What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32.downloader.gen

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Using Chrome tonight, started getting popup stating it was cleaning my facebook cache and did I want to leave the page. Updated and ran spybot, came up with Win32.downloader.gen and USTechSupport.CleanMyPC. Cleaned them via spybot then ran Kapersky and it came up with nothing, but a re-run of spybot, same thing, both programs sill there. Did not see Win32 under processes in Task Manager, nor anything under the HKEY_LOCAL_MACHINE which was mentioned on other sites.
Post #2
Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.
  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.



Step 1: FRST



Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.



Schritt 2: Gmer



Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================


Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click Yes.
  • Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.
If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.
Pleae attach the gmer.txt to your reply:
  • Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, browse to where you saved the file, and
  • Click Upload.
Post #3
Thanks. I have noticed my computer has been loading webpages more slowly the last couple of days but I am also travelling and on hotel networks, so that may be the issue. I hope I did this correctly. Thanks so much for your help.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-06-2013
Ran by [removed] (administrator) on 03-06-2013 16:14:35
Running from C:\Users\[removed]\Desktop
Windows Vista ™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(IObit) C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) C:\Windows\system32\PrintCtrl.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
(Uniblue Systems Limited) C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\…\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\…\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\…\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM\…\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKCU\…\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-03-18] (Google Inc.)
HKCU\…\Run: [OM2_Monitor] "C:\PROGRAM FILES\OLYMPUS\OLYMPUS MASTER 2\MMONITOR.EXE" -NoStart [95632 2009-11-25] (OLYMPUS IMAGING CORP.)
HKCU\…\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-01-21] (Google Inc.)
HKCU\…\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\…\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
MountPoints2: {ac67cfeb-4aeb-11de-85ae-001b24fc1699} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
MountPoints2: {e85f5d11-1220-11e0-aa0c-001bdc004ca3} - F:\InstallTomTomHOME.exe
HKU\Default\…\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Default User\…\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
SearchScopes: HKLM - {10F1CEB8-5984-42CC-87D7-60DABEFD8C4E} URL = http://www.ask.com/web?q={searchTerms}&l;=dis&o;=cahpd
SearchScopes: HKLM - {6C85BF2C-A7D7-4561-B460-240F25C81882} URL = http://ca.search.yahoo.com/search?p={searc…&fr;=hp-pvdt
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2653012
SearchScopes: HKCU - {10F1CEB8-5984-42CC-87D7-60DABEFD8C4E} URL =
SearchScopes: HKCU - {36377DD7-B3EB-42f5-986F-680BAF59BA9D} URL = http://start.msn.iplay.com/searchresultsre…q={searchTerms}
SearchScopes: HKCU - {3A84E5FC-CFF1-4F6A-B5F1-E40A5E9C40D5} URL = http://websearch.ask.com/redirect?client=i…41E5C55360&
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.ca/search?q={searchTerms…;rlz=1I7GGLJ_en
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2653012
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTe…amp;fr=chr-atty
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: No Name - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~1\IObit\ADVANC~2\BROWER~1\ASCPLU~1.DLL (IObit)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links; - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
PDF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.8.1

Chrome:
=======
CHR HomePage: hxxp://search.yahoo.com?type=198484&fr;=spigot-yhp-ch
CHR RestoreOnStartup: "hxxp://www.msn.com/?st=1"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\pdf.dll ()
CHR Plugin: (HP Product Detection Plugin for Mozilla) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnhbepgnjnaoahohppnffanmkjkjoglp\1.0.5.1_0\plugins/npProductDetectPlugin.dll (Hewlett-Packard)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealNetworks™ Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer™ HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.110.21) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealJukebox NS Plugin) - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (Angry Birds) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (HP Product Detection Plugin) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnhbepgnjnaoahohppnffanmkjkjoglp\1.0.5.1_0
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0
CHR Extension: (Sinuous) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\omlmnomieeknagejjojcpdomnbnbchdl\1.0.4_0
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 AdvancedSystemCareService6; C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe [574272 2013-04-18] (IObit)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
R2 Printer Control; C:\Windows\system32\PrintCtrl.exe [65536 2009-10-28] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
R2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-09] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [15672 2010-11-26] ()
S4 blbdrive; No ImagePath
U1 eabfiltr;
S3 IpInIp; No ImagePath
S3 MREMPR5; No ImagePath
S3 MRENDIS5; No ImagePath
S3 NwlnkFlt; No ImagePath
S3 NwlnkFwd; No ImagePath
S3 SymIM; No ImagePath
S3 SymIMMP; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-03 16:14 - 2013-06-03 16:14 - 01356239 ____A (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-06-03 16:14 - 2013-06-03 16:14 - 00000000 ____D C:\FRST
2013-05-31 19:30 - 2013-05-31 19:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-05-28 16:24 - 2013-06-01 17:08 - 00001228 ____A C:\Windows\PFRO.log
2013-05-27 00:08 - 2013-05-27 00:08 - 00000000 ____D C:\Program Files\Dropbox
2013-05-25 08:06 - 2013-05-25 08:07 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-25 08:06 - 2013-05-25 08:07 - 00000000 ____D C:\Program Files\iTunes
2013-05-25 08:06 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iPod
2013-05-12 15:20 - 2012-05-08 18:35 - 00029528 ____A (IObit) C:\Windows\System32\SmartDefragBootTime.exe
2013-05-04 19:35 - 2010-11-26 18:02 - 00015672 ____A C:\Windows\System32\Drivers\SmartDefragDriver.sys
2013-05-04 19:22 - 2013-05-04 19:23 - 22404848 ____A (IObit ) C:\Users\Owner\Downloads\asc-setup.exe
2013-05-04 19:20 - 2013-05-31 19:39 - 00000424 ____A C:\Windows\wininit.ini

==================== One Month Modified Files and Folders ========

2013-06-03 16:14 - 2013-06-03 16:14 - 01356239 ____A (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-06-03 16:14 - 2013-06-03 16:14 - 00000000 ____D C:\FRST
2013-06-03 16:11 - 2012-04-02 18:30 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-03 16:11 - 2010-08-02 02:18 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2772452592-850208931-1568878340-1000UA.job
2013-06-03 16:11 - 2010-01-31 19:28 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-03 16:11 - 2009-02-16 16:21 - 00117747 ____A C:\ProgramData\nvModes.dat
2013-06-03 16:11 - 2009-02-16 16:21 - 00117747 ____A C:\ProgramData\nvModes.001
2013-06-03 12:23 - 2008-04-27 16:54 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2013-06-03 12:14 - 2013-01-04 20:49 - 00000332 ____A C:\Windows\Tasks\rbmonitor.job
2013-06-03 12:14 - 2010-01-31 19:28 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-03 12:13 - 2006-11-02 09:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-03 12:13 - 2006-11-02 08:47 - 00003168 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-03 12:13 - 2006-11-02 08:47 - 00003168 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-03 09:45 - 2006-11-02 09:01 - 00032546 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-02 20:34 - 2010-08-02 02:18 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2772452592-850208931-1568878340-1000Core.job
2013-06-01 17:08 - 2013-05-28 16:24 - 00001228 ____A C:\Windows\PFRO.log
2013-05-31 19:39 - 2013-05-04 19:20 - 00000424 ____A C:\Windows\wininit.ini
2013-05-31 19:30 - 2013-05-31 19:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-05-31 18:00 - 2008-05-11 12:43 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-05-27 22:57 - 2010-03-12 22:51 - 00000000 ____D C:\Users\Owner\Documents\Youcam
2013-05-27 19:49 - 2008-11-24 21:10 - 00000052 ____A C:\Windows\System32\DOErrors.log
2013-05-27 10:39 - 2012-04-28 01:12 - 53772288 ____A C:\Windows\System32\config\software.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 37818368 ____A C:\Windows\System32\config\components.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 04866048 ____A C:\Windows\System32\config\default.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 00053248 ____A C:\Windows\System32\config\sam.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 00028672 ____A C:\Windows\System32\config\security.iobit
2013-05-27 10:39 - 2008-02-23 18:46 - 00000000 ____D C:\users\Owner
2013-05-27 00:21 - 2010-09-18 19:11 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Dropbox
2013-05-27 00:12 - 2010-09-18 19:18 - 00000000 ___RD C:\Users\Owner\Documents\My Dropbox
2013-05-27 00:08 - 2013-05-27 00:08 - 00000000 ____D C:\Program Files\Dropbox
2013-05-25 20:06 - 2013-04-13 20:10 - 00000000 ____D C:\Users\Owner\Desktop\trees
2013-05-25 08:10 - 2011-10-31 22:12 - 00000000 ____D C:\Program Files\QuickTime
2013-05-25 08:07 - 2013-05-25 08:06 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-25 08:07 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iTunes
2013-05-25 08:06 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iPod
2013-05-25 08:06 - 2009-09-10 14:31 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-05-23 18:04 - 2008-04-27 16:53 - 00000000 ____D C:\ProgramData\Skype
2013-05-19 22:29 - 2008-01-08 00:20 - 01051208 ____A C:\Windows\WindowsUpdate.log
2013-05-14 22:37 - 2012-04-02 18:30 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-14 22:37 - 2011-05-16 00:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-12 19:28 - 2006-11-02 06:33 - 00703404 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-04 19:35 - 2012-02-08 20:02 - 00000000 ____D C:\Users\Owner\AppData\Roaming\IObit
2013-05-04 19:35 - 2012-02-08 20:02 - 00000000 ____D C:\Program Files\IObit
2013-05-04 19:34 - 2012-02-08 20:02 - 00000000 ____D C:\ProgramData\IObit
2013-05-04 19:23 - 2013-05-04 19:22 - 22404848 ____A (IObit ) C:\Users\Owner\Downloads\asc-setup.exe
2013-05-04 19:02 - 2006-11-02 06:23 - 00448066 ___RA C:\Windows\System32\Drivers\etc\hosts.20130531-191225.backup

Files to move or delete:
====================
C:\ProgramData\ezsid.dat
C:\ProgramData\nvModes.dat

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-03 12:19

==================== End Of Log ============================

Attachments:

Post #4
Scan with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe.
  • Hit delete.
  • When the run is finished, it will open up a text file.
  • Please post its contents within your next reply.
  • You´ll find the log file at C:\AdwCleaner[S1].txt also.



You told us that you removed several items with Malwarebytes´ Antimalware. This tool creates a log on every run and we need to see them.


  • The logs can be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Zip any and all of these logs and attach the file to your next reply.
Post #5
I ran Adwcleaner. See below. I checked the malwarebytes folder but there was only a configuration file. # AdwCleaner v2.301 - Logfile created 06/04/2013 at 07:34:55 # Updated 16/05/2013 by Xplode # Operating system : Windows Vista ™ Home Premium Service Pack 2 (32 bits) # User : Owner - OWNER-PC # Boot Mode : Normal # Running from : C:\Users\Owner\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\IObit Apps Toolbar Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\ProgramData\Trymedia Folder Deleted : C:\Users\Owner\AppData\LocalLow\Search Settings ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport2 Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Headlight Key Deleted : HKCU\Software\InstallCore Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport2 Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966 Key Deleted : HKLM\Software\Viewpoint ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. -\\ Google Chrome v27.0.1453.94 File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[S1].txt - [3489 octets] - [04/06/2013 07:34:55] ########## EOF - C:\AdwCleaner[S1].txt - [3549 octets] ##########
Post #6 last edited
Then run a quick scan with Malwarebytes´ Antimalware and post the log! :) Create a new log with FRST and post that, too.
Post #7
malwarebytes came up with one thing, I haven't removed it yet (not win32.downloader.gen). re-ran farbar


Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.04.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Owner :: OWNER-PC [administrator]

Protection: Enabled

04/06/2013 10:00:57 AM
MBAM-log-2013-06-04 (10-09-01).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 209090
Time elapsed: 7 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4} (PUP.ShopToWin) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxx



Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-06-2013 02
Ran by [removed] (administrator) on 04-06-2013 10:11:13
Running from C:\Users\[removed]\Downloads
Windows Vista ™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(IObit) C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe
(ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) C:\Windows\system32\PrintCtrl.exe
() C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Uniblue Systems Limited) C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Malwarebytes Corporation) C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbam.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\…\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\…\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\…\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM\…\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM\…\RunOnce: [Malwarebytes Anti-Malware] C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\…\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-03-18] (Google Inc.)
HKCU\…\Run: [OM2_Monitor] "C:\PROGRAM FILES\OLYMPUS\OLYMPUS MASTER 2\MMONITOR.EXE" -NoStart [95632 2009-11-25] (OLYMPUS IMAGING CORP.)
HKCU\…\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-01-21] (Google Inc.)
HKCU\…\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\…\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
MountPoints2: {ac67cfeb-4aeb-11de-85ae-001b24fc1699} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
MountPoints2: {e85f5d11-1220-11e0-aa0c-001bdc004ca3} - F:\InstallTomTomHOME.exe
HKU\Default\…\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Default User\…\Run: [HPADVISOR] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…n&pf;=laptop
SearchScopes: HKLM - {10F1CEB8-5984-42CC-87D7-60DABEFD8C4E} URL = http://www.ask.com/web?q={searchTerms}&l;=dis&o;=cahpd
SearchScopes: HKLM - {6C85BF2C-A7D7-4561-B460-240F25C81882} URL = http://ca.search.yahoo.com/search?p={searc…&fr;=hp-pvdt
SearchScopes: HKCU - {10F1CEB8-5984-42CC-87D7-60DABEFD8C4E} URL =
SearchScopes: HKCU - {36377DD7-B3EB-42f5-986F-680BAF59BA9D} URL = http://start.msn.iplay.com/searchresultsre…q={searchTerms}
SearchScopes: HKCU - {3A84E5FC-CFF1-4F6A-B5F1-E40A5E9C40D5} URL = http://websearch.ask.com/redirect?client=i…41E5C55360&
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?p={searchTe…amp;fr=chr-atty
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: No Name - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
BHO: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~1\IObit\ADVANC~2\BROWER~1\ASCPLU~1.DLL (IObit)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links; - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
PDF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\27.0.1453.94\pdf.dll ()
CHR Plugin: (HP Product Detection Plugin for Mozilla) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnhbepgnjnaoahohppnffanmkjkjoglp\1.0.5.1_0\plugins/npProductDetectPlugin.dll (Hewlett-Packard)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealNetworks™ Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer™ HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.110.21) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealJukebox NS Plugin) - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (Angry Birds) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (HP Product Detection Plugin) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnhbepgnjnaoahohppnffanmkjkjoglp\1.0.5.1_0
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0
CHR Extension: (Sinuous) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\omlmnomieeknagejjojcpdomnbnbchdl\1.0.4_0
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

R2 AdvancedSystemCareService6; C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe [574272 2013-04-18] (IObit)
S3 Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [110592 2007-03-05] (Hewlett-Packard Development Company, L.P.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard)
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
R2 MBAMScheduler; C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 Printer Control; C:\Windows\system32\PrintCtrl.exe [65536 2009-10-28] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM)
R2 QPCapSvc; C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [271760 2007-09-30] ()
S2 QPSched; C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [112016 2007-09-30] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [176640 2007-09-09] (Conexant Systems Inc.)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [7168 2007-07-11] (Hewlett-Packard Development Company, L.P.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-06-04] (Malwarebytes Corporation)
S3 MREMP50; C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [21248 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [20096 2010-04-30] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [15672 2010-11-26] ()
S4 blbdrive; No ImagePath
U1 eabfiltr;
S3 IpInIp; No ImagePath
S3 MREMPR5; No ImagePath
S3 MRENDIS5; No ImagePath
S3 NwlnkFlt; No ImagePath
S3 NwlnkFwd; No ImagePath
S3 SymIM; No ImagePath
S3 SymIMMP; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-04 10:11 - 2013-06-04 10:11 - 01356205 ____A (Farbar) C:\Users\Owner\Downloads\FRST.exe
2013-06-04 10:00 - 2013-06-04 10:00 - 00040776 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys
2013-06-04 09:59 - 2013-06-04 09:59 - 00000697 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-04 09:59 - 2013-06-04 09:59 - 00000000 ____D C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware
2013-06-04 09:59 - 2013-06-04 09:59 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes
2013-06-04 09:59 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-04 07:38 - 2013-06-04 07:38 - 00003618 ____A C:\Users\Owner\Desktop\AdwCleaner[S1].txt
2013-06-04 07:34 - 2013-06-04 07:35 - 00003618 ____A C:\AdwCleaner[S1].txt
2013-06-04 07:34 - 2013-06-04 07:34 - 00632031 ____A C:\Users\Owner\Desktop\adwcleaner.exe
2013-06-03 16:48 - 2013-06-03 16:48 - 00007231 ____A C:\Users\Owner\Desktop\gmer.txt
2013-06-03 16:21 - 2013-06-03 16:21 - 00000000 ____D C:\Users\Owner\Desktop\gmer
2013-06-03 16:16 - 2013-06-03 16:16 - 00021621 ____A C:\Users\Owner\Desktop\FRST.txt
2013-06-03 16:15 - 2013-06-03 16:16 - 00015201 ____A C:\Users\Owner\Desktop\Addition.txt
2013-06-03 16:14 - 2013-06-03 16:14 - 01356239 ____A (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-06-03 16:14 - 2013-06-03 16:14 - 00000000 ____D C:\FRST
2013-05-31 19:30 - 2013-05-31 19:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-05-31 19:29 - 2013-05-31 19:29 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Owner\Desktop\mbam-setup-1.75.0.1300.exe
2013-05-28 16:24 - 2013-06-01 17:08 - 00001228 ____A C:\Windows\PFRO.log
2013-05-27 00:08 - 2013-05-27 00:08 - 00000000 ____D C:\Program Files\Dropbox
2013-05-25 08:06 - 2013-05-25 08:07 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-25 08:06 - 2013-05-25 08:07 - 00000000 ____D C:\Program Files\iTunes
2013-05-25 08:06 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iPod
2013-05-12 15:20 - 2012-05-08 18:35 - 00029528 ____A (IObit) C:\Windows\System32\SmartDefragBootTime.exe

==================== One Month Modified Files and Folders ========

2013-06-04 10:11 - 2013-06-04 10:11 - 01356205 ____A (Farbar) C:\Users\Owner\Downloads\FRST.exe
2013-06-04 10:09 - 2010-01-31 19:28 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-04 10:00 - 2013-06-04 10:00 - 00040776 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys
2013-06-04 09:59 - 2013-06-04 09:59 - 00000697 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-06-04 09:59 - 2013-06-04 09:59 - 00000000 ____D C:\Users\Owner\Desktop\Malwarebytes' Anti-Malware
2013-06-04 09:59 - 2013-06-04 09:59 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Malwarebytes
2013-06-04 09:57 - 2012-04-02 18:30 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-04 09:57 - 2010-08-02 02:18 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2772452592-850208931-1568878340-1000UA.job
2013-06-04 09:57 - 2009-02-16 16:21 - 00117747 ____A C:\ProgramData\nvModes.dat
2013-06-04 09:57 - 2009-02-16 16:21 - 00117747 ____A C:\ProgramData\nvModes.001
2013-06-04 07:38 - 2013-06-04 07:38 - 00003618 ____A C:\Users\Owner\Desktop\AdwCleaner[S1].txt
2013-06-04 07:38 - 2008-04-27 16:54 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2013-06-04 07:36 - 2013-01-04 20:49 - 00000332 ____A C:\Windows\Tasks\rbmonitor.job
2013-06-04 07:36 - 2010-01-31 19:28 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-04 07:36 - 2006-11-02 09:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-04 07:36 - 2006-11-02 08:47 - 00003168 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-04 07:36 - 2006-11-02 08:47 - 00003168 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-04 07:35 - 2013-06-04 07:34 - 00003618 ____A C:\AdwCleaner[S1].txt
2013-06-04 07:35 - 2006-11-02 09:01 - 00032546 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-04 07:34 - 2013-06-04 07:34 - 00632031 ____A C:\Users\Owner\Desktop\adwcleaner.exe
2013-06-03 21:50 - 2010-08-02 02:18 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2772452592-850208931-1568878340-1000Core.job
2013-06-03 18:40 - 2008-12-21 18:39 - 00000000 ____D C:\Users\Owner\PERSONAL files
2013-06-03 17:56 - 2008-11-24 21:10 - 00000052 ____A C:\Windows\System32\DOErrors.log
2013-06-03 16:48 - 2013-06-03 16:48 - 00007231 ____A C:\Users\Owner\Desktop\gmer.txt
2013-06-03 16:21 - 2013-06-03 16:21 - 00000000 ____D C:\Users\Owner\Desktop\gmer
2013-06-03 16:16 - 2013-06-03 16:16 - 00021621 ____A C:\Users\Owner\Desktop\FRST.txt
2013-06-03 16:16 - 2013-06-03 16:15 - 00015201 ____A C:\Users\Owner\Desktop\Addition.txt
2013-06-03 16:14 - 2013-06-03 16:14 - 01356239 ____A (Farbar) C:\Users\Owner\Desktop\FRST.exe
2013-06-03 16:14 - 2013-06-03 16:14 - 00000000 ____D C:\FRST
2013-06-01 17:08 - 2013-05-28 16:24 - 00001228 ____A C:\Windows\PFRO.log
2013-05-31 19:39 - 2013-05-04 19:20 - 00000424 ____A C:\Windows\wininit.ini
2013-05-31 19:30 - 2013-05-31 19:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-05-31 19:29 - 2013-05-31 19:29 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Owner\Desktop\mbam-setup-1.75.0.1300.exe
2013-05-31 18:00 - 2008-05-11 12:43 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-05-27 22:57 - 2010-03-12 22:51 - 00000000 ____D C:\Users\Owner\Documents\Youcam
2013-05-27 10:39 - 2012-04-28 01:12 - 53772288 ____A C:\Windows\System32\config\software.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 37818368 ____A C:\Windows\System32\config\components.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 04866048 ____A C:\Windows\System32\config\default.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 00053248 ____A C:\Windows\System32\config\sam.iobit
2013-05-27 10:39 - 2012-04-28 01:12 - 00028672 ____A C:\Windows\System32\config\security.iobit
2013-05-27 10:39 - 2008-02-23 18:46 - 00000000 ____D C:\users\Owner
2013-05-27 00:21 - 2010-09-18 19:11 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Dropbox
2013-05-27 00:12 - 2010-09-18 19:18 - 00000000 ___RD C:\Users\Owner\Documents\My Dropbox
2013-05-27 00:08 - 2013-05-27 00:08 - 00000000 ____D C:\Program Files\Dropbox
2013-05-25 20:06 - 2013-04-13 20:10 - 00000000 ____D C:\Users\Owner\Desktop\trees
2013-05-25 08:10 - 2011-10-31 22:12 - 00000000 ____D C:\Program Files\QuickTime
2013-05-25 08:07 - 2013-05-25 08:06 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-25 08:07 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iTunes
2013-05-25 08:06 - 2013-05-25 08:06 - 00000000 ____D C:\Program Files\iPod
2013-05-25 08:06 - 2009-09-10 14:31 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-05-23 18:04 - 2008-04-27 16:53 - 00000000 ____D C:\ProgramData\Skype
2013-05-19 22:29 - 2008-01-08 00:20 - 01051208 ____A C:\Windows\WindowsUpdate.log
2013-05-14 22:37 - 2012-04-02 18:30 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-14 22:37 - 2011-05-16 00:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-12 19:28 - 2006-11-02 06:33 - 00703404 ____A C:\Windows\System32\PerfStringBackup.INI

Files to move or delete:
====================
C:\ProgramData\ezsid.dat
C:\ProgramData\nvModes.dat

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


Last Boot: 2013-06-04 07:42

==================== End Of Log ============================
Post #8
Fix with FRST

  • Open notepad (Start =>All Programs => Accessories => Notepad).
  • Please copy the entire contents of the code box below.
    (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
  • Save it to the same direction as frst.exe (or frst64.exe).

    MountPoints2: {ac67cfeb-4aeb-11de-85ae-001b24fc1699} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
SearchScopes: HKCU - {3A84E5FC-CFF1-4F6A-B5F1-E40A5E9C40D5} URL = http://websearch.ask.com/redirect?client=i…41E5C55360&
REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6AE00F2C-62F7-41B5-83A6-B0CC6959CBC4}"
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  • Run frst.exe (on 64bit, run frst64.exe) and press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.




Please go to here to run the online scannner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file….
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Post #9
I think you mean to save the txt file to the same place as frst.exe? leave it called untitled? Include the word CODE as shown in blue at the top? Just want to be sure. I saved frst on my desktop so I can see everything :) I am in and out of meetings all day, so trying to respond as soon as I can. Thanks for your patience.
Post #10 last edited
by the way - should I finish the malwarebyte to remove the only item pup.shoptowin? i have not removed anything so far. The same for farbar. I haven't fixed anything. just checking
Post #11
No, do not include the word "code", just the content of the box below.
Save the file as fixlist.txt to the same location where FRST.exe is (in your case, it´s the desktop).

Don´t remove anything with MBAM, just let FRST do its work.

When finished, go on with the next step.
Post #13

It has been running for over 2.5 hours - is it supposed to do that? That seems a bit long.


WHAT has been running so long? IF it is ESET, be patient - depending on the number of files on your system it may last several hours.
Post #15
Restart your computer in safe mode with networking and try again. It should be finished within seconds. If not, report that.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI