What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Random Audio Plays [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Norton did not catch this for some reason. Neither did AdAware. I was watching a video stream of my niece's softball game, and this seems to have happened after that event. Thanks in advance for any help. I have a Tech Conference this coming weekend. I hope I can get this resolved by then! Here is the logfile from Hijack This: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 3:34:12 PM, on 6/18/2013 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16490) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\OEM02Mon.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Epson Software\Event Manager\EEventManager.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\System32\rundll32.exe C:\Program Files\Fitbit Connect\Fitbit Connect.exe C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe C:\ProgramData\Search Protection\SearchProtection.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\PROGRA~1\Ad-Aware Antivirus\AdAware.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe C:\Users\Laura\Desktop\HiJackThis.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - AppInit_DLLs: O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Ad-Aware Service - Lavasoft Limited - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: PC Tools Performance Toolkit Defrag Service (DMDefragService) - PC Tools - C:\Program Files\PC Tools\PC Tools Utilities\Tools\Defrag\DMDefragSrv.exe O23 - Service: PC Tools Performance Toolkit Repair Service (DMRepairService) - PC Tools - C:\Program Files\PC Tools\PC Tools Utilities\Tools\Repair\DMRepairSrv.exe O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe O23 - Service: Fitbit Connect Service (Fitbit Connect) - Fitbit, Inc. - C:\Program Files\Fitbit Connect\FitbitConnectService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe O23 - Service: Ad-Aware (SBAMSvc) - GFI Software - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe – End of file - 4608 bytes
Post #2
Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.
  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.




Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start –> Computer (right click) –> properties)

  • Run FRST.
  • Don´t change one of the checkboxes and hit Scan.
  • Logfiles are created on your desktop.
  • Poste the FRST.txt and (after the first scan only!) the Addition.txt.





Please download Gmer from here by clicking on the "Download EXE" Button.
  • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Show All ( should be unchecked by default )
  • Leave everything else as it is.
  • Close all other running programs as well as your Browser.
  • Click the Scan button & wait for it to finish.
  • Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop.
  • Please post the content of the ark.txt here.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Thank you so much for your time, Marius. Here is the FRST scan. I will put the Addition in the next reply box. And then run the GMR as you requested.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-06-2013
Ran by [removed] (administrator) on 19-06-2013 08:04:45
Running from C:\Users\[removed]\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
(Lavasoft Limited) C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Fitbit, Inc.) C:\Program Files\Fitbit Connect\FitbitConnectService.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(PC Tools) C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Symantec Corporation) C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
(PC Tools) C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Fitbit, Inc.) C:\Program Files\Fitbit Connect\Fitbit Connect.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Lavasoft) C:\ProgramData\Search Protection\SearchProtection.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Lavasoft Limited) C:\PROGRA~1\Ad-Aware Antivirus\AdAware.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(GFI Software) C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\…\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1008184 2008-01-18] (Microsoft Corporation)
HKLM\…\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe [36864 2007-05-09] (Creative Technology Ltd.)
HKLM\…\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [86016 2007-06-14] (NVIDIA Corporation)
HKLM\…\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [8433664 2007-06-14] (NVIDIA Corporation)
HKLM\…\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [81920 2007-06-14] (NVIDIA Corporation)
HKLM\…\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start [67584 2007-06-14] (NVIDIA Corporation)
HKLM\…\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-09-13] (IDT, Inc.)
HKLM\…\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\…\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\…\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe" [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\…\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\…\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\…\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\…\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe [103904 2011-12-12] (PC Tools)
HKLM\…\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)
HKLM\…\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM\…\Run: [Fitbit Connect] "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun [3093024 2013-02-25] (Fitbit, Inc.)
HKLM\…\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" [554408 2013-05-15] (Lavasoft)
HKLM\…\Run: [Search Protection] C:\ProgramData\Search Protection\SearchProtection.exe [942504 2013-05-16] (Lavasoft)
HKLM\…\Run: [Ad-Aware Antivirus] "C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher" –windows-run [x]
HKCU\…\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1233920 2009-04-10] (Microsoft Corporation)
HKCU\…\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter [x]
HKCU\…\Run: [Epson Stylus NX620(Network)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGAA.EXE /FU "C:\Windows\TEMP\E_SEE0B.tmp" /EF "HKCU" [x]
HKCU\…\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKCU\…\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe [59240 2012-02-23] (Apple Inc.)
HKCU\…\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-18] (Microsoft Corporation)
HKCU\…\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.)
HKCU\…\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
HKCU\…\Run: [com.apple.dav.bookmarks.daemon] C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59720 2013-04-05] (Apple Inc.)
HKCU\…\Run: [Fitbit Connect] "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun [3093024 2013-02-25] (Fitbit, Inc.)
MountPoints2: G - G:\LaunchU3.exe -a
Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securedsearch2.lavasoft.com/index.p…FFF8151BDFA7C87
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
HKCU SearchScopes: DefaultScope {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://securedsearch2.lavasoft.com/results…q={searchTerms}
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://securedsearch2.lavasoft.com/results…q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files\adawaretb\adawareDx.dll ()
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

========================== Services (Whitelisted) =================

R2 Ad-Aware Service; C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe [1236336 2013-03-18] (Lavasoft Limited)
S3 DMDefragService; C:\Program Files\PC Tools\PC Tools Utilities\Tools\Defrag\DMDefragSrv.exe [1038304 2011-12-12] (PC Tools)
S3 DMRepairService; C:\Program Files\PC Tools\PC Tools Utilities\Tools\Repair\DMRepairSrv.exe [1030112 2011-12-12] (PC Tools)
R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION)
R2 Fitbit Connect; C:\Program Files\Fitbit Connect\FitbitConnectService.exe [1239584 2013-02-25] (Fitbit, Inc.)
R2 N360; C:\Program Files\Norton 360\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)
R2 PCToolsSSDMonitorSvc; C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe [793056 2011-12-12] (PC Tools)
R2 SBAMSvc; C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1404000.028\ccSetx86.sys [134744 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-09] (Symantec Corporation)
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2012-08-09] (Symantec Corporation)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-06-16] (GFI Software)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\IPSDefs\20130618.001\IDSvix86.sys [386720 2013-06-13] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130618.022\NAVENG.SYS [93272 2013-05-31] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130618.022\NAVEX15.SYS [1611992 2013-05-31] (Symantec Corporation)
S3 PCTDMDefrag; C:\Windows\system32\drivers\PCTDMDefrag.sys [108864 2011-12-12] (PC Tools)
S3 PCTDSMon; C:\Windows\system32\drivers\PCTDSMon.sys [128120 2011-12-12] (PC Tools)
R3 SRTSP; C:\Windows\System32\Drivers\N360\1404000.028\SRTSP.SYS [603224 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1404000.028\SRTSPX.SYS [32344 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360\1404000.028\SYMDS.SYS [367704 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1404000.028\SYMEFA.SYS [934488 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-06-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1404000.028\Ironx86.SYS [175264 2013-03-04] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\N360\1404000.028\SYMTDIV.SYS [352344 2013-04-24] (Symantec Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-19 08:04 - 2013-06-19 08:04 - 00000000 ____D C:\FRST
2013-06-19 07:54 - 2013-06-19 07:54 - 01367073 ____A (Farbar) C:\Users\Laura\Desktop\FRST.exe
2013-06-18 15:34 - 2013-06-18 15:34 - 00004609 ____A C:\Users\Laura\Desktop\hijackthis.log
2013-06-18 14:56 - 2013-06-18 14:56 - 00388608 ____A (Trend Micro Inc.) C:\Users\Laura\Desktop\HiJackThis.exe
2013-06-17 01:15 - 2013-06-17 01:15 - 00000616 ____A C:\Windows\System32\SoftwareUpdateConfig.xml
2013-06-16 22:08 - 2013-06-17 07:08 - 00000838 ____A C:\Windows\System32\RegistrationConfig.xml
2013-06-16 22:08 - 2013-06-16 22:08 - 00001188 ____A C:\Windows\System32\ServiceConfig.xml
2013-06-16 22:08 - 2013-06-16 22:08 - 00000722 ____A C:\Windows\System32\ThreatDefinitionsConfig.xml
2013-06-16 14:06 - 2013-06-16 14:06 - 00000000 ____A C:\Windows\System32\SBRC.dat
2013-06-16 13:10 - 2013-06-16 13:21 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-06-16 13:10 - 2013-06-16 13:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\LavasoftStatistics
2013-06-16 12:53 - 2013-06-19 07:26 - 00001753 ____A C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-06-16 12:53 - 2013-06-16 22:08 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-06-16 12:53 - 2013-06-16 12:53 - 00000000 ____D C:\ProgramData\Lavasoft
2013-06-16 12:50 - 2013-06-16 12:58 - 00000000 ____D C:\Users\Laura\AppData\Local\adawarebp
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Search Protection
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\blekko toolbars
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\adawaretb
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-06-16 12:49 - 2013-06-16 12:49 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-06-16 12:48 - 2013-06-16 12:50 - 00000000 ____D C:\Program Files\adawaretb
2013-06-16 12:37 - 2013-06-18 15:15 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Ad-Aware Antivirus
2013-06-16 12:37 - 2013-06-16 12:37 - 00044424 ____A (GFI Software) C:\Windows\System32\sbbd.exe
2013-06-16 12:37 - 2013-06-16 12:37 - 00013560 ____A (GFI Software) C:\Windows\System32\Drivers\gfibto.sys
2013-06-14 08:46 - 2013-05-16 17:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 08:46 - 2013-05-16 17:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 08:46 - 2013-05-16 17:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-14 08:46 - 2013-05-16 17:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 08:46 - 2013-05-16 17:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 08:46 - 2013-05-16 17:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-14 08:46 - 2013-05-16 17:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-14 08:46 - 2013-05-16 17:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 08:46 - 2013-05-16 17:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 08:46 - 2013-05-16 17:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-14 08:46 - 2013-05-16 17:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 08:46 - 2013-05-16 17:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 08:45 - 2013-06-14 08:45 - 00000129 ____A C:\Windows\System32\MRT.INI
2013-06-14 08:45 - 2013-05-16 18:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 08:45 - 2013-05-16 17:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 08:45 - 2013-05-16 17:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 08:45 - 2013-05-16 17:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-14 07:24 - 2013-06-14 07:24 - 00000000 ____D C:\Windows\System32\N360_BACKUP
2013-06-13 17:03 - 2013-06-16 20:46 - 00000000 ____D C:\Users\Laura\Desktop\Corpus 2013
2013-06-13 16:52 - 2013-06-13 17:12 - 00000000 ____D C:\Users\Laura\Desktop\Graduation Chris
2013-06-13 16:45 - 2013-05-07 23:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 16:44 - 2013-05-01 23:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 16:44 - 2013-05-01 23:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-13 16:44 - 2013-04-23 23:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 16:44 - 2013-04-23 23:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 16:44 - 2013-04-23 23:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 16:44 - 2013-04-23 23:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 16:44 - 2013-04-23 20:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 16:44 - 2013-04-17 07:30 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 16:39 - 2013-06-13 16:51 - 00000000 ____D C:\Users\Laura\Desktop\Swim Team 2013
2013-06-10 07:23 - 2013-06-10 07:23 - 00000000 ____D C:\Windows\Sun
2013-06-01 20:40 - 2013-06-01 20:40 - 00000000 ____D C:\ProgramData\FitbitConnect
2013-06-01 20:40 - 2013-06-01 20:40 - 00000000 ____D C:\Program Files\Fitbit Connect
2013-05-28 06:49 - 2013-05-28 06:49 - 00001732 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2013-05-21 20:36 - 2013-05-21 20:37 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

==================== One Month Modified Files and Folders ========

2013-06-19 08:04 - 2013-06-19 08:04 - 00000000 ____D C:\FRST
2013-06-19 07:54 - 2013-06-19 07:54 - 01367073 ____A (Farbar) C:\Users\Laura\Desktop\FRST.exe
2013-06-19 07:50 - 2012-04-02 06:32 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-19 07:45 - 2012-08-06 12:51 - 00000000 ____D C:\Users\Laura\AppData\Local\CrashDumps
2013-06-19 07:32 - 2006-11-02 05:33 - 00707604 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-19 07:28 - 2012-07-25 22:37 - 00000000 ___RD C:\Users\Laura\Dropbox
2013-06-19 07:28 - 2012-07-25 22:33 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2013-06-19 07:26 - 2013-06-16 12:53 - 00001753 ____A C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-06-19 07:26 - 2011-08-20 14:03 - 00027335 ____A C:\Users\Laura\AppData\Roaming\nvModes.001
2013-06-19 07:25 - 2011-08-20 21:26 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-19 07:25 - 2006-11-02 08:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-19 07:25 - 2006-11-02 07:47 - 00003664 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-19 07:25 - 2006-11-02 07:47 - 00003664 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-18 18:24 - 2011-08-20 21:26 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-18 17:20 - 2006-11-02 07:52 - 01319329 ____A C:\Windows\WindowsUpdate.log
2013-06-18 15:34 - 2013-06-18 15:34 - 00004609 ____A C:\Users\Laura\Desktop\hijackthis.log
2013-06-18 15:32 - 2011-08-20 13:09 - 00000000 ____D C:\Users\Laura\AppData\Local\VirtualStore
2013-06-18 15:30 - 2012-04-22 13:39 - 00002061 ____A C:\Users\Public\Desktop\Norton 360.lnk
2013-06-18 15:30 - 2012-04-22 13:39 - 00000000 ____D C:\Windows\System32\Drivers\N360
2013-06-18 15:15 - 2013-06-16 12:37 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Ad-Aware Antivirus
2013-06-18 15:11 - 2012-01-16 17:22 - 00000000 ____D C:\Users\Laura\Desktop\From Blue Camera
2013-06-18 15:08 - 2013-02-17 12:32 - 00000000 ____D C:\Users\Laura\Desktop\Sunday Greenbelt
2013-06-18 14:56 - 2013-06-18 14:56 - 00388608 ____A (Trend Micro Inc.) C:\Users\Laura\Desktop\HiJackThis.exe
2013-06-18 07:25 - 2012-04-22 13:39 - 00142496 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SYMEVENT.SYS
2013-06-18 07:25 - 2012-04-22 13:39 - 00007611 ____A C:\Windows\System32\Drivers\SYMEVENT.CAT
2013-06-17 07:08 - 2013-06-16 22:08 - 00000838 ____A C:\Windows\System32\RegistrationConfig.xml
2013-06-17 01:15 - 2013-06-17 01:15 - 00000616 ____A C:\Windows\System32\SoftwareUpdateConfig.xml
2013-06-16 22:08 - 2013-06-16 22:08 - 00001188 ____A C:\Windows\System32\ServiceConfig.xml
2013-06-16 22:08 - 2013-06-16 22:08 - 00000722 ____A C:\Windows\System32\ThreatDefinitionsConfig.xml
2013-06-16 22:08 - 2013-06-16 12:53 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-06-16 21:17 - 2011-08-20 15:00 - 00000012 ____A C:\Windows\bthservsdp.dat
2013-06-16 20:46 - 2013-06-13 17:03 - 00000000 ____D C:\Users\Laura\Desktop\Corpus 2013
2013-06-16 19:29 - 2012-01-02 21:32 - 00000000 ____D C:\Users\Laura\Desktop\Misc Pics for FB
2013-06-16 16:47 - 2006-11-02 08:01 - 00032576 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-16 14:06 - 2013-06-16 14:06 - 00000000 ____A C:\Windows\System32\SBRC.dat
2013-06-16 13:21 - 2013-06-16 13:10 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-06-16 13:10 - 2013-06-16 13:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\LavasoftStatistics
2013-06-16 12:58 - 2013-06-16 12:50 - 00000000 ____D C:\Users\Laura\AppData\Local\adawarebp
2013-06-16 12:53 - 2013-06-16 12:53 - 00000000 ____D C:\ProgramData\Lavasoft
2013-06-16 12:53 - 2006-11-02 06:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Search Protection
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\blekko toolbars
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\adawaretb
2013-06-16 12:50 - 2013-06-16 12:50 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-06-16 12:50 - 2013-06-16 12:48 - 00000000 ____D C:\Program Files\adawaretb
2013-06-16 12:49 - 2013-06-16 12:49 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-06-16 12:37 - 2013-06-16 12:37 - 00044424 ____A (GFI Software) C:\Windows\System32\sbbd.exe
2013-06-16 12:37 - 2013-06-16 12:37 - 00013560 ____A (GFI Software) C:\Windows\System32\Drivers\gfibto.sys
2013-06-16 12:36 - 2011-08-20 13:09 - 00000680 ____A C:\Users\Laura\AppData\Local\d3d9caps.dat
2013-06-16 12:07 - 2011-08-20 15:27 - 00075432 ____A C:\Windows\PFRO.log
2013-06-14 09:45 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\rescache
2013-06-14 08:54 - 2011-08-20 16:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-14 08:45 - 2013-06-14 08:45 - 00000129 ____A C:\Windows\System32\MRT.INI
2013-06-14 08:28 - 2006-11-02 05:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-14 08:13 - 2011-08-28 17:05 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 08:09 - 2012-04-22 12:51 - 00000852 ____A C:\Users\Laura\Desktop\Norton Installation Files.lnk
2013-06-14 08:03 - 2012-04-22 13:39 - 00000000 ____D C:\Program Files\Symantec
2013-06-14 07:24 - 2013-06-14 07:24 - 00000000 ____D C:\Windows\System32\N360_BACKUP
2013-06-13 17:12 - 2013-06-13 16:52 - 00000000 ____D C:\Users\Laura\Desktop\Graduation Chris
2013-06-13 16:51 - 2013-06-13 16:39 - 00000000 ____D C:\Users\Laura\Desktop\Swim Team 2013
2013-06-13 16:26 - 2006-11-02 07:52 - 00048160 ____A C:\Windows\setupact.log
2013-06-11 18:25 - 2011-08-20 13:29 - 00027335 ____A C:\Users\Laura\AppData\Roaming\nvModes.dat
2013-06-11 15:51 - 2012-04-02 06:32 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 15:51 - 2011-08-20 21:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-11 07:22 - 2012-07-25 22:37 - 00000919 ____A C:\Users\Laura\Desktop\Dropbox.lnk
2013-06-11 07:15 - 2012-01-16 20:36 - 00000000 ____D C:\Users\Laura\Desktop\Lesson Plans 2011 2012
2013-06-10 07:23 - 2013-06-10 07:23 - 00000000 ____D C:\Windows\Sun
2013-06-09 21:22 - 2011-08-28 16:12 - 00000000 ____D C:\Users\Laura\AppData\Local\Adobe
2013-06-09 19:18 - 2011-12-20 20:00 - 00054798 ____A C:\Windows\System32\AppLog.log
2013-06-09 19:18 - 2011-12-19 19:56 - 00000266 ____A C:\Windows\Tasks\PTSchedule.job
2013-06-08 19:56 - 2011-08-28 17:05 - 00000402 ___AH C:\Windows\Tasks\Norton Security Scan for Laura.job
2013-06-04 13:27 - 2013-05-17 19:25 - 00000000 ____D C:\Users\Laura\Desktop\Prom 2013
2013-06-01 20:40 - 2013-06-01 20:40 - 00000000 ____D C:\ProgramData\FitbitConnect
2013-06-01 20:40 - 2013-06-01 20:40 - 00000000 ____D C:\Program Files\Fitbit Connect
2013-05-31 13:56 - 2012-11-08 21:42 - 00000000 ____D C:\Users\Laura\Desktop\CLPP 2013
2013-05-28 06:49 - 2013-05-28 06:49 - 00001732 ____A C:\Users\Public\Desktop\QuickTime Player.lnk
2013-05-28 06:49 - 2012-05-29 14:01 - 00000000 ____D C:\Program Files\QuickTime
2013-05-21 20:37 - 2013-05-21 20:36 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-05-21 20:37 - 2012-04-07 11:43 - 00001664 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-05-21 20:37 - 2012-03-12 08:25 - 00000000 ____D C:\Program Files\iTunes
2013-05-21 20:36 - 2011-09-02 21:12 - 00000000 ____D C:\Program Files\Common Files\Apple

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-19 07:33

==================== End Of Log ============================
Post #4
Here is the "Additional" scan: Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-06-2013 Ran by [removed] at 2013-06-19 08:07:43 Run: Running from C:\Users\[removed]\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) 32 Bit HP CIO Components Installer (Version: 6.1.2) 6500_E709_BasicWeb (Version: 140.0.000.000) 6500_E709_Help_BasicWeb (Version: 1.00.0000) Ad-Aware Antivirus (Version: 10.5.2.4379) Ad-Aware Security Add-on (Version: 3.0.0.6) Adobe AIR (Version: 2.7.1.19610) Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Reader X (10.1.7) (Version: 10.1.7) Adobe Shockwave Player 11.6 (Version: 11.6.3.633) Apple Application Support (Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (Version: 2.1.3.127) Bonjour (Version: 3.0.0.10) bpd_scan (Version: 3.00.0000) BPDSoftware_Ini (Version: 1.00.0000) BufferChm (Version: 140.0.213.000) Camtasia Studio 7 (Version: 7.1.1) Camtasia Studio 8 (Version: 8.0.0.878) CloneDVD2 (Version: 2.9.3.0) CloneDVDmobile (Version: 1.9.0.1) Dropbox (Version: 2.0.22) Epson CreativeZone Epson Easy Photo Print 2 (Version: 2.2.3.1) Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000) Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Epson Easy Photo Print Plug-in for Windows Live Photo Gallery Setup (Version: 1.00.0000) Epson Event Manager (Version: 2.40.0001) EPSON NX620 Series Printer Uninstall EPSON Scan EpsonNet Print (Version: 2.4i) EpsonNet Setup 3.3 (Version: 3.3b) ExamView Pro Fitbit Connect (Version: 1.0.0.2578) Free M4a to MP3 Converter 7.1 FreeStar Convert MP3 to WMA 1.0.5 (Version: 1.0.5) Google Update Helper (Version: 1.3.21.145) HP Officejet 6500 E709 Series (Version: 14.0) iCloud (Version: 2.1.2.8) iTunes (Version: 11.0.3.42) Java Auto Updater (Version: 2.0.6.1) Java™ 6 Update 29 (Version: 6.0.290) jZip Laptop Integrated Webcam Driver (1.04.01.1011) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000) Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) MobileMe Control Panel (Version: 3.1.8.0) MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Network (Version: 140.0.215.000) Norton 360 (Version: 20.4.0.40) Norton Security Scan (Version: 3.5.1.6) NVIDIA Drivers PC Tools Performance Toolkit 2.0 (Version: 2.0) QuickTime (Version: 7.74.80.86) Safari (Version: 5.34.57.2) Scan (Version: 140.0.167.000) Snagit 11 (Version: 11.0.1) swMSM (Version: 12.0.0.1) Toolbox (Version: 140.0.428.000) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) WebReg (Version: 140.0.213.017) Windows Live ID Sign-in Assistant (Version: 6.500.3165.0) Windows Media Encoder 9 Series SDK (Version: 9.00.2980) Wondershare Data Recovery(Build [removed]) (Version: 4.1.1.1) ==================== Restore Points ========================= ==================== Scheduled Tasks (whitelisted) ============= Task: {0B437930-86A6-48D3-B40D-85DBA5400CB2} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation) Task: {1B9CC65D-7296-4901-AE35-0D6FCA9EA856} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {221A265A-02D3-4986-9D2C-92301A234BCE} - System32\Tasks\Norton Security Scan for Laura => C:\PROGRA~1\NORTON~2\Engine\351~1.6\Nss.exe [2012-10-03] (Symantec Corporation) Task: {2FDBDC47-7148-49DB-9D32-32E6A003C996} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => C:\Windows\System32\rundll32 No File Task: {34D68DCC-8531-426E-A227-44A96C3E557D} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-18] (Microsoft Corporation) Task: {561375CB-FF5A-417B-B297-BA73DE149581} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs [2008-01-05] () Task: {74A9E151-AED3-4211-806C-56425400E81C} - System32\Tasks\Apple Diagnostics => C:\Program Files\Common Files\Apple\Internet Services\EReporter.exe [2013-04-05] (Apple Inc.) Task: {808AAE22-99C2-4DD0-9EEF-E855DD58FAE8} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation) Task: {85D94E4A-D4F9-4C56-925C-9CF623082160} - System32\Tasks\4682 => C:\Windows\System32\wscript.exe [2009-04-10] (Microsoft Corporation) Task: {8C0F72E5-74D5-4C6F-B0D8-983B6B42D07F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-20] (Google Inc.) Task: {8CF357BC-9F17-4931-8B68-FC6D89E93DF6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated) Task: {9F255B60-0F09-4359-B44E-1295391B90FD} - System32\Tasks\0 => c:\program files\internet explorer\iexplore.exe [2013-05-16] (Microsoft Corporation) Task: {A0279593-4E26-4CFD-ABAE-319A84546287} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~1\Ad-Aware Antivirus\AdAwareLauncher.exe [2013-03-18] (Lavasoft Limited) Task: {A1E9C0AD-8FB7-4A17-AFE0-35A9C8C1D8B6} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Laura => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-10] (Microsoft Corporation) Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-18] (Microsoft Corporation) Task: {B6E12EA8-5D58-4F6A-99D4-F1CFB392F8A9} - System32\Tasks\User_Feed_Synchronization-{FA1F3E37-3DBA-4EBA-9EDD-C12570701F01} => C:\Windows\system32\msfeedssync.exe [2011-08-20] (Microsoft Corporation) Task: {B7660926-E480-4AE3-B059-C524113CB64F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-08-20] (Google Inc.) Task: {B7E3BA05-F6E4-486A-97D5-655E8373FD94} - System32\Tasks\PTSchedule => C:\Program Files\PC Tools\PC Tools Utilities\pt.exe [2011-12-12] (PC Tools) Task: {CEA1221E-D9C4-45EA-BB67-2391363DA498} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\20.4.0.40\WSCStub.exe [2013-06-03] (Symantec Corporation) Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] () Task: {F8D6E476-24FE-4649-A4D7-985706B29128} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => C:\Windows\System32\rundll32 No File Task: {FA8C92B2-C6D6-4178-842C-2EFEC374582B} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-18] (Microsoft Corporation) ==================== Faulty Device Manager Devices ============= Name: isatap.{08EC9B7A-44E7-49B9-AECC-5F3060C8EFDB} Description: Microsoft ISATAP Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver Name: isatap.gateway.2wire.net Description: Microsoft ISATAP Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver Name: Biometric Coprocessor Description: Biometric Coprocessor Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Officejet 6500 E709n Description: Officejet 6500 E709n Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: HP Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: hp LaserJet 4250 Description: hp LaserJet 4250 Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: Hewlett-Packard Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Deskjet 3050 J610 series Description: Deskjet 3050 J610 series Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: HP Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Deskjet 3050A J611 series Description: Deskjet 3050A J611 series Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: HP Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Photosmart C7100 series Description: Photosmart C7100 series Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318} Manufacturer: HP Service: Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (06/19/2013 07:33:47 AM) (Source: Application Error) (User: ) Description: Faulting application APSDaemon.exe, version 2.2.9.2, time stamp 0x516e136b, faulting module pthreadVC2.dll, version 2.7.0.11200, time stamp 0x4c2910d2, exception code 0xc0000005, fault offset 0x00003496, process id 0x1370, application start time 0xAPSDaemon.exe0. Error: (06/18/2013 05:31:14 PM) (Source: System Restore) (User: ) Description: The scheduled restore point could not be created. Additional information: (0x80042319). Error: (06/18/2013 05:31:14 PM) (Source: System Restore) (User: ) Description: Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x80042319). Error: (06/18/2013 05:31:14 PM) (Source: VSS) (User: ) Description: Volume Shadow Copy Service error: Writer WMI Writer did not respond to a GatherWriterStatus call. Operation: Gather writers' status Executing Asynchronous Operation Context: Current State: GatherWriterStatus Error: (06/18/2013 03:52:10 PM) (Source: Windows Search Service) (User: ) Description: The entry in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (06/18/2013 03:52:10 PM) (Source: Windows Search Service) (User: ) Description: The entry in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (06/18/2013 03:38:06 PM) (Source: Application Error) (User: ) Description: Faulting application APSDaemon.exe, version 2.2.9.2, time stamp 0x516e136b, faulting module pthreadVC2.dll, version 2.7.0.11200, time stamp 0x4c2910d2, exception code 0xc0000005, fault offset 0x00003496, process id 0x11c0, application start time 0xAPSDaemon.exe0. Error: (06/18/2013 03:26:09 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 290209 Error: (06/18/2013 03:26:09 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 290209 Error: (06/18/2013 03:26:09 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (06/19/2013 07:31:18 AM) (Source: Service Control Manager) (User: ) Description: HP Network Devices Support Error: (06/19/2013 07:27:12 AM) (Source: Service Control Manager) (User: ) Description: Windows Image Acquisition (WIA)Shell Hardware Detection%%1058 Error: (06/19/2013 07:27:12 AM) (Source: DCOM) (User: ) Description: 1068stisvc{A1F4E726-8CF1-11D1-BF92-0060081ED811} Error: (06/19/2013 07:26:31 AM) (Source: Service Control Manager) (User: ) Description: Windows Image Acquisition (WIA)Shell Hardware Detection%%1058 Error: (06/19/2013 07:26:31 AM) (Source: Service Control Manager) (User: ) Description: Parallel port driver%%1058 Error: (06/19/2013 07:26:13 AM) (Source: netbt) (User: ) Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.75. The computer with the IP address 192.168.1.70 did not allow the name to be claimed by this computer. Error: (06/19/2013 07:25:48 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT AUTHORITY) Description: 0x8000002a63\??\C:\Users\Laura\AppData\Local\Microsoft\Windows\UsrClass.dat Error: (06/19/2013 07:25:25 AM) (Source: EventLog) (User: ) Description: The previous system shutdown at 8:43:29 PM on 6/18/2013 was unexpected. Error: (06/18/2013 07:03:49 PM) (Source: BROWSER) (User: ) Description: The browser was unable to update the service status bits. The data is the error. Error: (06/18/2013 07:02:49 PM) (Source: BROWSER) (User: ) Description: The browser was unable to update the service status bits. The data is the error. Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-06-19 08:07:21.192 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:07:20.708 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:07:20.256 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:07:19.822 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:06:11.318 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:06:10.782 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:06:10.300 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:06:09.860 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:05:43.660 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130531.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-19 08:05:43.025 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130531.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 88% Total physical RAM: 2045.31 MB Available physical RAM: 244.04 MB Total Pagefile: 4329.88 MB Available Pagefile: 1463.13 MB Total Virtual: 2047.88 MB Available Virtual: 1898.45 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:462.71 GB) (Free:377.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 00000080) Partition 1: (Not Active) - (Size=47 MB) - (Type=DE) Partition 2: (Active) - (Size=463 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=3 GB) - (Type=OF Extended) ==================== End Of Log ============================
Post #5 last edited
I downloaded the GREM as requested and ran it. As it finished I was reading your instructions on what to do next when the screen flashed blue for about 5 seconds, and then the computer rebooted. Should I just go through the steps again click on the download exe button etc? The computer seems to be just the same as it was just before that event. I do find the randomly named file in my downloads, now, too. Run as administrator and continue as noted in the first post? Thanks!
Post #6
Nope!

Skip that and do the following:


Please download Malwarebytes Anti-Rootkit from here Malwarebytes : Malwarebytes Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page.

Caution: This is a beta version so please be sure to read the disclaimer and back up any important data before using.

  • Double click the mbar.zip file to open it, then 'Extract all files'.
  • Double click the mbar folder to open it, then double click mbar.exe to start the tool.
Check for Updates, then Scan your system for malware

If malware is found, do NOT press the Cleanup button yet. Click EXIT.

I'd like to see the log first so I can see what it sees. You'll find the log in that mbar folder as MBAR-log-***.txt . Please attach that to your next reply.
Post #7
Here is the MBAR log: Malwarebytes Anti-Rootkit BETA 1.06.0.1003 www.malwarebytes.org Database version: v2013.06.20.09 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Laura :: LAURA-PC [administrator] 6/20/2013 3:00:39 PM mbar-log-2013-06-20 (15-00-39).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | Deep Anti-Rootkit Scan | PUM | P2P Scan options disabled: PUP Objects scanned: 217444 Time elapsed: 57 minute(s), 56 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 2 Master Boot Record on Drive #0 (Unknown Rootkit MBR Infection) -> No action taken. Physical Sector #976772906 on Drive #0 (Forged physical sector) -> No action taken. (end) Thanks!
Post #8
Run another scan with mbar.exe and click the CleanUp button. It will require a reboot. When it has rebooted, run another scan with mbar.exe and click CleanUp again if necessary. Send the mbar-log.txt along with an update on machine behavior.
Post #10
delete the mbar folder and download the tool again. Start your system in safe mode, extract and run mbar, then clean up and post the log here.
Post #11
Here is the MBAR log: Malwarebytes Anti-Rootkit BETA 1.06.0.1003 www.malwarebytes.org Database version: v2013.05.07.10 Windows Vista Service Pack 2 x86 NTFS (Safe Mode) Internet Explorer 9.0.8112.16421 Laura :: LAURA-PC [administrator] 6/21/2013 11:20:02 AM mbar-log-2013-06-21 (11-20-02).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | Deep Anti-Rootkit Scan | PUM | P2P Scan options disabled: PUP Objects scanned: 215354 Time elapsed: 27 minute(s), 30 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 2 Master Boot Record on Drive #0 (Unknown Rootkit MBR Infection) -> Replace on reboot. Physical Sector #976772906 on Drive #0 (Forged physical sector) -> Replace on reboot. (end) So far there has been no random audio, and have had computer running for about 10 minutes. I do now get a relentless "A website wants to open web content using this program on your computer" from Adobe. It takes 6-8 clicks on it to get it to stop popping up, but the minute I open a new tab or click a link to the next page it starts all over again. But random audio appears to be gone. Will let it sit for a full hour to confirm as it did not seem to have a pattern.
Post #12
Combofix


Combofix should only be run when adviced by a team member!

Link


Important - Save the file to your desktop!


  • Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
  • Run Combofix.exe

When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.
Post #13
Here is the combo fix log. The Adobe Flash window pop up is now gone!

ComboFix 13-06-22.01 - Laura 06/22/2013 21:10:04.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.815 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\Flipping Software\ComboFix.exe
AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\DRM\9907.tmp
c:\users\Laura\AppData\Local\assembly\tmp
.
.
((((((((((((((((((((((((( Files Created from 2013-05-23 to 2013-06-23 )))))))))))))))))))))))))))))))
.
.
2013-06-23 02:18 . 2013-06-23 02:18 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-06-22 22:51 . 2013-06-22 22:51 105 —-a-w- C:\prefs.js
2013-06-21 16:19 . 2013-06-21 16:19 31560 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-06-20 19:57 . 2013-06-20 19:57 ——– d—–w- c:\programdata\Malwarebytes
2013-06-19 13:04 . 2013-06-19 13:04 ——– d—–w- C:\FRST
2013-06-16 18:10 . 2013-06-16 18:21 ——– d—–w- c:\programdata\Ad-Aware Antivirus
2013-06-16 18:10 . 2013-06-16 18:10 ——– d—–w- c:\users\Laura\AppData\Roaming\LavasoftStatistics
2013-06-16 17:53 . 2013-06-16 17:53 ——– d—–w- c:\programdata\Lavasoft
2013-06-16 17:53 . 2013-06-17 03:08 ——– d—–w- c:\program files\Ad-Aware Antivirus
2013-06-16 17:50 . 2013-06-16 17:50 ——– d—–w- c:\programdata\Downloaded Installations
2013-06-16 17:50 . 2013-06-16 17:58 ——– d—–w- c:\users\Laura\AppData\Local\adawarebp
2013-06-16 17:50 . 2013-06-16 17:50 ——– d—–w- c:\programdata\Ad-Aware Browsing Protection
2013-06-16 17:37 . 2013-06-16 17:37 44424 —-a-w- c:\windows\system32\sbbd.exe
2013-06-16 17:37 . 2013-06-16 17:37 13560 —-a-w- c:\windows\system32\drivers\gfibto.sys
2013-06-16 17:37 . 2013-06-18 20:15 ——– d—–w- c:\users\Laura\AppData\Roaming\Ad-Aware Antivirus
2013-06-14 13:45 . 2013-05-16 22:27 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2013-06-14 12:24 . 2013-06-14 12:24 ——– d—–w- c:\windows\system32\N360_BACKUP
2013-06-13 21:45 . 2013-05-08 04:37 905576 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-13 21:44 . 2013-05-02 04:04 443904 —-a-w- c:\windows\system32\win32spl.dll
2013-06-13 21:44 . 2013-05-02 04:03 37376 —-a-w- c:\windows\system32\printcom.dll
2013-06-13 21:44 . 2013-04-24 04:00 985600 —-a-w- c:\windows\system32\crypt32.dll
2013-06-13 21:44 . 2013-04-24 04:00 98304 —-a-w- c:\windows\system32\cryptnet.dll
2013-06-13 21:44 . 2013-04-24 04:00 133120 —-a-w- c:\windows\system32\cryptsvc.dll
2013-06-13 21:44 . 2013-04-24 04:00 41984 —-a-w- c:\windows\system32\certenc.dll
2013-06-13 21:44 . 2013-04-24 01:46 812544 —-a-w- c:\windows\system32\certutil.exe
2013-06-13 21:44 . 2013-04-17 12:30 24576 —-a-w- c:\windows\system32\cryptdlg.dll
2013-06-10 12:23 . 2013-06-10 12:23 ——– d—–w- c:\windows\Sun
2013-06-02 01:40 . 2013-06-02 01:40 ——– d—–w- c:\programdata\FitbitConnect
2013-06-02 01:40 . 2013-06-02 01:40 ——– d—–w- c:\program files\Fitbit Connect
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-05-28 11:49 . 2013-05-28 11:49 159744 —-a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 20:51 . 2012-04-02 11:32 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-11 20:51 . 2011-08-21 02:27 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-01 08:59 . 2013-05-01 08:59 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2013-05-01 08:59 . 2013-05-01 08:59 69632 —-a-w- c:\windows\system32\QuickTime.qts
2013-04-15 14:20 . 2013-05-15 11:40 638328 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-13 10:56 . 2013-05-15 11:40 37376 —-a-w- c:\windows\system32\cdd.dll
2013-04-09 01:36 . 2013-05-15 11:40 2049024 —-a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 —-a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-04-05 59720]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-04-05 59720]
"com.apple.dav.bookmarks.daemon"="c:\program files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe" [2013-04-05 59720]
"Fitbit Connect"="c:\program files\Fitbit Connect\Fitbit Connect.exe" [2013-02-25 3093024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Aware Antivirus"="c:\program files\Ad-Aware Antivirus\AdAwareLauncher –windows-run" [X]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-14 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-14 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-14 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-06-14 67584]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"Fitbit Connect"="c:\program files\Fitbit Connect\Fitbit Connect.exe" [2013-02-25 3093024]
.
c:\users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 Ad-Aware Service;Ad-Aware Service;c:\program files\Ad-Aware Antivirus\AdAwareService.exe [2013-03-18 1236336]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:52]
.
2013-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-21 02:26]
.
2013-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-21 02:26]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 4.2.2.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
HKLM-Run-Search Protection - c:\programdata\Search Protection\SearchProtection.exe
SafeBoot-mbamchameleon
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-06-22 21:19
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-06-22 21:20:48
ComboFix-quarantined-files.txt 2013-06-23 02:20
.
Pre-Run: 402,633,506,816 bytes free
Post-Run: 402,687,619,072 bytes free
.
- - End Of File - - 141AD64A442E88F4236C8DE8BDCB3EE1
5C616939100B85E558DA92B899A0FC36
Post #14
Please go to here to run the online scannner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file….
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Post #15
Here are the results from the ESET scan: C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Users\Laura\AppData\LocalLow\9937.tmp a variant of Win32/Kryptik.BDEI trojan C:\Windows.old\Documents and Settings\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Windows.old\Documents and Settings\Laura\AppData\LocalLow\9937.tmp a variant of Win32/Kryptik.BDEI trojan C:\Windows.old\ProgramData\Application Data\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Windows.old\Users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI