jamie Tarn\Desktop\aswMBR.txt"
Post #7

Hi,

Don't forget to run aswMBR and post that log as well. :)
———

Looks like you have also run ComboFix? Please post the log that was created after running that. It should be located at C:\ComboFix.txt


I can't seem to find ComboFix.txt.
Post #8
Hi,

Let's try this….

Go to Start >> in Start Search bar type Run >> type C:\ComboFix.txt >> press Enter.

Does the log open up for you? :)
Post #9

Hi,

Let's try this….

Go to Start >> in Start Search bar type Run >> type C:\ComboFix.txt >> press Enter.

Does the log open up for you? :)


Nope. Nothing.
Post #10
:thumbup:

Please delete the current version of Combofix.exe from your desktop and download a new version from here to your desktop.

Disable your AntiVirus and AntiSpyware applications.

Right-click and Run as Administrator on the Combofix.exe and follow the prombts on your display. When finish, it will create a C:\Combofix.txt. Please post this log for further review.
———
Post #11
ComboFix 12-10-25.01 - Jamie Tarn 25/10/2012 17:34:51.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.8191.6693 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Lavasoft Ad-Aware *Enabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800} FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B} SP: Lavasoft Ad-Aware *Enabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\program files (x86)\AP Suggestor\APSUggestor.dll c:\users\Jamie Tarn\AppData\Roaming\PropMgrAsync c:\users\Jamie Tarn\AppData\Roaming\PropMgrAsync\PropMgrAsync.cfg c:\users\Jamie Tarn\AppData\Roaming\PropMgrAsync\PropMgrAsync.log c:\windows\SysWow64\Packet.dll c:\windows\SysWow64\pthreadVC.dll c:\windows\SysWow64\SET90D1.tmp c:\windows\SysWow64\SET9E54.tmp c:\windows\SysWow64\wpcap.dll . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_NPF ——-\Service_nvsvc . . ((((((((((((((((((((((((( Files Created from 2012-09-25 to 2012-10-25 ))))))))))))))))))))))))))))))) . . 2012-10-25 16:49 . 2012-10-25 16:49 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-25 16:49 . 2012-10-25 16:49 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-10-23 14:59 . 2012-10-23 14:59 ——– d—–w- c:\programdata\Ad-Aware Antivirus 2012-10-23 02:00 . 2012-10-23 02:00 ——– d—–w- c:\program files (x86)\MSXML 4.0 2012-10-21 17:13 . 2012-10-21 17:13 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\LavasoftStatistics 2012-10-21 17:04 . 2011-12-19 12:21 45936 —-a-w- c:\windows\system32\sbbd.exe 2012-10-21 17:04 . 2011-12-19 11:44 60536 —-a-w- c:\windows\system32\drivers\sbhips.sys 2012-10-21 17:04 . 2011-10-26 13:23 57976 —-a-w- c:\windows\system32\drivers\sbredrv.sys 2012-10-21 17:04 . 2012-10-21 17:15 ——– d—–w- c:\program files (x86)\Ad-Aware Antivirus 2012-10-21 17:04 . 2012-10-21 17:04 ——– d—–w- c:\programdata\Lavasoft 2012-10-21 17:01 . 2012-10-21 17:18 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\Ad-Aware Antivirus 2012-10-10 17:01 . 2012-06-02 05:41 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-10-10 17:01 . 2012-06-02 05:41 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-10-10 17:01 . 2012-06-02 05:41 1464320 —-a-w- c:\windows\system32\crypt32.dll 2012-10-10 17:01 . 2012-06-02 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-10-10 17:01 . 2012-06-02 04:36 1159680 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-10-10 17:01 . 2012-06-02 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-10-05 18:13 . 2012-10-05 18:46 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\Awesomium 2012-10-04 16:20 . 2012-10-04 16:26 ——– d—–w- c:\program files (x86)\DoomRL 2012-09-29 13:53 . 2012-09-29 13:53 ——– d—–w- C:\~MSSETUP.T 2012-09-29 13:47 . 2012-09-29 13:48 ——– d—–w- c:\program files (x86)\MagicDisc 2012-09-29 13:47 . 2009-02-24 17:35 255552 —-a-w- c:\windows\SysWow64\drivers\mcdbus.sys 2012-09-29 13:47 . 2009-02-24 17:35 255552 —-a-w- c:\windows\system32\drivers\mcdbus.sys 2012-09-29 13:46 . 2012-09-29 13:46 ——– d—–w- c:\program files (x86)\MagicISO 2012-09-28 15:33 . 2012-09-29 13:20 ——– d—–w- c:\program files (x86)\uTorrent 2012-09-28 15:32 . 2012-09-30 09:33 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\uTorrent 2012-09-28 15:29 . 2012-09-28 15:29 ——– d—–w- c:\program files (x86)\PrivitizeVPN 2012-09-28 15:03 . 2012-09-28 15:03 ——– d—–w- c:\program files (x86)\Just BASIC v1.01 2012-09-28 14:59 . 2012-09-28 15:00 ——– d—–w- c:\program files (x86)\FreeBASIC 2012-09-26 15:18 . 2012-08-21 21:01 245760 —-a-w- c:\windows\system32\OxpsConverter.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-12 07:19 . 2012-10-19 14:49 9291768 ——w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{23A0D3FC-9FF2-4243-9AB6-0AEBCE0DC36E}\mpengine.dll 2012-10-09 17:54 . 2012-04-02 21:24 696760 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-09 17:54 . 2011-09-13 18:18 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-06 09:21 . 2012-05-27 14:37 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-10-06 09:21 . 2012-05-27 14:35 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-10-02 22:21 . 2012-07-02 15:54 973672 —-a-w- c:\windows\system32\nvumdshimx.dll 2012-10-02 22:21 . 2012-07-02 15:54 2731880 —-a-w- c:\windows\system32\nvapi64.dll 2012-10-02 22:21 . 2012-07-02 15:54 2428776 —-a-w- c:\windows\SysWow64\nvapi.dll 2012-10-02 22:21 . 2012-07-02 15:54 1760104 —-a-w- c:\windows\system32\nvdispco64.dll 2012-10-02 22:21 . 2012-07-02 15:54 14922600 —-a-w- c:\windows\system32\nvwgf2umx.dll 2012-10-02 22:21 . 2012-07-02 15:54 12501352 —-a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-10-02 19:51 . 2012-07-02 15:55 3536817 —-a-w- c:\windows\system32\nvcoproc.bin 2012-10-02 19:51 . 2012-07-02 15:55 3293544 —-a-w- c:\windows\system32\nvsvc64.dll 2012-10-02 19:51 . 2012-07-02 15:55 6200680 —-a-w- c:\windows\system32\nvcpl.dll 2012-10-02 19:50 . 2012-07-02 15:55 891240 —-a-w- c:\windows\system32\nvvsvc.exe 2012-10-02 19:50 . 2012-07-02 15:55 63336 —-a-w- c:\windows\system32\nvshext.dll 2012-10-02 19:50 . 2012-07-02 15:55 2557800 —-a-w- c:\windows\system32\nvsvcr.dll 2012-10-02 19:50 . 2012-07-02 15:55 118120 —-a-w- c:\windows\system32\nvmctray.dll 2012-09-04 17:27 . 2012-05-27 14:35 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-08-24 11:15 . 2012-09-22 21:57 17810944 —-a-w- c:\windows\system32\mshtml.dll 2012-08-24 10:39 . 2012-09-22 21:56 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-08-24 10:31 . 2012-09-22 21:57 2312704 —-a-w- c:\windows\system32\jscript9.dll 2012-08-24 10:22 . 2012-09-22 21:57 1346048 —-a-w- c:\windows\system32\urlmon.dll 2012-08-24 10:21 . 2012-09-22 21:57 1392128 —-a-w- c:\windows\system32\wininet.dll 2012-08-24 10:20 . 2012-09-22 21:57 1494528 —-a-w- c:\windows\system32\inetcpl.cpl 2012-08-24 10:18 . 2012-09-22 21:57 237056 —-a-w- c:\windows\system32\url.dll 2012-08-24 10:17 . 2012-09-22 21:57 85504 —-a-w- c:\windows\system32\jsproxy.dll 2012-08-24 10:14 . 2012-09-22 21:57 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-08-24 10:14 . 2012-09-22 21:57 816640 —-a-w- c:\windows\system32\jscript.dll 2012-08-24 10:13 . 2012-09-22 21:57 599040 —-a-w- c:\windows\system32\vbscript.dll 2012-08-24 10:12 . 2012-09-22 21:57 2144768 —-a-w- c:\windows\system32\iertutil.dll 2012-08-24 10:11 . 2012-09-22 21:57 729088 —-a-w- c:\windows\system32\msfeeds.dll 2012-08-24 10:10 . 2012-09-22 21:57 96768 —-a-w- c:\windows\system32\mshtmled.dll 2012-08-24 10:09 . 2012-09-22 21:57 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-08-24 10:04 . 2012-09-22 21:57 248320 —-a-w- c:\windows\system32\ieui.dll 2012-08-24 06:59 . 2012-09-22 21:57 1800704 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-08-24 06:51 . 2012-09-22 21:57 1129472 —-a-w- c:\windows\SysWow64\wininet.dll 2012-08-24 06:51 . 2012-09-22 21:57 1427968 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-08-24 06:47 . 2012-09-22 21:57 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-08-24 06:47 . 2012-09-22 21:57 420864 —-a-w- c:\windows\SysWow64\vbscript.dll 2012-08-24 06:43 . 2012-09-22 21:57 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb 2012-08-22 18:12 . 2012-09-12 16:29 1913200 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-08-22 18:12 . 2012-09-12 16:29 950128 —-a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 16:29 376688 —-a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 16:29 288624 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 12:01 . 2012-09-16 19:47 33240 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-08-21 12:01 . 2011-10-07 20:44 125872 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-08-21 12:01 . 2011-10-07 20:44 106928 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-08-20 17:38 . 2012-10-10 17:02 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2012-08-12 13:24 . 2012-05-27 14:35 76888 —-a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-08-02 17:58 . 2012-09-12 16:29 574464 —-a-w- c:\windows\system32\d3d10level9.dll 2012-08-02 16:57 . 2012-09-12 16:29 490496 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2011-09-14 20:21 . 2011-09-13 13:41 303104 —-a-w- c:\program files (x86)\Common Files\FDEUnInstaller.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Ad-Aware Antivirus"="c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher –windows-run" [X] "BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2010-03-05 411864] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776] "PrivitizeVPN"="c:\program files (x86)\PrivitizeVPN\PrivitizeVPN.exe" [2012-09-10 196784] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ NETGEAR WNA3100 Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WNA3100\WNA3100.exe [2011-9-24 4577760] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service] @="Ad-Aware Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 116648] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944] R2 WSWNA3100;WSWNA3100;c:\program files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2010-08-26 285152] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-09 250808] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 116648] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-13 115168] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RTLE8023x64;Realtek 10/100/1000 PCI-E NIC Family NDIS XP(x64) Driver;c:\windows\system32\DRIVERS\Rtenic64.sys [2011-01-14 335464] R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys [2011-12-19 60536] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 uxddrv;Dynamically loaded UxdDrv;c:\pcspro\uxddrv64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-14 1255736] R4 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [2007-01-19 25312] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2011-10-26 57976] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-09-20 1236368] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-03-05 235752] S2 BecHelperService;BecHelperService;c:\program files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-10-02 1258856] S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032] S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2011-11-29 74872] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 Simraceway Update Service;Simraceway Update Service;c:\program files (x86)\SimracewayUpdater\SRWUpdate.exe [2012-07-18 1028096] S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2011-02-24 126952] S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2011-02-24 389608] S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\DRIVERS\bcmwlhigh664.sys [2009-11-06 838136] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-07-03 189288] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-16 428136] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] . . Contents of the 'Scheduled Tasks' folder . 2012-10-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:54] . 2012-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 15:10] . 2012-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 15:10] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.co.uk/ mStart Page = hxxp://search.privitize.com/?aff=7 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Search with Wanadoo - c:\progra~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm IE: {{02E2473F-766B-4ce2-8FD0-C4E8071EF1C4} - {D0984FD4-FA9A-46ee-9072-70B0735FF852} - c:\program files (x86)\AP Suggestor\APSuggestor.dll TCP: Interfaces\{344B71B5-92C9-4ECB-8C3D-2DFF433EF2A2}: NameServer = 192.168.1.1,192.168.0.1 FF - ProfilePath - c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - ExtSQL: 2012-10-21 18:02; jid1-yZwVFzbsyfMrqQ@jetpack; c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack . - - - - ORPHANS REMOVED - - - - . BHO-{D0984FD4-FA9A-46ee-9072-70B0735FF852} - c:\program files (x86)\AP Suggestor\APSuggestor.dll Toolbar-Locked - (no file) SafeBoot-BsScanner Toolbar-Locked - (no file) AddRemove-BattlEye - c:\program files (x86)\CapsuleGames\ARMA II - PC\BattlEye\UnInstallBE.exe AddRemove-BattlEye for A2 - c:\program files (x86)\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe AddRemove-FXAA Post Process Injector - c:\program files (x86)\Steam\steamapps\common\skyrim\Uninstall.exe AddRemove-{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1 - c:\games\World_of_Tanks\unins000.exe AddRemove-{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB} - c:\program files (x86)\Common Files\BioWare\Uninstall Mass Effect 2.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-2036449241-558682152-1390425216-1001\Software\SecuROM\License information*] "datasecu"=hex:b4,ef,af,fa,e4,68,4f,9d,91,58,d0,40,c6,33,4d,e9,75,9f,65,af,9c, 7c,53,76,e5,53,8c,cc,3c,20,cf,db,b9,68,e7,49,44,2e,4f,2d,79,9c,95,1a,a7,5c,\ "rkeysecu"=hex:82,c3,15,4f,bb,1d,3b,7f,84,f5,53,93,76,d6,d1,ff . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe . ************************************************************************** . Completion time: 2012-10-25 17:56:15 - machine was rebooted ComboFix-quarantined-files.txt 2012-10-25 16:56 . Pre-Run: 579,441,913,856 bytes free Post-Run: 580,436,230,144 bytes free . - - End Of File - - 5A8C7C3A0001EEE4AE1FBED237FA60FF
Post #12
Hi,
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:


    ClearJavaCache::

    DDS::
    uStart Page = hxxp://www.google.co.uk/
    mStart Page = hxxp://search.privitize.com/?aff=7
    IE: {{02E2473F-766B-4ce2-8FD0-C4E8071EF1C4} - {D0984FD4-FA9A-46ee-9072-70B0735FF852} - c:\program files (x86)\AP Suggestor\APSuggestor.dll
    BHO: AP Suggestor: {D0984FD4-FA9A-46ee-9072-70B0735FF852} - C:\Program Files (x86)\AP Suggestor\APSuggestor.dll
    mRun: [PrivitizeVPN] C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun

    Firefox::
    FF - ExtSQL: 2012-10-21 18:02; jid1-yZwVFzbsyfMrqQ@jetpack; c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack

    File::
    C:\Windows\System32\SET7546.tmp
    C:\Windows\SysWow64\SET90D1.tmp
    C:\Windows\System32\SET9EA4.tmp
    C:\Windows\System32\nvgenco64.dll
    C:\Windows\System32\SET9062.tmp

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Please post the new ComboFix log and let me know how your system is running now. :)
Post #13
This is from the second time I ran it- the first time, I forgot the update thing. ComboFix 12-10-26.01 - Jamie Tarn 26/10/2012 11:40:37.4.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.8191.6702 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Jamie Tarn\Desktop\CFScript.txt AV: Lavasoft Ad-Aware *Enabled/Updated* {445B48C3-0FA4-6B16-8F07-6506F305D800} FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B} SP: Lavasoft Ad-Aware *Enabled/Updated* {FF3AA927-299E-6498-B5B7-5E74888292BD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\System32\nvgenco64.dll" "c:\windows\System32\SET7546.tmp" "c:\windows\System32\SET9062.tmp" "c:\windows\System32\SET9EA4.tmp" "c:\windows\SysWow64\SET90D1.tmp" . . ((((((((((((((((((((((((( Files Created from 2012-09-26 to 2012-10-26 ))))))))))))))))))))))))))))))) . . 2012-10-26 10:50 . 2012-10-26 10:50 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp 2012-10-26 10:50 . 2012-10-26 10:50 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-10-26 10:26 . 2012-10-26 10:26 ——– d—–w- C:\found.000 2012-10-23 14:59 . 2012-10-23 14:59 ——– d—–w- c:\programdata\Ad-Aware Antivirus 2012-10-23 02:00 . 2012-10-23 02:00 ——– d—–w- c:\program files (x86)\MSXML 4.0 2012-10-21 17:13 . 2012-10-21 17:13 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\LavasoftStatistics 2012-10-21 17:04 . 2011-12-19 12:21 45936 —-a-w- c:\windows\system32\sbbd.exe 2012-10-21 17:04 . 2011-12-19 11:44 60536 —-a-w- c:\windows\system32\drivers\sbhips.sys 2012-10-21 17:04 . 2011-10-26 13:23 57976 —-a-w- c:\windows\system32\drivers\sbredrv.sys 2012-10-21 17:04 . 2012-10-21 17:15 ——– d—–w- c:\program files (x86)\Ad-Aware Antivirus 2012-10-21 17:04 . 2012-10-21 17:04 ——– d—–w- c:\programdata\Lavasoft 2012-10-21 17:01 . 2012-10-21 17:18 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\Ad-Aware Antivirus 2012-10-19 14:49 . 2012-10-12 07:19 9291768 ——w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{23A0D3FC-9FF2-4243-9AB6-0AEBCE0DC36E}\mpengine.dll 2012-10-10 17:01 . 2012-06-02 05:41 184320 —-a-w- c:\windows\system32\cryptsvc.dll 2012-10-10 17:01 . 2012-06-02 05:41 140288 —-a-w- c:\windows\system32\cryptnet.dll 2012-10-10 17:01 . 2012-06-02 05:41 1464320 —-a-w- c:\windows\system32\crypt32.dll 2012-10-10 17:01 . 2012-06-02 04:36 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll 2012-10-10 17:01 . 2012-06-02 04:36 1159680 —-a-w- c:\windows\SysWow64\crypt32.dll 2012-10-10 17:01 . 2012-06-02 04:36 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll 2012-10-05 18:13 . 2012-10-05 18:46 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\Awesomium 2012-10-04 16:20 . 2012-10-04 16:26 ——– d—–w- c:\program files (x86)\DoomRL 2012-09-29 13:53 . 2012-09-29 13:53 ——– d—–w- C:\~MSSETUP.T 2012-09-29 13:47 . 2012-09-29 13:48 ——– d—–w- c:\program files (x86)\MagicDisc 2012-09-29 13:47 . 2009-02-24 17:35 255552 —-a-w- c:\windows\SysWow64\drivers\mcdbus.sys 2012-09-29 13:47 . 2009-02-24 17:35 255552 —-a-w- c:\windows\system32\drivers\mcdbus.sys 2012-09-29 13:46 . 2012-09-29 13:46 ——– d—–w- c:\program files (x86)\MagicISO 2012-09-28 15:33 . 2012-09-29 13:20 ——– d—–w- c:\program files (x86)\uTorrent 2012-09-28 15:32 . 2012-09-30 09:33 ——– d—–w- c:\users\Jamie Tarn\AppData\Roaming\uTorrent 2012-09-28 15:29 . 2012-09-28 15:29 ——– d—–w- c:\program files (x86)\PrivitizeVPN 2012-09-28 15:03 . 2012-09-28 15:03 ——– d—–w- c:\program files (x86)\Just BASIC v1.01 2012-09-28 14:59 . 2012-09-28 15:00 ——– d—–w- c:\program files (x86)\FreeBASIC 2012-09-26 15:18 . 2012-08-21 21:01 245760 —-a-w- c:\windows\system32\OxpsConverter.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-10-09 17:54 . 2012-04-02 21:24 696760 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-09 17:54 . 2011-09-13 18:18 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-10-06 09:21 . 2012-05-27 14:37 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-10-06 09:21 . 2012-05-27 14:35 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-10-02 22:21 . 2012-07-02 15:54 973672 —-a-w- c:\windows\system32\nvumdshimx.dll 2012-10-02 22:21 . 2012-07-02 15:54 2731880 —-a-w- c:\windows\system32\nvapi64.dll 2012-10-02 22:21 . 2012-07-02 15:54 2428776 —-a-w- c:\windows\SysWow64\nvapi.dll 2012-10-02 22:21 . 2012-07-02 15:54 1760104 —-a-w- c:\windows\system32\nvdispco64.dll 2012-10-02 22:21 . 2012-07-02 15:54 14922600 —-a-w- c:\windows\system32\nvwgf2umx.dll 2012-10-02 22:21 . 2012-07-02 15:54 12501352 —-a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-10-02 19:51 . 2012-07-02 15:55 3536817 —-a-w- c:\windows\system32\nvcoproc.bin 2012-10-02 19:51 . 2012-07-02 15:55 3293544 —-a-w- c:\windows\system32\nvsvc64.dll 2012-10-02 19:51 . 2012-07-02 15:55 6200680 —-a-w- c:\windows\system32\nvcpl.dll 2012-10-02 19:50 . 2012-07-02 15:55 891240 —-a-w- c:\windows\system32\nvvsvc.exe 2012-10-02 19:50 . 2012-07-02 15:55 63336 —-a-w- c:\windows\system32\nvshext.dll 2012-10-02 19:50 . 2012-07-02 15:55 2557800 —-a-w- c:\windows\system32\nvsvcr.dll 2012-10-02 19:50 . 2012-07-02 15:55 118120 —-a-w- c:\windows\system32\nvmctray.dll 2012-09-04 17:27 . 2012-05-27 14:35 280856 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-08-24 11:15 . 2012-09-22 21:57 17810944 —-a-w- c:\windows\system32\mshtml.dll 2012-08-24 10:39 . 2012-09-22 21:56 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-08-24 10:31 . 2012-09-22 21:57 2312704 —-a-w- c:\windows\system32\jscript9.dll 2012-08-24 10:22 . 2012-09-22 21:57 1346048 —-a-w- c:\windows\system32\urlmon.dll 2012-08-24 10:21 . 2012-09-22 21:57 1392128 —-a-w- c:\windows\system32\wininet.dll 2012-08-24 10:20 . 2012-09-22 21:57 1494528 —-a-w- c:\windows\system32\inetcpl.cpl 2012-08-24 10:18 . 2012-09-22 21:57 237056 —-a-w- c:\windows\system32\url.dll 2012-08-24 10:17 . 2012-09-22 21:57 85504 —-a-w- c:\windows\system32\jsproxy.dll 2012-08-24 10:14 . 2012-09-22 21:57 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-08-24 10:14 . 2012-09-22 21:57 816640 —-a-w- c:\windows\system32\jscript.dll 2012-08-24 10:13 . 2012-09-22 21:57 599040 —-a-w- c:\windows\system32\vbscript.dll 2012-08-24 10:12 . 2012-09-22 21:57 2144768 —-a-w- c:\windows\system32\iertutil.dll 2012-08-24 10:11 . 2012-09-22 21:57 729088 —-a-w- c:\windows\system32\msfeeds.dll 2012-08-24 10:10 . 2012-09-22 21:57 96768 —-a-w- c:\windows\system32\mshtmled.dll 2012-08-24 10:09 . 2012-09-22 21:57 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-08-24 10:04 . 2012-09-22 21:57 248320 —-a-w- c:\windows\system32\ieui.dll 2012-08-24 06:59 . 2012-09-22 21:57 1800704 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-08-24 06:51 . 2012-09-22 21:57 1129472 —-a-w- c:\windows\SysWow64\wininet.dll 2012-08-24 06:51 . 2012-09-22 21:57 1427968 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-08-24 06:47 . 2012-09-22 21:57 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-08-24 06:47 . 2012-09-22 21:57 420864 —-a-w- c:\windows\SysWow64\vbscript.dll 2012-08-24 06:43 . 2012-09-22 21:57 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb 2012-08-22 18:12 . 2012-09-12 16:29 1913200 —-a-w- c:\windows\system32\drivers\tcpip.sys 2012-08-22 18:12 . 2012-09-12 16:29 950128 —-a-w- c:\windows\system32\drivers\ndis.sys 2012-08-22 18:12 . 2012-09-12 16:29 376688 —-a-w- c:\windows\system32\drivers\netio.sys 2012-08-22 18:12 . 2012-09-12 16:29 288624 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 12:01 . 2012-09-16 19:47 33240 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-08-21 12:01 . 2011-10-07 20:44 125872 —-a-w- c:\windows\system32\GEARAspi64.dll 2012-08-21 12:01 . 2011-10-07 20:44 106928 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2012-08-20 17:38 . 2012-10-10 17:02 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2012-08-12 13:24 . 2012-05-27 14:35 76888 —-a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-08-02 17:58 . 2012-09-12 16:29 574464 —-a-w- c:\windows\system32\d3d10level9.dll 2012-08-02 16:57 . 2012-09-12 16:29 490496 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2011-09-14 20:21 . 2011-09-13 13:41 303104 —-a-w- c:\program files (x86)\Common Files\FDEUnInstaller.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D0984FD4-FA9A-46ee-9072-70B0735FF852}] c:\program files (x86)\AP Suggestor\APSuggestor.dll [BU] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 64792 —-a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Ad-Aware Antivirus"="c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher –windows-run" [X] "BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2010-03-05 411864] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280] "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776] "PrivitizeVPN"="c:\program files (x86)\PrivitizeVPN\PrivitizeVPN.exe" [2012-09-10 196784] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ NETGEAR WNA3100 Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WNA3100\WNA3100.exe [2011-9-24 4577760] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service] @="Ad-Aware Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 116648] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-03 160944] R2 WSWNA3100;WSWNA3100;c:\program files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2010-08-26 285152] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-09 250808] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 116648] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-10-13 115168] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 RTLE8023x64;Realtek 10/100/1000 PCI-E NIC Family NDIS XP(x64) Driver;c:\windows\system32\DRIVERS\Rtenic64.sys [2011-01-14 335464] R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys [2011-12-19 60536] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 uxddrv;Dynamically loaded UxdDrv;c:\pcspro\uxddrv64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-14 1255736] R4 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [2007-01-19 25312] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2011-10-26 57976] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [2012-09-20 1236368] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2010-03-05 235752] S2 BecHelperService;BecHelperService;c:\program files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-10-02 1258856] S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [2011-12-19 3289032] S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [2011-11-29 74872] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 Simraceway Update Service;Simraceway Update Service;c:\program files (x86)\SimracewayUpdater\SRWUpdate.exe [2012-07-18 1028096] S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys [2011-02-24 126952] S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys [2011-02-24 389608] S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\DRIVERS\bcmwlhigh664.sys [2009-11-06 838136] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-07-03 189288] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-16 428136] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] . . Contents of the 'Scheduled Tasks' folder . 2012-10-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:54] . 2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 15:10] . 2012-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 15:10] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 10:20 75544 —-a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://search.privitize.com/?aff=7 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Search with Wanadoo - c:\progra~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm IE: {{02E2473F-766B-4ce2-8FD0-C4E8071EF1C4} - {D0984FD4-FA9A-46ee-9072-70B0735FF852} - c:\program files (x86)\AP Suggestor\APSuggestor.dll TCP: Interfaces\{344B71B5-92C9-4ECB-8C3D-2DFF433EF2A2}: NameServer = 192.168.1.1,192.168.0.1 FF - ProfilePath - c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - ExtSQL: 2012-10-21 18:02; jid1-yZwVFzbsyfMrqQ@jetpack; c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) AddRemove-BattlEye - c:\program files (x86)\CapsuleGames\ARMA II - PC\BattlEye\UnInstallBE.exe AddRemove-BattlEye for A2 - c:\program files (x86)\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe AddRemove-FXAA Post Process Injector - c:\program files (x86)\Steam\steamapps\common\skyrim\Uninstall.exe AddRemove-{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1 - c:\games\World_of_Tanks\unins000.exe AddRemove-{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB} - c:\program files (x86)\Common Files\BioWare\Uninstall Mass Effect 2.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-2036449241-558682152-1390425216-1001\Software\SecuROM\License information*] "datasecu"=hex:b4,ef,af,fa,e4,68,4f,9d,91,58,d0,40,c6,33,4d,e9,75,9f,65,af,9c, 7c,53,76,e5,53,8c,cc,3c,20,cf,db,b9,68,e7,49,44,2e,4f,2d,79,9c,95,1a,a7,5c,\ "rkeysecu"=hex:82,c3,15,4f,bb,1d,3b,7f,84,f5,53,93,76,d6,d1,ff . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-10-26 11:51:39 ComboFix-quarantined-files.txt 2012-10-26 10:51 ComboFix2.txt 2012-10-25 23:17 ComboFix3.txt 2012-10-25 16:56 . Pre-Run: 578,865,606,656 bytes free Post-Run: 578,802,962,432 bytes free . - - End Of File - - E24610D611C23D7F8AD0134CAA3EC67C
Post #14
Hi,
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


    ClearJavaCache::

    DDS::
    mStart Page = hxxp://search.privitize.com/?aff=7
    IE: {{02E2473F-766B-4ce2-8FD0-C4E8071EF1C4} - {D0984FD4-FA9A-46ee-9072-70B0735FF852} - c:\program files (x86)\AP Suggestor\APSuggestor.dll

    File::
    c:\users\Jamie Tarn\AppData\Roaming\Mozilla\Firefox\Profiles\porkai4o.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
    c:\program files (x86)\PrivitizeVPN\PrivitizeVPN.exe

    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "PrivitizeVPN"=-

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI