FBI Moneypak Virus [Solved]
12 min read
Can you do this:
- Please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Plug the flash drive into the infected PC.
- If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
If you are using Vista or Windows 7 enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.
Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-…isc-create.html
To enter System Recovery Options by using Windows installation disc:
- Insert the installation disc.
- Restart your computer.
- If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
- Click Repair your computer.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account and click Next.
- On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Select Command Prompt
Once in the Command Prompt: - In the command window type in notepad and press Enter.
- The notepad opens. Under File menu select Open.
- Select "Computer" and find your flash drive letter and close the notepad.
- In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive. - The tool will start to run.
- When the tool opens click Yes to disclaimer.
- Press Scan button.
- It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
_____________________________________________
If you can't do that, then follow the instructions at the link below using HitmanPro Kickstart to remove the FBI malware:
FIRST: Please vaccinate yours and all computers with Panda USB Vaccine to prevent the spread of any infections.
http://www.selectrealsecurity.com/remove-ransomware
http://www.surfright.nl/en/kickstart
MrC
Please read the following information first.
You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.
BACKDOOR WARNING
——————————
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451
When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063
I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.
Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.
—————————————–
Please remove any usb or external drives from the computer before you run this scan!
Please download and run RogueKiller to your desktop.
RogueKiller<—use this one for 64 bit systems
Quit all running programs.
For Windows XP, double-click to start.
For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.
Click Scan to scan the system.
When the scan completes > Close out the program > Don't Fix anything!
Don't run any other options, they're not all bad!!!!!!!
Post back the report which should be located on your desktop.
(please don't put logs in code or quotes)
P2P Warning:
If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
MrC
Note:
Removing malware can be unpredictable…things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive
<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
<+>The removal of malware isn't instantaneous, please be patient.
<+>Please stick with me until I give you the "all clear".
——->Your topic will be closed if you haven't replied within 3 days!<——–
(If I don't respond within 24 hours, please send me a PM)
=====================================================
HKLM\…\Run: [dbtypi] "C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA [412160 2012-07-22] ()
HKU\Brianna\…\Run: [dbtypi] "C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA [412160 2012-07-22] ()
ZeroAccess:
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U\00000001.@
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U\80000000.@
C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U\800000cb.@
ZeroAccess:
C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}
C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@
C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L
C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U
C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
Here is the log:
RogueKiller V8.5.2 _x64_ [Feb 23 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User : Brianna [Admin rights]
Mode : Scan – Date : 03/06/2013 05:56:35
| ARK || FAK || MBR |
¤¤¤ Bad processes : 2 ¤¤¤
[DLL] rundll32.exe – C:\Windows\System32\rundll32.exe : C:\Users\Brianna\AppData\Roaming\dbtypi.dll [x] -> KILLED [TermProc]
[DLL] rundll32.exe – C:\Windows\SysWOW64\rundll32.exe : C:\Users\Brianna\AppData\Roaming\dbtypi.dll [x] -> KILLED [TermProc]
¤¤¤ Registry Entries : 12 ¤¤¤
[RUN][SUSP PATH] HKCU\[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[RUN][SUSP PATH] HKLM\[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-3872141776-2585948808-2999971105-1001[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[SHELL][SUSP PATH] HKCU\[…]\Winlogon : shell (C:\Users\Brianna\AppData\Roaming\ldr.mcb,explorer.exe) [x] -> FOUND
[SHELL][SUSP PATH] HKUS\S-1-5-21-3872141776-2585948808-2999971105-1001[…]\Winlogon : shell (C:\Users\Brianna\AppData\Roaming\ldr.mcb,explorer.exe) [x] -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [-] -> FOUND
[STARTUP][SUSP PATH] Best Buy pc app.lnk @Default User : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe [-] -> FOUND
[HJ] HKLM\[…]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[…]\Wow6432Node\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ INPROC][ZeroAccess] HKCR\[…]\InprocServer32 : (C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\n.) [x] -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] @ : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@ [-] –> FOUND
[ZeroAccess][FILE] @ : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@ [-] –> FOUND
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U –> FOUND
[ZeroAccess][FOLDER] U : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L –> FOUND
[ZeroAccess][FOLDER] L : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L –> FOUND
[Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe [-] –> FOUND
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: ST95005620AS +++++
— User —
[MBR] f2bb638caf84a5a831afff156fe50eb0
[BSP] 4bd723b63117cdb15f46b7ece45e83d8 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 64 | Size: 22000 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 45056064 | Size: 122569 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 296078203 | Size: 332370 Mo
User = LL1 … OK!
User = LL2 … OK!
+++++ PhysicalDrive1: JMCR SD/MMC SCSI Disk Device +++++
— User —
[MBR] d4af44344fbd0f905c07c67a2ce00570
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 239 | Size: 477 Mo
User = LL1 … OK!
Error reading LL2 MBR!
Finished : << RKreport[1]_S_03062013_02d0556.txt >>
RKreport[1]_S_03062013_02d0556.txt
When the scan completes > click on the Registry tab
Put a check next to all of these and uncheck the rest: (if found)
[RUN][SUSP PATH] HKCU\[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[RUN][SUSP PATH] HKLM\[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-3872141776-2585948808-2999971105-1001[…]\Run : dbtypi ("C:\Windows\System32\rundll32.exe" "C:\Users\Brianna\AppData\Roaming\dbtypi.dll",SetSingleInstanceA) [7] -> FOUND
[SHELL][SUSP PATH] HKCU\[…]\Winlogon : shell (C:\Users\Brianna\AppData\Roaming\ldr.mcb,explorer.exe) [x] -> FOUND
[SHELL][SUSP PATH] HKUS\S-1-5-21-3872141776-2585948808-2999971105-1001[…]\Winlogon : shell (C:\Users\Brianna\AppData\Roaming\ldr.mcb,explorer.exe) [x] -> FOUND
[HJ INPROC][ZeroAccess] HKCR\[…]\InprocServer32 : (C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\n.) [x] -> FOUND
Now click Delete on the right hand column under Options
————-
Next click on the Files tab and put a check next to these and uncheck the rest. (if found)
[ZeroAccess][FILE] @ : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@ [-] –> FOUND
[ZeroAccess][FILE] @ : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\@ [-] –> FOUND
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U –> FOUND
[ZeroAccess][FOLDER] U : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L –> FOUND
[ZeroAccess][FOLDER] L : C:\Users\Brianna\AppData\Local\{b84a9617-79ac-e125-59b4-5520f760cf6e}\L –> FOUND
[Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe [-] –> FOUND
Now click Delete on the right hand column under Options
————-
Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)
[DLL] rundll32.exe – C:\Windows\System32\rundll32.exe : C:\Users\Brianna\AppData\Roaming\dbtypi.dll [x] -> KILLED [TermProc]
[DLL] rundll32.exe – C:\Windows\SysWOW64\rundll32.exe : C:\Users\Brianna\AppData\Roaming\dbtypi.dll [x] -> KILLED [TermProc]
Now click Delete on the right hand column under Options
————-
Then……………..
Please read the directions carefully so you don't end up deleting something that is good!!
If in doubt about an entry….please ask or choose Skip!!!!
Don't Delete anything unless instructed to!
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue
If a suspicious object is detected, the default action will be Skip, click on Continue
Please note that TDSSKiller can be run in safe mode if needed.
Here's a video that explains how to run it if needed:
How To Run TDSSKiller
Please download the latest version of TDSSKiller from here and save it to your Desktop.
- Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
[external image: Posted Image]
- Put a checkmark beside loaded modules.
[external image: Posted Image]
- A reboot will be needed to apply the changes. Do it.
- TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
- Then click on Change parameters in TDSSKiller.
- Check all boxes then click OK.
[external image: Posted Image]
- Click the Start Scan button.
[external image: Posted Image]
- The scan should take no longer than 2 minutes.
- If a suspicious object is detected, the default action will be Skip, click on Continue.
[external image: Posted Image]
Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
If in doubt about an entry….please ask or choose Skip
- If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
[external image: Posted Image]
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed. - A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
- Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.
Here's a summary of what to do if you would like to print it out:
If in doubt about an entry….please ask or choose Skip
Don't Delete anything unless instructed to!
If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue
Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
~~~~~~~~~~~~~~~~~~~~
MrC
Please download and run ComboFix.
The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.
Please visit this webpage for download links, and instructions for running ComboFix
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Information on disabling your malware programs can be found Here.
Make sure you run ComboFix from your desktop.
Give it at least 30-45 minutes to finish if needed.
Please include the C:\ComboFix.txt in your next reply for further review.
———->NOTE<———-
If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix….please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC
Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.
Make sure that everything is checked, and click Remove Selected.
Please let me know how computer is running now, MrC
Then…………….
Please download AdwCleaner from here and save it on your Desktop.
AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.
AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)
It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode.
- Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
- Now click on the Search tab.
- Please post the contents of the log-file created in your next post.
Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <– Denotes the number of times the application has been ran, so in this should be something like R1.
Note:
Please look over what was found……especially any folders, we're going to permanently delete it all in the next step….if there's something you may want to keep…please let me know and I'll explain to why it shouldn't be on your system.
If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.
MrC
Please create a new system restore point before continuing.
Lots of adware found….lets clear it out…..
- Please re-run AdwCleaner
- Click on Delete button.
- Confirm each time with OK if asked.
- Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Then……
Lets check your computers security before you go and we have a little cleanup to do also:
Download Security Check by screen317 from HERE or HERE.
- Save it to your Desktop.
- Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt.
- Please Post the contents of that document.
- Do Not Attach It!!!
# AdwCleaner v2.114 - Logfile created 03/12/2013 at 15:17:57
# Updated 05/03/2013 by Xplode
# Operating system : Windows 7 Home Premium (64 bits)
# User : Brianna - BRIANNA-PC
# Boot Mode : Normal
# Running from : C:\Users\Brianna\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\Yontoo Layers Runtime
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Brianna\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registry] *****
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16464
[OK] Registry is clean.
-\\ Google Chrome v25.0.1364.97
File : C:\Users\Brianna\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [5398 octets] - [11/03/2013 18:20:57]
AdwCleaner[S1].txt - [5447 octets] - [12/03/2013 15:17:57]
########## EOF - C:\AdwCleaner[S1].txt - [5507 octets] ##########
Results of screen317's Security Check version 0.99.61
Windows 7 x64 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.70.0.1100
Java™ 6 Update 31
Java version out of Date!
Adobe Reader 10.1.3 Adobe Reader out of Date!
Google Chrome 24.0.1312.57
Google Chrome 25.0.1364.97
Google Chrome plugins…
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI