trojan horse.mpr [Solved]

My PC runs windows 7. I think I must have infected my computer with this virus a couple of days ago, as I think it was the evening of the 11th March that I started getting the messages from AVG. It detects the Trojan Horse Hider.mpr virus but then when i try and move it to the vault it states it cant find it. It is also detecting another virus ffrqbsabb.exe, but it does move this one to the vault, though it keeps reappearing. Yesterday there was an unauthorised transaction on my paypal account and I guess that this may be as a result of my PC's compromised security. Furthermore it is affecting some other programs like open office writer, which crashed a few seconds after being opened. And it is preventing me going on antivirus sites, such as AVG. Having spent most of the day searching online for a solution, I decided that i was not competent enough to tray a manual removal and to be honest I could not find the files that were described anyway.. I eventually tried smart defenderand removed 2 threats, but the ffrqbsabb.exe popped up again. I have not yet done a full scan with that program as I read one of the posts on here which suggested not doing anything until listening to the experts. I am hoping that a full re-install will not be necessary, but am not overly hopeful. Thanks in anticipation, Rick

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:12:00, on 13/03/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16448)
Boot mode: Safe mode with network support

Running processes:
C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Rick\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://signin.ebay.co.uk/ws/eBayISAPI.dll?…%26MT_ID%3D1327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
R3 - URLSearchHook: WiseConvert B Toolbar - {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWise.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,,C:\Users\Rick\AppData\Local\ftfjonre\nwwvyqxu.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WiseConvert B - {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWise.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~2\Datamngr\ToolBar\searchqudtx.dll
O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~2\Datamngr\BROWSE~1.DLL
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~2\Datamngr\ToolBar\searchqudtx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: WiseConvert B Toolbar - {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWise.dll
O3 - Toolbar: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~2\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
O4 - HKLM\..\Run: [Anvi Smart Defender] C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe
O4 - HKCU\..\Run: [HP Officejet Pro 8600 (NET)] "C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN1C81R0SQ05KD:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [NwwVyqxu] C:\Users\Rick\AppData\Local\ftfjonre\nwwvyqxu.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: CurseClientStartup.ccip
O4 - Startup: nwwvyqxu.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/select/asusTek_sys_ctrl3.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {BAD4FE2C-503B-45CC-88CD-4B0574057D11} (FuturemarkSystemInfoX Class) - http://clients.futuremark.com/calico/syste…/FMSI_v4110.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
O23 - Service: ASDR - Unknown owner - C:\Windows\SysWOW64\ASDR.exe
O23 - Service: Anvi Smart Defender Realtime Guard Service (asdsrv) - Anvisoft - C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe
O23 - Service: ATK Fast User Switch Service (ATKFUSService) - Unknown owner - C:\Windows\system32\ATKFUSService.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HsdService - Virgin Media - C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

–
End of file - 14276 bytes

Firstly Mr Charlie, thanks for your quick response.

I believe i did things correctly, though initially i think Anvisoft was still running, so i uninstalled it and ran the first scan again.


DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16448
Run by [removed] at 18:18:29 on 2013-03-14
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4095.2629 [GMT 0:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ATKFUSService.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe
C:\Windows\SysWOW64\ASDR.exe
C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe
C:\Program Files\SmartTechnology\Software\ProfilerU.exe
C:\Program Files\SmartTechnology\Software\SaiMfd.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
C:\Program Files (x86)\ASUS\SmartDoctor\SmartDoctor.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Users\Rick\AppData\Local\Apps\2.0\EY1JLM9T.6B4\E27TVR54.WC8\curs..tion_9e9e83ddf3ed3ead_0005.0001_f98d05d4713e76ec\CurseClient.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\AVG\AVG10\avgui.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://signin.ebay.co.uk/ws/eBayISAPI.dll?SignIn&ru;=http%3A%2F%2Fwww.ebay.co.uk%2F%3Fclk_rvr_id%3D370262363523%26keyword%3Debay.%2Bu.k.%26geo_id%3D32251%26adpos%3D1t1%26crlp%3D15789102725_1924481%26MT_ID%3D1327
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
uURLSearchHooks: WiseConvert B Toolbar: {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWis0.dll
mURLSearchHooks: WiseConvert B Toolbar: {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWis0.dll
mWinlogon: Userinit = userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} -
BHO: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: WiseConvert B Toolbar: {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWis0.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll
BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: WiseConvert B Toolbar: {2713B394-286F-4D7C-89EA-4174EEAB9F5A} - C:\Program Files (x86)\WiseConvert_B\prxtbWis0.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: WiseConvert B Toolbar: {2713b394-286f-4d7c-89ea-4174eeab9f5a} - C:\Program Files (x86)\WiseConvert_B\prxtbWis0.dll
TB: IObit Toolbar: {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll
uRun: [HP Officejet Pro 8600 (NET)] "C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN1C81R0SQ05KD:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [ASUSGamerOSD] C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe
mRun: [DATAMNGR] C:\PROGRA~2\SEARCH~2\Datamngr\DATAMN~1.EXE
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [SearchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
StartupFolder: C:\Users\Rick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {BAD4FE2C-503B-45CC-88CD-4B0574057D11} - hxxp://clients.futuremark.com/calico/systeminfodeploy/FMSI_v4110.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{82C49DB5-45DA-49A8-A13A-ADA200F4482D} : DHCPNameServer = [removed] [removed]
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
x64-mSearchAssistant = hxxp://www.google.com/ie
x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe
x64-Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-SSODL: WebCheck -
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;C:\Windows\System32\drivers\AVGIDSEH.sys [2011-2-22 26704]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2011-3-16 37456]
R0 SmartDefragDriver;SmartDefragDriver;C:\Windows\System32\drivers\SmartDefragDriver.sys [2011-11-3 17720]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-11-12 312160]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2011-3-1 41552]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2011-4-4 377936]
R1 EIO64;EIO Driver;C:\Windows\System32\drivers\EIO64.sys [2012-2-14 16384]
R2 Application Updater;Application Updater;C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe [2013-2-23 805752]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [2011-2-8 269520]
R2 HsdService;HsdService;C:\Program Files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-7-25 1406264]
R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2011-11-3 820568]
R2 ServicepointService;ServicepointService;C:\Program Files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-7-25 689464]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-5-15 382272]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\AVGIDSDriver.sys [2011-5-27 118864]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\AVGIDSFilter.sys [2011-2-10 29264]
R3 IOMap;IOMap;C:\Windows\System32\drivers\IOMap64.sys [2012-2-14 23680]
R3 SaiKA50A;SaiKA50A;C:\Windows\System32\drivers\SaiKA50A.sys [2009-9-14 147976]
R3 SaiUA50A;SaiUA50A;C:\Windows\System32\drivers\SaiUA50A.sys [2009-9-14 41224]
RUnknown asdws;asdws; [x]
S2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-1-31 7391072]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 FileMonitor;FileMonitor;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2011-11-3 20336]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-6-20 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-3-8 1492840]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2012-8-21 150464]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2011-11-3 33184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-6 59392]
S3 UrlFilter;UrlFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\UrlFilter.sys [2011-11-3 21872]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-24 1255736]
S3 WSDScan;WSD Scan Support via UMB;C:\Windows\System32\drivers\WSDScan.sys [2009-7-14 25088]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
SUnknown asdrm;asdrm; [x]
.
=============== Created Last 30 ================
.
2013-03-13 18:05:28 ——– d—–w- C:\Users\Rick\AppData\Roaming\Anvisoft
2013-03-13 18:05:20 ——– d—–w- C:\ProgramData\Anvisoft
2013-03-13 18:05:19 ——– d—–w- C:\Program Files (x86)\Anvisoft
2013-03-13 09:52:25 ——– d—–w- C:\Users\Rick\AppData\Roaming\SpeedyPC Software
2013-03-13 09:52:17 ——– d—–w- C:\ProgramData\SpeedyPC Software
2013-03-13 08:41:22 ——– d—–w- C:\Users\Rick\AppData\Roaming\TuneUp Software
2013-03-13 08:38:57 ——– d—–w- C:\Users\Rick\AppData\Local\{A6C17E18-9A11-4963-B9B6-2343C49228A0}
2013-03-12 16:50:43 ——– d—–w- C:\Program Files (x86)\IObit Toolbar
2013-03-12 16:50:43 ——– d—–w- C:\Program Files (x86)\Common Files\Spigot
2013-03-12 16:50:43 ——– d—–w- C:\Program Files (x86)\Application Updater
2013-03-12 14:24:16 ——– d—–w- C:\Users\Rick\AppData\Local\{459B0D10-0DC8-49CC-96C6-3475BC06EB38}
2013-03-11 18:00:33 ——– d—–w- C:\Users\Rick\AppData\Local\ftfjonre
2013-03-11 13:53:06 ——– d—–w- C:\Users\Rick\AppData\Local\{BDFA1DA5-EEA3-42AD-BE08-BB0F54C6E31E}
2013-03-10 20:36:34 ——– d—–w- C:\Users\Rick\AppData\Local\{4FDC1E9C-6B03-4640-8695-7B38882DF08A}
2013-03-10 08:35:57 ——– d—–w- C:\Users\Rick\AppData\Local\{FF3219D3-BDC1-4E96-B3D4-61A9156E91FA}
2013-03-09 15:25:38 ——– d—–w- C:\Users\Rick\AppData\Local\{6DD43F07-BB99-489E-829B-375A098CEC1C}
2013-03-09 01:15:07 ——– d—–w- C:\Users\Rick\AppData\Local\{A65666A2-E48C-40EF-A79E-7ACD11A78074}
2013-03-08 11:34:02 ——– d—–w- C:\Users\Rick\AppData\Local\{9877E97D-72AC-46BA-9D60-6E4D452EE6EC}
2013-03-07 23:33:26 ——– d—–w- C:\Users\Rick\AppData\Local\{3E9176E3-6E34-4563-B4CE-67E9C62C1AFB}
2013-03-07 11:32:50 ——– d—–w- C:\Users\Rick\AppData\Local\{E02B6C1E-D51A-455F-AD92-01E511C08320}
2013-03-06 22:54:49 ——– d—–w- C:\Users\Rick\AppData\Local\{17050581-EB63-4F74-B3E0-3C10A942CBB4}
2013-03-06 10:54:11 ——– d—–w- C:\Users\Rick\AppData\Local\{94DB3FE0-CCC7-4DEC-BAA4-29739A8E839E}
2013-03-05 13:18:39 ——– d—–w- C:\Users\Rick\AppData\Local\{A79602A5-C0CA-46E3-9384-09E20B7F72F7}
2013-03-05 01:18:14 ——– d—–w- C:\Users\Rick\AppData\Local\{F698B971-720D-46A0-A270-F64AFC629A00}
2013-03-04 11:33:35 ——– d—–w- C:\Users\Rick\AppData\Local\{9D01F58C-8E75-4DC2-AB48-6CCCA6565953}
2013-03-03 14:56:11 ——– d—–w- C:\Users\Rick\AppData\Local\{F7395BC1-DFA5-4A28-9E9A-EEA57CD610DB}
2013-03-03 09:30:22 ——– d—–w- C:\Users\Rick\AppData\Local\{4E439CC6-A2FB-47BF-95E8-A0AD6F52980E}
2013-03-02 20:56:00 ——– d—–w- C:\Users\Rick\.minecraft
2013-03-02 20:00:42 ——– d—–w- C:\Users\Rick\AppData\Roaming\.technic
2013-03-02 12:55:08 ——– d—–w- C:\Users\Rick\AppData\Local\{C0539951-F653-4F2F-A6AD-8402F851BD05}
2013-03-01 15:50:29 ——– d—–w- C:\Users\Rick\AppData\Local\{8AF7C6FB-CA64-4628-8F07-C2735DF86390}
2013-02-28 23:41:16 ——– d—–w- C:\Users\Rick\AppData\Local\{CF3E8183-8C66-4490-9E5E-E9DAB7380DCA}
2013-02-28 11:03:20 ——– d—–w- C:\Users\Rick\AppData\Local\{17E09BBA-1540-4F46-84EE-795A03E51F0F}
2013-02-27 20:57:16 ——– d—–w- C:\Users\Rick\AppData\Local\{56795E78-58D2-4486-900C-EFBCFE21BD95}
2013-02-26 13:48:46 ——– d—–w- C:\Users\Rick\AppData\Local\{B6185425-8298-4803-9C90-EBAA2F6E3F14}
2013-02-26 00:36:31 ——– d—–w- C:\Users\Rick\AppData\Local\{6EE5A957-C6B9-4362-A441-3543284F0B1A}
2013-02-25 19:01:12 ——– d—–w- C:\Program Files (x86)\Conduit
2013-02-25 10:42:23 ——– d—–w- C:\Users\Rick\AppData\Local\{CB0370E7-391A-4758-B958-C598EF1A49F9}
2013-02-24 22:41:47 ——– d—–w- C:\Users\Rick\AppData\Local\{5B7C697D-B63E-48F4-914A-4F5177CA99F2}
2013-02-24 10:41:11 ——– d—–w- C:\Users\Rick\AppData\Local\{2B37A8D6-29F9-4422-A7AB-55BA3F384A7E}
2013-02-23 18:06:23 ——– d—–w- C:\Users\Rick\AppData\Local\{03A766E8-1E29-4A89-A097-B7930150CF83}
2013-02-22 23:31:10 ——– d—–w- C:\Users\Rick\AppData\Local\{928BFBE1-0184-4ED4-B199-2A4764CDA110}
2013-02-22 10:27:38 ——– d—–w- C:\Users\Rick\AppData\Local\{42E6CE6A-93FA-41B5-861A-4ECCDD48C92E}
2013-02-21 22:27:03 ——– d—–w- C:\Users\Rick\AppData\Local\{BF716E4C-856E-47A4-9B93-9D40CBBA8D2A}
2013-02-21 09:03:47 ——– d—–w- C:\Users\Rick\AppData\Local\{A7251885-C790-4472-BDC0-26AC299D30B5}
2013-02-20 15:59:35 ——– d—–w- C:\Users\Rick\AppData\Local\{8F4BBFD2-9D87-4D49-9472-FCB47BCA5B7C}
2013-02-19 11:06:34 ——– d—–w- C:\Users\Rick\AppData\Local\{3A34810B-63AB-4870-A748-35142BDBD634}
2013-02-18 11:20:12 ——– d—–w- C:\Users\Rick\AppData\Local\{D654128F-E71A-40BE-876B-985959A1195A}
2013-02-17 23:19:36 ——– d—–w- C:\Users\Rick\AppData\Local\{21AB2F5A-52BF-47F0-A545-1A170505F3E9}
2013-02-17 10:55:45 ——– d—–w- C:\Users\Rick\AppData\Local\{7F813156-55E9-4540-B4CA-C63A8F438CA3}
2013-02-16 14:05:03 ——– d—–w- C:\Users\Rick\AppData\Local\{1E9D19D2-55EC-4DE6-8B22-3C619BDBEECE}
2013-02-15 22:04:52 208448 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-02-15 19:05:35 ——– d—–w- C:\Program Files (x86)\WiseConvert_B
2013-02-15 10:49:21 ——– d—–w- C:\Users\Rick\AppData\Local\{5CE5BC0C-A4A6-475F-B36D-E130BEA25E8C}
2013-02-14 21:41:49 ——– d—–w- C:\Users\Rick\AppData\Local\{A96F9F43-9CCE-435D-8EE5-462A07B1C02A}2013-02-14 09:29:02 ——– d—–w- C:\Users\Rick\AppData\Local\{2DEE804D-63F0-4EFA-B923-E23E0B1AD2FC}
2013-02-13 09:55:13 ——– d—–w- C:\Users\Rick\AppData\Local\{C01BBA5D-DDC5-4F03-8AA3-494E1D502BC9}
.
==================== Find3M ====================
.
2013-03-12 23:30:36 73432 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-12 23:30:36 693976 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-01-07 00:42:28 281688 —-a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2013-01-07 00:42:28 281688 —-a-w- C:\Windows\SysWow64\PnkBstrB.exe
2013-01-06 20:14:53 281688 —-a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2012-12-25 11:10:11 76888 —-a-w- C:\Windows\SysWow64\PnkBstrA.exe
.
============= FINISH: 18:18:48.74 ===============



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 05/11/2009 15:36:58
System Uptime: 14/03/2013 17:58:17 (1 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P5N-E SLI
Processor: Intel® Core™2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 932 GiB total, 92.537 GiB free.
D: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP285: 14/09/2012 19:13:55 - Scheduled Checkpoint
RP286: 21/09/2012 23:27:24 - Scheduled Checkpoint
RP287: 27/09/2012 08:27:07 - Removed Mumble 1.2.3
RP288: 04/10/2012 22:30:13 - Scheduled Checkpoint
RP289: 12/10/2012 18:39:08 - Scheduled Checkpoint
RP290: 21/10/2012 13:32:03 - Scheduled Checkpoint
RP291: 28/10/2012 21:42:01 - Scheduled Checkpoint
RP292: 05/11/2012 17:40:32 - Scheduled Checkpoint
RP293: 13/11/2012 17:48:21 - Scheduled Checkpoint
RP294: 20/11/2012 21:10:01 - Scheduled Checkpoint
RP295: 27/11/2012 21:56:10 - Scheduled Checkpoint
RP296: 07/12/2012 17:10:18 - Scheduled Checkpoint
RP297: 16/12/2012 10:22:24 - Scheduled Checkpoint
RP298: 23/12/2012 12:16:33 - Scheduled Checkpoint
RP299: 25/12/2012 10:51:18 - Installed Far Cry 3
RP300: 01/01/2013 19:17:55 - Scheduled Checkpoint
RP301: 09/01/2013 22:41:48 - Scheduled Checkpoint
RP302: 17/01/2013 18:16:57 - Scheduled Checkpoint
RP303: 22/01/2013 19:59:37 - Installed 7-Zip 9.20 (x64 edition)
RP304: 23/01/2013 12:02:27 - Installed QuickTime
RP305: 24/01/2013 16:41:39 - Device Driver Package Install: Texas Instruments, Inc Multi-port serial adapters
RP306: 24/01/2013 16:42:36 - Device Driver Package Install: Texas Instruments Ports (COM & LPT)
RP307: 01/02/2013 12:15:33 - Scheduled Checkpoint
RP308: 08/02/2013 14:40:02 - Scheduled Checkpoint
RP309: 15/02/2013 21:09:28 - Scheduled Checkpoint
RP310: 24/02/2013 13:36:55 - Scheduled Checkpoint
RP311: 04/03/2013 10:44:59 - Scheduled Checkpoint
RP312: 12/03/2013 21:10:57 - Scheduled Checkpoint
.
==== Installed Programs ======================
.
3DMark 11
3DMark06
7-Zip 9.20 (x64 edition)
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader XI (11.0.02)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASUS Gamer OSD
ASUS nVidia Driver
ASUS Smart Doctor
AVG 2011
BitTorrent
Bonjour
Call of Duty: Black Ops
Call of Duty: Black Ops - Multiplayer
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
CCleaner
ConvertXtoDVD 3.3.4.106e
Curse Client
Curse Client - 1
D3DX10
Driver Manager
Epson Easy Photo Print 2
Epson Print CD
EPSON PX700W Series Printer Uninstall
Express Zip File Compression Software
Far Cry 3
Free Realms Installer
Futuremark SystemInfo
Game Booster 3
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Hewlett-Packard ACLM.NET v1.1.0.0
HP FWUpdateEDO2
HP Officejet Pro 8600 Basic Device Software
HP Officejet Pro 8600 Help
HP Product Detection
HP Update
I.R.I.S. OCR
iLivid
IObit Malware Fighter
IObit Toolbar v7.0
iTunes
Java Auto Updater
Java™ 6 Update 29
Junk Mail filter update
McAfee Security Scan Plus
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft IntelliType Pro 8.0
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MobileMe Control Panel
MSVCRT
MSVCRT_amd64
Nomadio Digital RC Desktop, 2.0
NVIDIA 3D Vision Controller Driver
NVIDIA 3D Vision Controller Driver 301.42
NVIDIA 3D Vision Driver 301.42
NVIDIA Control Panel 301.42
NVIDIA Graphics Driver 301.42
NVIDIA HD Audio Driver [removed]
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0213
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 1.8.15
NVIDIA Update Components
OpenAL
OpenOffice.org 3.1
PunkBuster Services
Radialpoint Security Advisor 2.5.19
RaidCall
Roblox for Rick
Safari
Searchqu Toolbar
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Skype Click to Call
Skype™ 5.5
Smart Defrag 2
Smart Technology Programming Software [removed]
Star Wars: The Old Republic
Steam
System Requirements Lab
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Uplay
Utility
Ventrilo Client for Windows x64
Virgin Media Digital Home Support 2.1.27
Virgin Media Service Manager 3.7.47
Visual C++ 8.0 Runtime Setup Package (x64)
Visual Studio 2008 x64 Redistributables
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinZip 14.5
WiseConvert B Toolbar
World of Tanks v.0.6.7
World of Warcraft
XviD MPEG-4 Video Codec
Yahoo! Detect
.
==== Event Viewer Messages From Past Week ========
.
14/03/2013 18:02:30, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
14/03/2013 18:02:30, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.
14/03/2013 18:00:52, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891
14/03/2013 18:00:52, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891
14/03/2013 18:00:35, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
13/03/2013 19:10:04, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
13/03/2013 19:09:08, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service NVSvc with arguments "" in order to run the server: {DCAB0989-1301-4319-BE5F-ADE89F88581C}
13/03/2013 19:08:32, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
13/03/2013 19:08:32, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
13/03/2013 18:32:12, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
13/03/2013 18:30:28, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
13/03/2013 18:30:28, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
13/03/2013 18:30:24, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
13/03/2013 18:30:17, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
13/03/2013 18:30:12, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: asdnet asdrm Avgldx64 Avgmfx64 discache spldr Wanarpv6
13/03/2013 18:30:12, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
13/03/2013 18:30:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
13/03/2013 18:30:09, Error: Service Control Manager [7001] - The Media Center Extender Service service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
13/03/2013 17:40:28, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McComponentHostService with arguments "" in order to run the server: {CC6F4D12-8575-4CFF-9455-CF5774AEB13B}
13/03/2013 16:42:44, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx64 Avgmfx64 discache spldr Wanarpv6
13/03/2013 16:26:28, Error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
11/03/2013 23:02:38, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
09/03/2013 10:13:49, Error: Service Control Manager [7034] - The EPSON V3 Service4(01) service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================


RogueKiller V8.5.3 _x64_ [Mar 13 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Rick [Admin rights]
Mode : Scan – Date : 03/14/2013 18:26:42
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 11 ¤¤¤
[HJ] HKLM\[…]\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[…]\Wow6432Node\System : EnableLUA (0) -> FOUND
[HJ] HKLM\[…]\Wow6432Node\Security Center : AntiVirusDisableNotify (1) -> FOUND
[HJ] HKLM\[…]\Wow6432Node\Security Center : FirewallDisableNotify (1) -> FOUND
[HJ] HKLM\[…]\Wow6432Node\Security Center : UpdatesDisableNotify (1) -> FOUND
[HJ DESK] HKCU\[…]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKCU\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST310005 28AS SCSI Disk Device +++++
— User —
[MBR] 4305a8b03104881c9f3b6220a96b6614
[BSP] d197c4fc235b4b8ad7489e24a892bbf5 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 953867 Mo
User = LL1 … OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: SanDisk Cruzer Blade USB Device +++++
— User —
[MBR] a124dc1f32b91ceacb765c7a5ad6ec2e
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 15266 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[1]_S_03142013_02d1826.txt >>
RKreport[1]_S_03142013_02d1826.txt

here is the log from combofix ComboFix 13-03-16.02 - Rick 16/03/2013 21:07:52.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4095.2844 [GMT 0:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\users\Rick\AppData\Local\bshplfef.log c:\users\Rick\AppData\Local\dobmxeii.log c:\users\Rick\AppData\Local\hdtcdnfg.log c:\users\Rick\AppData\Local\kgmngmyl.log c:\users\Rick\AppData\Local\odjorpso.log c:\users\Rick\AppData\Local\ptncnmao.log c:\users\Rick\AppData\Local\qtgrltdf.log c:\users\Rick\AppData\Local\tmejtijj.log c:\users\Rick\AppData\Roaming\inst.exe c:\users\Rick\AppData\Roaming\vso_ts_preview.xml c:\users\Rick\WINDOWS . . ((((((((((((((((((((((((( Files Created from 2013-02-16 to 2013-03-16 ))))))))))))))))))))))))))))))) . . 2013-03-16 21:24 . 2013-03-16 21:24 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp 2013-03-16 21:24 . 2013-03-16 21:24 ——– d—–w- c:\users\Mcx1-HOME\AppData\Local\temp 2013-03-16 21:24 . 2013-03-16 21:24 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-03-14 20:53 . 2013-03-14 20:53 ——– d—–w- c:\program files (x86)\RegCure 2013-03-14 20:53 . 2013-03-14 20:53 ——– d—–w- c:\programdata\RegCure 2013-03-14 20:36 . 2013-03-14 20:36 ——– d—–w- c:\windows\CD95F661A5C444F5A6AAECDD91C240BD.TMP 2013-03-14 20:28 . 2013-03-14 20:28 ——– d—–w- c:\programdata\Malwarebytes 2013-03-14 20:25 . 2013-03-14 20:26 ——– d—–w- c:\users\Rick\AppData\Local\Fuze Zip 2013-03-14 20:25 . 2013-03-14 20:25 ——– d—–w- c:\program files (x86)\Search Results Toolbar 2013-03-14 20:24 . 2013-03-14 20:25 ——– d—–w- c:\program files (x86)\Fuze Zip 2013-03-13 18:05 . 2013-03-14 18:18 ——– d—–w- c:\users\Rick\AppData\Roaming\Anvisoft 2013-03-13 18:05 . 2013-03-13 18:05 ——– d—–w- c:\programdata\Anvisoft 2013-03-13 18:05 . 2013-03-13 18:05 ——– d—–w- c:\program files (x86)\Anvisoft 2013-03-13 09:52 . 2013-03-13 09:52 ——– d—–w- c:\users\Rick\AppData\Roaming\SpeedyPC Software 2013-03-13 09:52 . 2013-03-13 10:39 ——– d—–w- c:\programdata\SpeedyPC Software 2013-03-13 08:41 . 2013-03-13 08:41 ——– d—–w- c:\users\Rick\AppData\Roaming\TuneUp Software 2013-03-12 16:50 . 2013-03-12 16:50 ——– d—–w- c:\program files (x86)\Application Updater 2013-03-12 16:50 . 2013-03-12 16:50 ——– d—–w- c:\program files (x86)\IObit Toolbar 2013-03-12 16:50 . 2013-03-12 16:50 ——– d—–w- c:\program files (x86)\Common Files\Spigot 2013-03-11 18:00 . 2013-03-14 18:01 ——– d—–w- c:\users\Rick\AppData\Local\ftfjonre 2013-03-02 20:56 . 2013-03-02 20:56 ——– d—–w- c:\users\Rick\.minecraft 2013-03-02 20:00 . 2013-03-14 19:02 ——– d—–w- c:\users\Rick\AppData\Roaming\.technic 2013-02-25 19:01 . 2013-02-25 19:01 ——– d—–w- c:\program files (x86)\Conduit 2013-02-15 22:04 . 2013-02-15 22:04 208448 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll 2013-02-15 19:05 . 2013-03-13 20:04 ——– d—–w- c:\program files (x86)\WiseConvert_B . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-03-12 23:30 . 2012-07-04 15:58 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-12 23:30 . 2011-11-15 09:15 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-01-07 00:42 . 2012-12-25 11:25 281688 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2013-01-07 00:42 . 2012-12-25 11:10 281688 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2013-01-06 20:14 . 2012-12-25 11:10 281688 —-a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-12-25 11:10 . 2012-12-25 11:10 76888 —-a-w- c:\windows\SysWow64\PnkBstrA.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"= "c:\program files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll" [2013-02-23 1352512] "{2713b394-286f-4d7c-89ea-4174eeab9f5a}"= "c:\program files (x86)\WiseConvert_B\prxtbWis0.dll" [2013-03-05 231168] . [HKEY_CLASSES_ROOT\clsid\{0bda0769-fd72-49f4-9266-e1fb004f4d8f}] . [HKEY_CLASSES_ROOT\clsid\{2713b394-286f-4d7c-89ea-4174eeab9f5a}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}] 2013-02-23 19:17 1352512 —-a-w- c:\program files (x86)\IObit Toolbar\IE\7.0\iobitToolbarIE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{2713b394-286f-4d7c-89ea-4174eeab9f5a}] 2013-03-05 13:37 231168 —-a-w- c:\program files (x86)\WiseConvert_B\prxtbWis0.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{38235d53-ead1-46f3-b5aa-f8774a64718f}] 2012-12-06 10:46 89288 —-a-w- c:\progra~2\SEARCH~3\Datamngr\SRTOOL~1\searchresultsDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{38235d53-ead1-46f3-b5aa-f8774a64718f}"= "c:\progra~2\SEARCH~3\Datamngr\SRTOOL~1\searchresultsDx.dll" [2012-12-06 89288] . [HKEY_CLASSES_ROOT\clsid\{38235d53-ead1-46f3-b5aa-f8774a64718f}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Officejet Pro 8600 (NET)"="c:\program files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" [2011-09-09 2676584] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-10-31 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280] "ASUSGamerOSD"="c:\program files (x86)\ASUS\GamerOSD\GamerOSD.exe" [2009-07-30 380928] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] "SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [2013-02-23 1297728] . c:\users\Rick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2011-11-30 0] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HsdService] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ServicepointService] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "UacDisableNotify"=dword:00000001 . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 cpuz130;cpuz130;c:\users\Rick\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x] R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x] R3 FileMonitor;FileMonitor;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2011-10-08 20336] R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2012-08-10 150464] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 RegFilter;RegFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [2011-09-20 33184] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 UrlFilter;UrlFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [2011-09-20 21872] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-24 1255736] R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720] S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [2012-02-14 16384] S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2013-02-23 805752] S2 HsdService;HsdService;c:\program files (x86)\Virgin Media\Digital Home Support\HsdService.exe [2011-03-23 1406264] S2 IMFservice;IMF Service;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2011-10-08 820568] S2 ServicepointService;ServicepointService;c:\program files (x86)\Virgin Media\Service Manager\ServicepointService.exe [2011-03-25 689464] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-05-15 382272] S3 IOMap;IOMap;c:\windows\system32\drivers\IOMap64.sys [2010-02-22 23680] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2009-12-21 82816] S3 SaiKA50A;SaiKA50A;c:\windows\system32\DRIVERS\SaiKA50A.sys [2009-09-14 147976] S3 SaiUA50A;SaiUA50A;c:\windows\system32\DRIVERS\SaiUA50A.sys [2009-09-14 41224] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-03-12 19:25 1629648 —-a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-03-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-04 23:30] . 2013-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 09:16] . 2013-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-31 09:16] . 2013-03-14 c:\windows\Tasks\RegCure Program Check.job - c:\program files (x86)\RegCure\RegCure.exe [2010-05-19 23:20] . 2013-03-14 c:\windows\Tasks\RegCure.job - c:\program files (x86)\RegCure\RegCure.exe [2010-05-19 23:20] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ProfilerU"="c:\program files\SmartTechnology\Software\ProfilerU.exe" [2011-08-10 310784] "SaiMfd"="c:\program files\SmartTechnology\Software\SaiMfd.exe" [2011-08-10 158208] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = 127.0.0.1;*.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s TCP: DhcpNameServer = [removed] [removed] DPF: {BAD4FE2C-503B-45CC-88CD-4B0574057D11} - hxxp://clients.futuremark.com/calico/systeminfodeploy/FMSI_v4110.cab . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) Toolbar-!{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - (no file) Toolbar-!{2713b394-286f-4d7c-89ea-4174eeab9f5a} - (no file) Wow6432Node-HKLM-Run- - (no file) Toolbar-10 - (no file) Toolbar-!{2713b394-286f-4d7c-89ea-4174eeab9f5a} - (no file) WebBrowser-{7F312B9A-208B-49FA-8218-B9AA22EC1463} - (no file) WebBrowser-{37483B40-C254-4A72-BDA4-22EE90182C1E} - (no file) WebBrowser-{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} - (no file) WebBrowser-{2713B394-286F-4D7C-89EA-4174EEAB9F5A} - (no file) AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\ASDR.exe c:\windows\SysWOW64\PnkBstrA.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\ASUS\SmartDoctor\SmartDoctor.exe . ************************************************************************** . Completion time: 2013-03-16 21:46:59 - machine was rebooted ComboFix-quarantined-files.txt 2013-03-16 21:46 . Pre-Run: 97,404,858,368 bytes free Post-Run: 99,246,559,232 bytes free . - - End Of File - - 823864A34ECF3C208E6A601EE5299545

# AdwCleaner v2.114 - Logfile created 03/17/2013 at 00:49:51 # Updated 05/03/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Rick - HOME # Boot Mode : Normal # Running from : C:\Users\Rick\Desktop\adwcleaner.exe # Option [Search] ***** [Services] ***** Found : Application Updater ***** [Files / Folders] ***** File Found : C:\Windows\SysWOW64\conduitEngine.tmp Folder Found : C:\Program Files (x86)\1ClickDownload Folder Found : C:\Program Files (x86)\Application Updater Folder Found : C:\Program Files (x86)\Common Files\spigot Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\Program Files (x86)\search results toolbar Folder Found : C:\Program Files (x86)\SearchCore for Browsers Folder Found : C:\Program Files (x86)\Windows iLivid Toolbar Folder Found : C:\Program Files (x86)\WiseConvert_B Folder Found : C:\ProgramData\Ask Folder Found : C:\ProgramData\boost_interprocess Folder Found : C:\Users\Rick\AppData\Local\Conduit Folder Found : C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla Folder Found : C:\Users\Rick\AppData\Local\Ilivid Player Folder Found : C:\Users\Rick\AppData\LocalLow\Conduit Folder Found : C:\Users\Rick\AppData\LocalLow\PriceGong Folder Found : C:\Users\Rick\AppData\LocalLow\Search Settings Folder Found : C:\Users\Rick\AppData\LocalLow\searchquband Folder Found : C:\Users\Rick\AppData\LocalLow\WiseConvert_B ***** [Registry] ***** Key Found : HKCU\Software\1ClickDownload Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\conduitEngine Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Found : HKCU\Software\AppDataLow\Software\PriceGong Key Found : HKCU\Software\AppDataLow\Software\Search Settings Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\AppDataLow\Software\Toolbar Key Found : HKCU\Software\AppDataLow\Software\WiseConvert_B Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Found : HKCU\Software\Search Settings Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Found : HKLM\Software\Application Updater Key Found : HKLM\Software\AVG Secure Search Key Found : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF} Key Found : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1683615 Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2801948 Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3196716 Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3282134 Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Freeze.com Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Found : HKLM\Software\Search Settings Key Found : HKLM\Software\WiseConvert_B Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9F6E9A51-24E1-4DA8-87AB-D3DDEC77E4A0} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F085AE9C-8C45-4174-B58D-1257595E594A} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_B Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Found : HKU\S-1-5-21-1296266938-573634603-3897812124-1001\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings] Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16448 [OK] Registry is clean. -\\ Google Chrome v25.0.1364.172 File : C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [6616 octets] - [17/03/2013 00:49:51] ########## EOF - C:\AdwCleaner[R1].txt - [6676 octets] ##########

# AdwCleaner v2.114 - Logfile created 03/17/2013 at 14:27:41 # Updated 05/03/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Rick - HOME # Boot Mode : Normal # Running from : C:\Users\Rick\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** Stopped & Deleted : Application Updater ***** [Files / Folders] ***** File Deleted : C:\Windows\SysWOW64\conduitEngine.tmp Folder Deleted : C:\Program Files (x86)\1ClickDownload Folder Deleted : C:\Program Files (x86)\Application Updater Folder Deleted : C:\Program Files (x86)\Common Files\spigot Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Program Files (x86)\search results toolbar Folder Deleted : C:\Program Files (x86)\SearchCore for Browsers Folder Deleted : C:\Program Files (x86)\Windows iLivid Toolbar Folder Deleted : C:\Program Files (x86)\WiseConvert_B Folder Deleted : C:\ProgramData\Ask Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\Users\Rick\AppData\Local\Conduit Folder Deleted : C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla Folder Deleted : C:\Users\Rick\AppData\Local\Ilivid Player Folder Deleted : C:\Users\Rick\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Rick\AppData\LocalLow\PriceGong Folder Deleted : C:\Users\Rick\AppData\LocalLow\Search Settings Folder Deleted : C:\Users\Rick\AppData\LocalLow\searchquband Folder Deleted : C:\Users\Rick\AppData\LocalLow\WiseConvert_B ***** [Registry] ***** Key Deleted : HKCU\Software\1ClickDownload Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\conduitEngine Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar Key Deleted : HKCU\Software\AppDataLow\Software\WiseConvert_B Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Deleted : HKCU\Software\Search Settings Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKLM\Software\Application Updater Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF} Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT1683615 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3196716 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3282134 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Deleted : HKLM\Software\Search Settings Key Deleted : HKLM\Software\WiseConvert_B Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{332CDD17-CC24-41CF-A9D6-207FE50210E6} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9F6E9A51-24E1-4DA8-87AB-D3DDEC77E4A0} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F085AE9C-8C45-4174-B58D-1257595E594A} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2713B394-286F-4D7C-89EA-4174EEAB9F5A} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_B Toolbar Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{2713B394-286F-4D7C-89EA-4174EEAB9F5A}] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings] Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16448 [OK] Registry is clean. -\\ Google Chrome v25.0.1364.172 File : C:\Users\Rick\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [6741 octets] - [17/03/2013 00:49:51] AdwCleaner[R2].txt - [6801 octets] - [17/03/2013 14:27:28] AdwCleaner[S1].txt - [6752 octets] - [17/03/2013 14:27:41] ########## EOF - C:\AdwCleaner[S1].txt - [6812 octets] ##########