What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected laptop? [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello to you all.

Three days ago my pc started redirecting me when performing google searches.
Now I cannot even access the computer without using safe mode with network connections (I'm running safe mode this very moment). The computer is also very slow.
Upon a complete system scan featuring Norton Internet Security 2012 nothing was found.
Upon a complete system scan by Malwarebytes nothing was found.

This is very frustrating and I hope any of you competent persons can help me.

This is a copy of the log from Hijackthis: (Bear in mind this scan was performed while operating in safe mode whereas the other scans were performed while I still could use the regular/normal login)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:38:51, on 19.01.2013
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Safe mode with network support

Running processes:
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Bromm\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…h4z155t6652k55q
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sol.no/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…h4z155t6652k55q
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…h4z155t6652k55q
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - (no file)
F2 - REG:system.ini: UserInit=C:\Windows\SysWOW64\userinit.exe,
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
O4 - HKLM\..\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
O4 - HKLM\..\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
O4 - HKLM\..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [CLX3180_Scan2Pc] C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe
O4 - HKLM\..\Run: [3180 Scan2PC] "C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ABSFIGGC] rundll32 "C:\Users\Bromm\AppData\Roaming\makecabs.dll",Vzridk
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Blogg dette - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blogg dette i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Vis eller skjul HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: DirectEdit - https://www.itslearning.com/file/DirectEdit.CAB
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://sslvpn2.ntnu.no/CACHE/stc/3/binaries/vpnweb.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Googles oppdateringstjeneste (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google-oppdatering-tjenesten (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Sesam Control Service (SesamService) - Swisscom - C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TurboBoost - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: Updater Service - Acer Group - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14469 bytes
Post #2
Please do the following:

Download the appropriate version for your system of the Farbar Recovery Scan Tool and save it to a flash drive.


Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to the disclaimer.

[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there

[*]Press Scan button.

[*]type exit and reboot the computer normally

[*]FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.

Post #3
Hello and thank you so much for taking your time helping me. I have now tried what you described above and after typing frst.exe in command prompt an error was returned, saying: "the subsystem required to support this imagetype does not exist" (mind you this is the result of a translation from Norwegian and might not be entirely correct) Sincerely Brumble
Post #5
Hello again. I have now run the frst64 and the log is posted below: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013 Ran by [removed] at 19-01-2013 22:58:20 Running from G:\ Windows 7 Home Premium (X64) OS Language: Norwegian Bokmal The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [9913376 2009-12-29] (Realtek Semiconductor) HKLM\…\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-04-16] (Egis Technology Inc.) HKLM\…\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [17412200 2010-04-07] (NVIDIA Corporation) HKLM\…\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\…\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated) HKLM\…\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a [1984832 2011-06-21] (FSPro Labs) HKLM-x32\…\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation) HKLM-x32\…\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-04-16] (Egis Technology Inc.) HKLM-x32\…\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d [201584 2010-03-10] (Egis Technology Inc.) HKLM-x32\…\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-10] (Egis Technology Inc.) HKLM-x32\…\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [588648 2009-07-24] (Symantec Corporation) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2010-09-23] (Adobe Systems Incorporated) HKLM-x32\…\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [260608 2010-03-08] (NewTech Infosystems, Inc.) HKLM-x32\…\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [908368 2010-04-07] (Dritek System Inc.) HKLM-x32\…\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-21] (Adobe Systems Incorporated) HKLM-x32\…\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\…\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard) HKLM-x32\…\Run: [] [x] HKLM-x32\…\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun [688128 2011-07-06] () HKLM-x32\…\Run: [CLX3180_Scan2Pc] C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-28] () HKLM-x32\…\Run: [3180 Scan2PC] "C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe" [1990144 2011-04-28] () HKLM-x32\…\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-02] (Sun Microsystems, Inc.) HKLM-x32\…\Run: [ABSFIGGC] rundll32 "C:\Users\Bromm\AppData\Roaming\makecabs.dll",Vzridk [118784 2013-01-17] () HKU\Bromm\…\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-04-21] (Google Inc.) HKU\Bromm\…\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3883856 2009-07-26] (Microsoft Corporation) HKU\Bromm\…\Policies\system: [LogonHoursAction] 2 HKU\Bromm\…\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Default\…\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] () HKU\Default User\…\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] () HKLM-x32\…\Winlogon: [Userinit] C:\Windows\SysWOW64\userinit.exe, [26112 2009-07-13] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ==================== Services (Whitelisted) =================== 2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [398184 2012-12-14] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [682344 2012-12-14] (Malwarebytes Corporation) 3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-04-16] (Egis Technology Inc.) 2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\diMaster.dll" /prefetch:1 [135032 2010-04-29] (Symantec Corporation) 3 OpenVPNService; "C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe" [36352 2011-07-13] () 2 SesamService; "C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe" [1237800 2009-02-17] (Swisscom) ==================== Drivers (Whitelisted) ===================== 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130111.001\BHDrvx64.sys [1384608 2012-10-23] (Symantec Corporation) 1 ccHP; C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [593544 2011-08-03] (Symantec Corporation) 2 DgiVecp; C:\Windows\System32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation) 3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation) 3 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.) 0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130117.001\IDSvia64.sys [513184 2012-08-31] (Symantec Corporation) 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130118.007\ENG64.SYS [126192 2013-01-18] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130118.007\EX64.SYS [2087664 2013-01-18] (Symantec Corporation) 0 SMR311; C:\Windows\System32\Drivers\SMR311.sys [95392 2013-01-17] (Symantec Corporation) 1 SRTSP; C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS [505392 2010-04-21] (Symantec Corporation) 1 SRTSPX; C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS [32304 2010-04-21] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [221304 2011-08-21] (Symantec Corporation) 3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-10-16] (Symantec Corporation) 1 SymIRON; C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [150064 2010-04-28] (Symantec Corporation) 1 SYMTDIv; C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [451704 2011-08-21] (Symantec Corporation) 2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] () 3 wtsmpadap; C:\Windows\System32\Drivers\wtsmpadap.sys [56104 2009-01-30] (Swisscom) 3 WtSmpFlt; C:\Windows\System32\Drivers\WtSmpFlt.sys [383784 2009-01-30] (Swisscom) ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2013-01-19 22:01 - 2013-01-19 22:01 - 00000000 ____D C:\FRST 2013-01-19 09:38 - 2013-01-19 09:38 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Desktop\HiJackThis.exe 2013-01-19 09:04 - 2013-01-19 09:38 - 00014471 ____A C:\Users\Bromm\Desktop\hijackthis.log 2013-01-19 09:02 - 2013-01-19 09:02 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Downloads\HiJackThis.exe 2013-01-18 12:51 - 2013-01-18 12:51 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-01-18 12:51 - 2012-12-14 07:49 - 00024176 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2013-01-18 12:49 - 2013-01-18 12:50 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\Bromm\Downloads\mbam-setup-1.70.0.1100.exe 2013-01-18 04:40 - 2013-01-18 12:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\Malwarebytes 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-01-17 23:14 - 2013-01-17 23:14 - 00095392 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SMR311.SYS 2013-01-17 14:58 - 2013-01-17 23:33 - 00000000 ____D C:\Users\Bromm\AppData\Local\NPE 2013-01-17 14:49 - 2013-01-17 14:50 - 02957840 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\NPE.exe 2013-01-17 11:25 - 2013-01-17 11:25 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS (1).exe 2013-01-17 11:18 - 2013-01-17 11:18 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS.exe 2013-01-17 03:58 - 2013-01-17 03:58 - 00118784 _RASH C:\Users\Bromm\AppData\Roaming\makecabs.dll 2013-01-16 12:24 - 2013-01-11 18:30 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-01-16 12:24 - 2013-01-11 18:26 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-01-16 12:24 - 2013-01-11 18:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-01-16 12:23 - 2013-01-16 12:24 - 00004509 ____A C:\Windows\SysWOW64\jupdate-1.7.0_11-b21.log 2013-01-15 03:02 - 2013-01-17 11:35 - 00000000 ____D C:\Program Files (x86)\NirSoft 2013-01-15 03:01 - 2013-01-15 03:01 - 00260969 ____A C:\Users\Bromm\Downloads\wnetwatcher_setup.exe 2013-01-15 02:29 - 2013-01-15 02:29 - 20967680 ____A (Wireshark development team) C:\Users\Bromm\Downloads\Wireshark-win32-1.8.4.exe 2013-01-09 03:58 - 2012-11-22 19:45 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-01-09 03:58 - 2012-11-19 21:55 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2013-01-09 03:58 - 2012-11-19 21:10 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-01-09 03:58 - 2012-11-08 21:34 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2013-01-09 03:58 - 2012-11-08 20:49 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-01-09 03:58 - 2012-11-01 21:30 - 02001408 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2013-01-09 03:58 - 2012-11-01 21:30 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2013-01-09 03:58 - 2012-11-01 20:50 - 01388544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2013-01-09 03:58 - 2012-11-01 20:50 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2013-01-07 13:25 - 2013-01-03 21:31 - 00000000 ____D C:\Users\Bromm\Downloads\ppb 2013-01-06 14:35 - 2013-01-06 00:30 - 00000000 ___RD C:\Users\Bromm\Downloads\BG 2013-01-06 14:10 - 2012-10-07 21:27 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.9 2013-01-06 14:00 - 2012-09-30 20:34 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.8 2013-01-06 13:50 - 2012-09-23 18:47 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.7 2013-01-06 13:41 - 2012-09-16 10:14 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.6 2013-01-06 13:36 - 2012-09-09 20:48 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.5 2013-01-06 13:28 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.4 2013-01-06 13:21 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.3 2013-01-06 13:14 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.2.2 2013-01-06 13:06 - 2012-09-06 04:03 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.1.2 2013-01-06 10:28 - 2013-01-03 09:12 - 00000000 ___RD C:\Users\Bromm\Downloads\PSS 2013-01-05 07:35 - 2013-01-05 07:58 - 00000000 ____D C:\Users\Bromm\Documents\B1 2013-01-05 07:31 - 2013-01-18 12:00 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-01-05 07:31 - 2013-01-05 08:15 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\FileZilla 2013-01-05 07:29 - 2013-01-05 07:30 - 04702459 ____A (FileZilla Project) C:\Users\Bromm\Downloads\FileZilla_3.6.0.2_win32-setup.exe 2013-01-05 06:21 - 2011-01-18 21:30 - 00000000 ___RD C:\Users\Bromm\Downloads\M.C 2013-01-05 06:13 - 2011-09-19 07:39 - 00000000 ___RD C:\Users\Bromm\Downloads\Tri 2013-01-05 05:25 - 2012-05-01 04:22 - 00000000 ___RD C:\Users\Bromm\Downloads\LegFa 2013-01-05 02:53 - 2012-05-27 02:07 - 00000000 ___RD C:\Users\Bromm\Downloads\EH 2013-01-05 02:23 - 2012-06-27 23:27 - 00000000 ___RD C:\Users\Bromm\Downloads\SITW 2013-01-05 02:01 - 2013-01-02 23:44 - 00000000 ___RD C:\Users\Bromm\Downloads\T2 2013-01-05 01:30 - 2011-11-05 11:13 - 00000000 ___RD C:\Users\Bromm\Downloads\C.B 2013-01-04 13:33 - 2013-01-04 13:34 - 00000000 ___RD C:\Users\Bromm\Downloads\T.con 2013-01-04 13:06 - 2011-06-12 20:25 - 00000000 ___RD C:\Users\Bromm\Downloads\A.L 2012-12-22 17:59 - 2012-12-16 08:52 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll 2012-12-22 17:59 - 2012-12-16 06:40 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll 2012-12-22 17:59 - 2012-12-16 06:25 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2012-12-22 17:59 - 2012-12-16 06:25 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll ==================== One Month Modified Files and Folders ======= 2013-01-19 22:01 - 2013-01-19 22:01 - 00000000 ____D C:\FRST 2013-01-19 13:45 - 2010-06-11 19:25 - 00456728 ____A C:\Windows\System32\perfh014.dat 2013-01-19 13:45 - 2010-06-11 19:25 - 00077234 ____A C:\Windows\System32\perfc014.dat 2013-01-19 13:45 - 2009-07-13 21:13 - 01248852 ____A C:\Windows\System32\PerfStringBackup.INI 2013-01-19 12:02 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-01-19 12:01 - 2009-07-13 20:51 - 00135734 ____A C:\Windows\setupact.log 2013-01-19 12:01 - 2009-07-13 20:45 - 00009216 _____ C:\Windows\System32\umstartup.etl 2013-01-19 09:38 - 2013-01-19 09:38 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Desktop\HiJackThis.exe 2013-01-19 09:38 - 2013-01-19 09:04 - 00014471 ____A C:\Users\Bromm\Desktop\hijackthis.log 2013-01-19 09:02 - 2013-01-19 09:02 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Downloads\HiJackThis.exe 2013-01-19 04:16 - 2010-08-15 14:51 - 00000988 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-01-18 17:43 - 2010-06-11 18:39 - 01369048 ____A C:\Windows\WindowsUpdate.log 2013-01-18 17:40 - 2010-08-15 14:51 - 00000992 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-01-18 12:51 - 2013-01-18 12:51 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-01-18 12:51 - 2013-01-18 04:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-18 12:50 - 2013-01-18 12:49 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\Bromm\Downloads\mbam-setup-1.70.0.1100.exe 2013-01-18 12:11 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-01-18 12:11 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-01-18 12:03 - 2011-08-23 07:15 - 00000000 ____D C:\Users\Bromm\Tracing 2013-01-18 12:02 - 2010-08-15 13:45 - 00000000 ____D C:\users\Bromm 2013-01-18 12:00 - 2013-01-05 07:31 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-01-18 12:00 - 2012-03-31 09:24 - 00000000 ____D C:\Program Files (x86)\SamsungPrinterLiveUpdate 2013-01-18 12:00 - 2011-02-23 13:59 - 00000000 ____D C:\Program Files (x86)\Vuze 2013-01-18 12:00 - 2010-10-16 02:55 - 00000000 ____D C:\Users\All Users\Norton 2013-01-18 12:00 - 2010-04-21 02:59 - 00000000 ____D C:\Program Files (x86)\EgisTec IPS 2013-01-18 12:00 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-01-18 12:00 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration 2013-01-18 12:00 - 2009-02-14 09:48 - 00000000 ____D C:\Users\Bromm\Desktop\GBD-0.1.0.alpha8 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\Malwarebytes 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-01-18 02:04 - 2010-09-25 08:04 - 00000000 ____D C:\Users\Bromm\Desktop\kvitteringer 2013-01-17 23:33 - 2013-01-17 14:58 - 00000000 ____D C:\Users\Bromm\AppData\Local\NPE 2013-01-17 23:14 - 2013-01-17 23:14 - 00095392 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SMR311.SYS 2013-01-17 14:53 - 2010-06-11 18:36 - 00083932 ____A C:\Windows\PFRO.log 2013-01-17 14:50 - 2013-01-17 14:49 - 02957840 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\NPE.exe 2013-01-17 11:35 - 2013-01-15 03:02 - 00000000 ____D C:\Program Files (x86)\NirSoft 2013-01-17 11:25 - 2013-01-17 11:25 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS (1).exe 2013-01-17 11:18 - 2013-01-17 11:18 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS.exe 2013-01-17 07:08 - 2010-09-05 03:28 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\PrimoPDF 2013-01-17 06:12 - 2012-07-03 02:43 - 00000000 ____D C:\Users\Bromm\Desktop\Nitriding of frustules 2013-01-17 03:58 - 2013-01-17 03:58 - 00118784 _RASH C:\Users\Bromm\AppData\Roaming\makecabs.dll 2013-01-17 03:09 - 2012-06-01 05:19 - 00000000 ____D C:\Users\Bromm\Desktop\Golf 2 Reparasjoner 2013-01-16 23:47 - 2012-03-07 15:17 - 00000000 ____D C:\Users\Bromm\Desktop\Energiteknologi 2013-01-16 12:24 - 2013-01-16 12:23 - 00004509 ____A C:\Windows\SysWOW64\jupdate-1.7.0_11-b21.log 2013-01-16 12:24 - 2012-09-06 14:46 - 00000000 ____D C:\Program Files (x86)\Java 2013-01-15 03:01 - 2013-01-15 03:01 - 00260969 ____A C:\Users\Bromm\Downloads\wnetwatcher_setup.exe 2013-01-15 02:29 - 2013-01-15 02:29 - 20967680 ____A (Wireshark development team) C:\Users\Bromm\Downloads\Wireshark-win32-1.8.4.exe 2013-01-14 06:41 - 2012-11-01 03:19 - 00000000 ____D C:\Users\Bromm\Desktop\Diverse papirer CV 2013-01-13 06:12 - 2010-08-23 07:13 - 00000000 ____D C:\Program Files (x86)\JDownloader 2013-01-12 15:20 - 2010-10-28 09:23 - 00000000 ____D C:\Users\Bromm\AppData\Local\CrashDumps 2013-01-11 18:30 - 2013-01-16 12:24 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-01-11 18:26 - 2013-01-16 12:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-01-11 18:24 - 2013-01-16 12:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-01-10 03:23 - 2009-07-13 20:45 - 00426184 ____A C:\Windows\System32\FNTCACHE.DAT 2013-01-09 17:05 - 2010-04-21 02:48 - 00000000 ____D C:\Users\All Users\Microsoft Help 2013-01-09 16:56 - 2010-09-03 00:53 - 67599240 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-01-09 09:07 - 2002-07-04 03:20 - 00000494 ____A C:\Windows\Hsc5.ini 2013-01-06 00:30 - 2013-01-06 14:35 - 00000000 ___RD C:\Users\Bromm\Downloads\BG 2013-01-05 08:15 - 2013-01-05 07:31 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\FileZilla 2013-01-05 07:58 - 2013-01-05 07:35 - 00000000 ____D C:\Users\Bromm\Documents\B1 2013-01-05 07:30 - 2013-01-05 07:29 - 04702459 ____A (FileZilla Project) C:\Users\Bromm\Downloads\FileZilla_3.6.0.2_win32-setup.exe 2013-01-04 13:34 - 2013-01-04 13:33 - 00000000 ___RD C:\Users\Bromm\Downloads\T.con 2013-01-03 21:31 - 2013-01-07 13:25 - 00000000 ____D C:\Users\Bromm\Downloads\ppb 2013-01-03 13:46 - 2011-10-22 15:12 - 00000632 _RASH C:\Users\Bromm\ntuser.pol 2013-01-03 09:12 - 2013-01-06 10:28 - 00000000 ___RD C:\Users\Bromm\Downloads\PSS 2013-01-03 04:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\spool 2013-01-03 03:39 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF 2013-01-02 23:44 - 2013-01-05 02:01 - 00000000 ___RD C:\Users\Bromm\Downloads\T2 2012-12-27 17:58 - 2010-08-27 13:15 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\vlc ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2012-12-11 23:25] - [2012-09-06 09:38] - 0295792 ____A (Microsoft Corporation) 9E425AC5C9A5A973273D169F43B4F5E1 ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-01-16 12:23:15 Restore point made on: 2013-01-17 23:27:01 ==================== Memory info =========================== Percentage of memory in use: 17% Total physical RAM: 3958.71 MB Available physical RAM: 3247.7 MB Total Pagefile: 3956.86 MB Available Pagefile: 3231.86 MB Total Virtual: 8192 MB Available Virtual: 8191.91 MB ==================== Partitions ============================= 1 Drive c: (Acer) (Fixed) (Total:451.66 GB) (Free:126.51 GB) NTFS 2 Drive e: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.94 GB) NTFS 4 Drive g: (KINGSTON) (Removable) (Total:14.78 GB) (Free:0.19 GB) FAT32 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disknr. Status Str. Ledig Dyn GPT ——– ————- ——- ——- — — Disk 0 Tilkoblet 465 G byte 0 byte Disk 1 Tilkoblet 14 G byte 0 byte Partitions of Disk 0: =============== Partisjonsnr. Type Str. Forskyvning ————- —————- ——- ———– Partisjon 1 Gjenoppretting 14 G 31 K byte Partisjon 2 Prim‘r 101 M 14 G byte Partisjon 3 Prim‘r 451 G 14 G byte ================================================================================ == Disk: 0 Partisjon 1 Type : 27 Skjult: Ja Aktiv : Nei Forskyvning i byte: 32256 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 3 E PQSERVICE NTFS Partisjon 14 G OK Skjult ========================================================= Disk: 0 Partisjon 2 Type : 07 Skjult: Nei Aktiv : Ja Forskyvning i byte: 15035811840 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 1 Y SYSTEM RESE NTFS Partisjon 101 M OK ========================================================= Disk: 0 Partisjon 3 Type : 07 Skjult: Nei Aktiv : Nei Forskyvning i byte: 15142740480 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 2 C Acer NTFS Partisjon 451 G OK ========================================================= Partitions of Disk 1: =============== Partisjonsnr. Type Str. Forskyvning ————- —————- ——- ———– Partisjon 1 Prim‘r 14 G 4032 K byte ================================================================================ == Disk: 1 Partisjon 1 Type : 0C Skjult: Nei Aktiv : Nei Forskyvning i byte: 4128768 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 4 G KINGSTON FAT32 Flyttbar 14 G OK ========================================================= Last Boot: 2013-01-05 16:38 ==================== End Of Log =============================
Post #6
Please do the following:


Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt 

start
HKLM-x32\…\Run: [] [x]
HKLM-x32\…\Run: [ABSFIGGC] rundll32 "C:\Users\Bromm\AppData\Roaming\makecabs.dll",Vzridk [118784 2013-01-17] ()
C:\Users\Bromm\AppData\Roaming\makecabs.dll
end

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.


NEXT


Refer to the ComboFix User's Guide

  • Download ComboFix from the following location:

    Link

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

    ———————————————————————————————
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Post #7
I have now created the fixlist.txt, run the frst64 and pressed the fix button. I am however unable to boot normally, since the computer hangs up after entering my access code. Here is the fixlog.txt: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-01-2013 Ran by [removed] at 2013-01-19 23:31:04 Run:1 Running from G:\ ============================================== HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully. HKEY_LOCAL_MACHINE\software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ABSFIGGC Value deleted successfully. C:\Users\Bromm\AppData\Roaming\makecabs.dll moved successfully. ==== End of Fixlog ====
Post #8
are you able to boot into safe mode?

To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account
Post #11
I have now run the combofix from safe mode. I could not find Norton Internet Security at all in this mode. Here is the logfile combofix.txt: ComboFix 13-01-17.04 - Bromm 20.01.2013 0:41.1.4 - x64 NETWORK Microsoft Windows 7 Home Premium 6.1.7600.0.1252.47.1044.18.3959.3224 [GMT 1:00] Kjører fra: c:\users\Bromm\Desktop\ComboFix.exe AV: Norton Internet Security Online *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security Online *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security Online *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Opprettet nytt gjenopprettingspunkt . . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\FullRemove.exe c:\programdata\Local c:\windows\security\Database\tmp.edb c:\windows\wininit.ini . . ((((((((((((((((((((((((((( Filer Opprettet Fra 2012-12-19 til 2013-01-19 ))))))))))))))))))))))))))))))))) . . 2013-01-20 06:01 . 2013-01-20 06:01 ——– d—–w- C:\FRST 2013-01-19 23:50 . 2013-01-19 23:50 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-01-18 20:51 . 2012-12-14 15:49 24176 —-a-w- c:\windows\system32\drivers\mbam.sys 2013-01-18 12:40 . 2013-01-18 12:40 ——– d—–w- c:\users\Bromm\AppData\Roaming\Malwarebytes 2013-01-18 12:40 . 2013-01-18 12:40 ——– d—–w- c:\programdata\Malwarebytes 2013-01-18 12:40 . 2013-01-18 20:51 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2013-01-18 12:40 . 2013-01-18 12:40 ——– d—–w- c:\users\Bromm\AppData\Local\Programs 2013-01-18 07:14 . 2013-01-18 07:14 95392 —-a-w- c:\windows\system32\drivers\SMR311.SYS 2013-01-17 22:58 . 2013-01-18 07:33 ——– d—–w- c:\users\Bromm\AppData\Local\NPE 2013-01-16 20:24 . 2013-01-12 02:30 95648 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-01-15 11:02 . 2013-01-17 19:35 ——– d—–w- c:\program files (x86)\NirSoft 2013-01-09 11:58 . 2012-11-09 05:34 751104 —-a-w- c:\windows\system32\win32spl.dll 2013-01-09 11:58 . 2012-11-09 04:49 492032 —-a-w- c:\windows\SysWow64\win32spl.dll 2013-01-09 11:58 . 2012-11-02 05:30 2001408 —-a-w- c:\windows\system32\msxml6.dll 2013-01-09 11:58 . 2012-11-02 05:30 1880064 —-a-w- c:\windows\system32\msxml3.dll 2013-01-09 11:58 . 2012-11-02 04:50 1388544 —-a-w- c:\windows\SysWow64\msxml6.dll 2013-01-09 11:58 . 2012-11-02 04:50 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2013-01-09 11:58 . 2012-11-20 05:55 307200 —-a-w- c:\windows\system32\ncrypt.dll 2013-01-09 11:58 . 2012-11-20 05:10 219136 —-a-w- c:\windows\SysWow64\ncrypt.dll 2013-01-09 11:58 . 2012-11-23 03:45 3147264 —-a-w- c:\windows\system32\win32k.sys 2013-01-05 15:31 . 2013-01-05 16:15 ——– d—–w- c:\users\Bromm\AppData\Roaming\FileZilla 2013-01-05 15:31 . 2013-01-18 20:00 ——– d—–w- c:\program files (x86)\FileZilla FTP Client 2012-12-23 01:59 . 2012-12-16 16:52 46080 —-a-w- c:\windows\system32\atmlib.dll 2012-12-23 01:59 . 2012-12-16 14:25 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2012-12-23 01:59 . 2012-12-16 14:40 367616 —-a-w- c:\windows\system32\atmfd.dll 2012-12-23 01:59 . 2012-12-16 14:25 295424 —-a-w- c:\windows\SysWow64\atmfd.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-01-10 00:56 . 2010-09-03 08:53 67599240 —-a-w- c:\windows\system32\MRT.exe 2012-11-14 07:06 . 2012-12-12 15:11 17811968 —-a-w- c:\windows\system32\mshtml.dll 2012-11-14 06:32 . 2012-12-12 15:11 10925568 —-a-w- c:\windows\system32\ieframe.dll 2012-11-14 06:11 . 2012-12-12 15:11 2312704 —-a-w- c:\windows\system32\jscript9.dll 2012-11-14 06:04 . 2012-12-12 15:11 1346048 —-a-w- c:\windows\system32\urlmon.dll 2012-11-14 06:04 . 2012-12-12 15:11 1392128 —-a-w- c:\windows\system32\wininet.dll 2012-11-14 06:02 . 2012-12-12 15:11 1494528 —-a-w- c:\windows\system32\inetcpl.cpl 2012-11-14 06:02 . 2012-12-12 15:11 237056 —-a-w- c:\windows\system32\url.dll 2012-11-14 05:59 . 2012-12-12 15:11 85504 —-a-w- c:\windows\system32\jsproxy.dll 2012-11-14 05:58 . 2012-12-12 15:11 816640 —-a-w- c:\windows\system32\jscript.dll 2012-11-14 05:57 . 2012-12-12 15:11 599040 —-a-w- c:\windows\system32\vbscript.dll 2012-11-14 05:57 . 2012-12-12 15:11 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-11-14 05:55 . 2012-12-12 15:11 2144768 —-a-w- c:\windows\system32\iertutil.dll 2012-11-14 05:55 . 2012-12-12 15:11 729088 —-a-w- c:\windows\system32\msfeeds.dll 2012-11-14 05:53 . 2012-12-12 15:11 96768 —-a-w- c:\windows\system32\mshtmled.dll 2012-11-14 05:52 . 2012-12-12 15:11 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-11-14 05:46 . 2012-12-12 15:11 248320 —-a-w- c:\windows\system32\ieui.dll 2012-11-14 02:09 . 2012-12-12 15:11 1800704 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-11-14 01:58 . 2012-12-12 15:11 1427968 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-11-14 01:57 . 2012-12-12 15:11 1129472 —-a-w- c:\windows\SysWow64\wininet.dll 2012-11-14 01:49 . 2012-12-12 15:11 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-11-14 01:48 . 2012-12-12 15:11 420864 —-a-w- c:\windows\SysWow64\vbscript.dll 2012-11-14 01:44 . 2012-12-12 15:11 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb 2012-11-09 05:34 . 2012-12-12 07:26 2048 —-a-w- c:\windows\system32\tzres.dll 2012-11-09 04:49 . 2012-12-12 07:26 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2012-11-02 05:27 . 2012-12-12 07:25 478208 —-a-w- c:\windows\system32\dpnet.dll 2012-11-02 04:48 . 2012-12-12 07:25 376832 —-a-w- c:\windows\SysWow64\dpnet.dll 2002-12-09 09:25 . 2002-12-09 09:25 6139904 —-a-w- c:\program files (x86)\HSC.EXE 2002-12-09 07:45 . 2002-12-09 07:45 2215936 —-a-w- c:\program files (x86)\HeatLoss.exe 2002-12-05 11:52 . 2002-12-05 11:52 380928 —-a-w- c:\program files (x86)\GIBBS.EXE 2002-12-04 08:34 . 2002-12-04 08:34 995 —-a-w- c:\program files (x86)\SGM.PIF 2002-11-12 08:04 . 2002-11-12 08:04 573440 —-a-w- c:\program files (x86)\HSCHelp.exe 2002-10-14 15:21 . 2002-10-14 15:21 1523712 —-a-w- c:\program files (x86)\PIC.EXE 2002-10-14 13:40 . 2002-10-14 13:40 1028096 —-a-w- c:\program files (x86)\PSD.EXE 2002-08-09 09:37 . 2002-08-09 09:37 655360 —-a-w- c:\program files (x86)\HSCImage.exe 2002-08-09 09:34 . 2002-08-09 09:34 3080192 —-a-w- c:\program files (x86)\EPH.EXE 1992-05-25 13:15 . 1992-05-25 13:15 116736 —-a-w- c:\program files (x86)\CELL.EXE 1992-02-12 05:01 . 1992-02-12 05:01 308488 —-a-w- c:\program files (x86)\SGM.EXE . . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 94208 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2010-04-17 05:55 120176 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-21 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2009-12-24 284696] "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-04-17 337264] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920] "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-04-08 908368] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208] "Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2011-07-06 688128] "CLX3180_Scan2Pc"="c:\windows\Twain_32\Samsung\CLX3180\Scan2pc.exe" [2011-04-29 1990144] "3180 Scan2PC"="c:\windows\twain_32\Samsung\CLX3180\Scan2Pc.exe" [2011-04-29 1990144] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-26 1125152] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "HideFastUserSwitching"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer5"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130111.001\BHDrvx64.sys [2012-10-23 1384608] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [2011-08-04 593544] R1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130117.001\IDSvia64.sys [2012-09-01 513184] R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576] R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016] R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [2010-04-29 150064] R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [2011-08-22 451704] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-04-08 312400] R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-03-17 866336] R2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-24 13336] R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344] R2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [2011-08-04 126400] R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640] R2 SesamService;Sesam Control Service;c:\program files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe [2009-02-17 1237800] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-07-13 11576] R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784] R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-18 2320920] R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232] R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2012-06-19 645088] R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-03-05 335400] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-01 39464] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-09 138912] R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-03-20 114560] R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys [2010-03-20 13952] R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2010-08-27 138752] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176] R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-04-17 305520] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-03-01 239136] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-15 1255736] S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [2010-07-22 54848] S0 SMR311;Symantec SMR Utility Service 3.1.1;c:\windows\System32\drivers\SMR311.SYS [2013-01-18 95392] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1109000.00C\SYMDS64.SYS [2009-08-30 433200] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [2011-08-22 221304] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2010-03-21 321064] S3 wtsmpadap;Sesam Virtual Adapter;c:\windows\system32\DRIVERS\wtsmpadap.sys [2009-01-30 56104] S3 WtSmpFlt;Sesam Adapter;c:\windows\system32\DRIVERS\wtsmpflt.sys [2009-01-30 383784] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) . 2013-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-15 22:50] . 2013-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-08-15 22:50] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2010-10-06 23:36 97792 —-a-w- c:\users\Bromm\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2010-04-17 05:58 137584 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-29 9913376] "mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-04-17 349552] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-07 17412200] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-03-17 860704] "mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-06-21 1984832] . ——- Tilleggsskanning ——- . uStart Page = hxxp://www.sol.no/ uLocal Page = c:\windows\system32\blank.htm mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0414&m=aspire_5741g&r=27360810j245l04h4z155t6652k55q mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0414&m=aspire_5741g&r=27360810j245l04h4z155t6652k55q mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&ksporter til Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 DPF: DirectEdit - hxxps://www.itslearning.com/file/DirectEdit.CAB DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://sslvpn2.ntnu.no/CACHE/stc/3/binaries/vpnweb.cab . - - - - TOMME PEKERE FJERNET - - - - . Toolbar-Locked - (no file) Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\diMaster.dll\" /prefetch:1" . ——————— LÅSTE REGISTERNØKLER ——————— . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Tidspunkt ferdig: 2013-01-20 00:52:10 ComboFix-quarantined-files.txt 2013-01-19 23:52 . Pre-Run: 135 701 618 688 byte ledig Post-Run: 144 453 033 984 byte ledig . - - End Of File - - C77D706F9C23637FBA3C907B224BEAA2
Post #12
are you now able to boot normally?

If not, run the following scans in safe mode with networking:


Please download Junkware Removal Tool to your desktop.
  • Shutdown your antivirus to avoid any conflicts.
  • Right-mouse click JRT.exe and select Run as administrator
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message


NEXT


Download AdwCleaner from here and save it to your desktop.
  • Run AdwCleaner and select Delete
  • Once done it will ask to reboot, allow the reboot
  • On reboot a log will be produced, please attach the content of the log to your next reply


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish
Post #13
I have now completed all the previously mentioned steps. This was done from safe mode since the computer still hangs up upon normal booting (it hangs up just after entering password and the welcome sign is presented) Here is the log from Junkware Removal Tool (JRT.txt): ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.4.5 (01.19.2013:1) OS: Windows 7 Home Premium x64 Ran by [removed] on 20.01.2013 at 1:50:55,10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\partner" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 20.01.2013 at 1:53:34,33 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Here is the Adwcleaner log: # AdwCleaner v2.106 - Logfile created 01/20/2013 at 01:58:49 # Updated 17/01/2013 by Xplode # Operating system : Windows 7 Home Premium (64 bits) # User : Bromm - BROMM-PC # Boot Mode : Safe mode with networking # Running from : C:\Users\Bromm\Desktop\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. ************************* AdwCleaner[S1].txt - [520 octets] - [20/01/2013 01:58:49] ########## EOF - C:\AdwCleaner[S1].txt - [579 octets] ########## Here is the Malwarebytes log: (there appeared to be two separate logs so I include both) Log 1: Malwarebytes Anti-Malware (Trial) 1.70.0.1100 www.malwarebytes.org Database version: v2013.01.19.11 Windows 7 x64 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 Bromm :: BROMM-PC [administrator] Protection: Disabled 20.01.2013 02:16:51 mbam-log-2013-01-20 (02-16-51).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213206 Time elapsed: 3 minute(s), 11 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Log 2: 2013/01/20 01:00:54 +0100 BROMM-PC (null) MESSAGE Starting protection 2013/01/20 01:00:54 +0100 BROMM-PC (null) MESSAGE Protection started successfully 2013/01/20 01:00:54 +0100 BROMM-PC (null) MESSAGE Starting IP protection 2013/01/20 02:04:57 +0100 BROMM-PC Bromm MESSAGE Starting protection 2013/01/20 02:04:58 +0100 BROMM-PC Bromm MESSAGE Protection started successfully 2013/01/20 02:04:58 +0100 BROMM-PC Bromm MESSAGE Starting IP protection Here is the ESET log: C:\FRST\Quarantine\makecabs.dll a variant of Win32/Ponmocup.FS trojan C:\Program Files (x86)\Vuze\.install4j\i4j_extf_32_5p83tu.dll a variant of Win32/Bunndle application
Post #14
Please run the following:

Please download Windows Repair (all in one) from here

Install the program then run it

Go to step 2 and allow it to run Disk check

Once that is done then go to step 3 and allow it to run SFC

On the the Start Repairs tab => Click the Start

[external image: Posted Image]

Click on the select all check box and then click on Start

DON'T use the computer while each scan is in progress.

Restart may be needed to finish the repair procedure.
Post #15
Downloaded, installed and ran the windows repair. The disk scan does however require a reboot which results in a locked computer. After trying several times I managed to get something looking like a chkdsk screen upon startup after running the windows repair, then it rebooted to normal and hung up again… Can I perform the remaining steps after separately rebooting into safe mode?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI