What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Resources being eatten [Solved]

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
The process WmiPrvSE is using 50-60% of the cpu resources. I made sure that the dependent services were stopped to check, no difference. As a result the pc is very sluggish.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:27:50 PM, on 7/22/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16635)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe
C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe
C:\Users\sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\sherry2\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com/?ctid=CT3288691&…1F-8C3E9C8CEAE9
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;192.168.*.*;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
O4 - HKLM\..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [VueMinder] "C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe" 1
O4 - HKCU\..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [1A7660B26AC462035AF5AB4A35435CCA01AA57E1._service_run] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" –type=service
O4 - HKCU\..\Run: [SearchProtect] C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe
O4 - Startup: Dropbox.lnk = sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agr64svc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\windows\system32\atiesrxx.exe (file missing)
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
O23 - Service: Search Protect by Conduit Updater (CltMngSvc) - Conduit - C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe
O23 - Service: ConfigFree Gadget Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: MotoHelper Service (MotoHelper) - Unknown owner - C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: Wise Boot Assistant (WiseBootAssistant) - WiseCleaner.com - C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)

–
End of file - 11169 bytes
Post #2
Hello sLeven7. Welcome to WTT Forums.

My name is fbfbfb.

I will gladly assist you with your malware concerns. Malware logs may require some time to analyze, and because there is no quick-fix solution, we may need to use various approaches to clean your system. Please be patient.

While working to resolve the issues with your machine, please note the following guidelines:
  • Read and follow my directions carefully, in the sequence they are posted.
  • If you are unsure about anything, please ask for clarification before continuing.
  • To avoid potential problems and setbacks, do not:

  • install or uninstall any applications while your system is being cleaned.
  • use any tools other than those recommended.
  • run any other scans without being directed to do so.

  • Copy and Paste the log files inside your posts. Do not send them as attachments unless otherwise instructed.
  • Stay with this thread until your machine has been deemed all clear. Absence of symptoms does not mean your system is clear.
  • Please reply within 3 days of each posting to avoid closing this topic. If you need more time to complete tasks, or if you will be away, please let me know in advance.
Please run the following scans

1. DDS

Please download DDS from HERE. Click Save File. The file will save to your default location.
  • Disable any script blocking protection. (How to Temporarily Disable Security Programs: Anti-virus/Anti-spyware/Firewall)
  • Double click dds.com > Click Run.
  • At the next prompt, ensure check marks appear next to dds.com and attach.txt > Click Start to begin the scan. When done, click OK to close the DDS window.
  • Two reports will automatically open: dds.txt and Attach.txt. These reports are also saved to your desktop.
Please copy and paste the scan results of DDS.txt.

Please attach the second file: Attach.txt.

To attach a file, do the following:
  • Under the reply panel is the Attachments Panel.
  • Browse for the attachment file you want to upload, then click the green Upload button.
  • Once it has uploaded, click the Manage Current Attachments drop down box.
  • Click on [external image: Posted Image] to insert the attachment into your post.
2. aswMBR

Please download aswMBR from HERE.
  • Double click aswMBR.exe to run it.
  • When asked if you want to download Avast's virus definitions, please select Yes.
  • Click the Scan button to start the scan.
[external image: Posted Image]
  • On completion of the scan, click save log, save it to your desktop, and post in your next reply.
[external image: Posted Image]

3. Security Check

Please download Security Check from HERE or HERE.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt. This may take a few minutes.
Please copy and paste the contents of that document into your next reply.

CHECKLIST: In your next reply, please post the following:
  • dds.txt
  • attach.txt
  • aswMBR log
  • checkup.txt
Post #3
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16635 BrowserJavaVersion: 10.25.2
Run by [removed] at 6:24:41 on 2013-07-23
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.1138 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\atieclxx.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe
C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe
C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Windows Sidebar\sidebar.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\windows\System32\WUDFHost.exe
C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe
C:\Users\sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\windows\system32\taskmgr.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\splwow64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\LSI SoftModem\agr64svc.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN35281739206954322&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9
uDefault_Search_URL = hxxp://www.google.com/ie
uProxyOverride = 127.0.0.1:9421;192.168.*.*;
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
uRun: [Akamai NetSession Interface] "C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe"
uRun: [VueMinder] "C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe" 1
uRun: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [1A7660B26AC462035AF5AB4A35435CCA01AA57E1._service_run] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" –type=service
uRun: [SearchProtect] C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
mRun: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\sherry2\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:28
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{A2DAF245-EF74-4D98-8FA2-4A0C8FBCBDDD} : DHCPNameServer = [removed] [removed]
TCP: Interfaces\{A2DAF245-EF74-4D98-8FA2-4A0C8FBCBDDD}\85D445F53597374756D637 : DHCPNameServer = 192.168.10.1
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
x64-Run: [Logitech Download Assistant] C:\windows\System32\rundll32.exe C:\windows\System32\LogiLDA.dll,LogiFetch
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&CUI=UN65523040813424239&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DivX Browser Bar Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN65523040813424239&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&SearchSource=2&CUI=UN65523040813424239&UM=2&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files (x86)\mozilla firefox\extensions\[removed]\components\KavLinkFilter.dll
FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll
FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\[removed]\components\plugins.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll
FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2013-1-20 230320]
R0 RapportKE64;RapportKE64;C:\windows\System32\drivers\RapportKE64.sys [2013-2-9 236688]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\drivers\tos_sps64.sys [2010-5-22 482384]
R1 RapportCerberus_53984;RapportCerberus_53984;C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\53984\RapportCerberus64_53984.sys [2013-6-23 588048]
R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2013-6-18 229040]
R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2013-6-18 357712]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672]
R2 Akamai;Akamai NetSession Interface;C:\windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2010-5-22 203264]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688]
R2 CltMngSvc;Search Protect by Conduit Updater;C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe [2013-5-8 97056]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 Garmin Core Update Service;Garmin Core Update Service;C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-12 185688]
R2 MotoHelper;MotoHelper Service;C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-12-6 214896]
R2 RapportMgmtService;Rapport Management Service;C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2013-6-18 1124632]
R2 RSELSVC;TOSHIBA Modem region select service;C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [2009-7-7 65904]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-27 251760]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2010-5-22 35008]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2010-5-22 215040]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\System32\drivers\rtl8192se.sys [2010-4-26 1103904]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 WiseBootAssistant;Wise Boot Assistant;C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [2012-11-25 580232]
S3 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2010-10-24 130008]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\windows\System32\drivers\rdpvideominiport.sys [2012-10-26 19456]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2010-5-22 222208]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-5-22 54136]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560]
S3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2012-10-26 57856]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2010-7-24 1255736]
.
=============== File Associations ===============
.
FileExt: .txt: textfile="C:\Program Files (x86)\Windows NT\Accessories\WORDPAD.EXE" "%1" [UserChoice]
FileExt: .jse: JSEFile=NOTEPAD.EXE %1
FileExt: .wsf: WSFFile=NOTEPAD.EXE %1
.
=============== Created Last 30 ================
.
2013-07-23 04:12:24 76232 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7D388B64-CD83-4F56-972A-52BF0BC91F32}\offreg.dll
2013-07-23 04:07:44 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7D388B64-CD83-4F56-972A-52BF0BC91F32}\mpengine.dll
2013-07-22 04:06:40 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-17 03:43:40 941720 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DF2CE67D-7DC2-4316-9672-2D988B120B46}\gapaengine.dll
2013-07-11 09:05:12 2706432 —-a-w- C:\windows\System32\mshtml.tlb
2013-07-11 09:05:11 2706432 —-a-w- C:\windows\SysWow64\mshtml.tlb
2013-07-10 12:54:45 1643520 —-a-w- C:\windows\System32\DWrite.dll
2013-07-10 12:54:44 1247744 —-a-w- C:\windows\SysWow64\DWrite.dll
2013-07-04 12:50:42 96168 —-a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll
.
==================== Find3M ====================
.
2013-07-17 00:38:19 71048 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-17 00:38:19 692104 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2013-07-04 12:49:09 867240 —-a-w- C:\windows\SysWow64\npDeployJava1.dll
2013-07-04 12:49:08 789416 —-a-w- C:\windows\SysWow64\deployJava1.dll
2013-06-18 20:14:30 236688 —-a-w- C:\windows\System32\drivers\RapportKE64.sys
2013-06-11 23:43:37 1767936 —-a-w- C:\windows\SysWow64\wininet.dll
2013-06-11 23:43:00 2877440 —-a-w- C:\windows\SysWow64\jscript9.dll
2013-06-11 23:42:58 61440 —-a-w- C:\windows\SysWow64\iesetup.dll
2013-06-11 23:42:58 109056 —-a-w- C:\windows\SysWow64\iesysprep.dll
2013-06-11 23:26:20 2241024 —-a-w- C:\windows\System32\wininet.dll
2013-06-11 23:25:16 3958784 —-a-w- C:\windows\System32\jscript9.dll
2013-06-11 23:25:13 67072 —-a-w- C:\windows\System32\iesetup.dll
2013-06-11 23:25:13 136704 —-a-w- C:\windows\System32\iesysprep.dll
2013-06-11 22:51:45 71680 —-a-w- C:\windows\SysWow64\RegisterIEPKEYs.exe
2013-06-11 22:50:58 89600 —-a-w- C:\windows\System32\RegisterIEPKEYs.exe
2013-06-05 03:34:27 3153920 —-a-w- C:\windows\System32\win32k.sys
2013-06-04 06:00:13 624128 —-a-w- C:\windows\System32\qedit.dll
2013-06-04 04:53:07 509440 —-a-w- C:\windows\SysWow64\qedit.dll
2013-05-27 14:04:19 81536 —-a-w- C:\ministub.exe
2013-05-13 05:51:01 184320 —-a-w- C:\windows\System32\cryptsvc.dll
2013-05-13 05:51:00 1464320 —-a-w- C:\windows\System32\crypt32.dll
2013-05-13 05:51:00 139776 —-a-w- C:\windows\System32\cryptnet.dll
2013-05-13 05:50:40 52224 —-a-w- C:\windows\System32\certenc.dll
2013-05-13 04:45:55 140288 —-a-w- C:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55 1160192 —-a-w- C:\windows\SysWow64\crypt32.dll
2013-05-13 04:45:55 103936 —-a-w- C:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55 1192448 —-a-w- C:\windows\System32\certutil.exe
2013-05-13 03:08:10 903168 —-a-w- C:\windows\SysWow64\certutil.exe
2013-05-13 03:08:06 43008 —-a-w- C:\windows\SysWow64\certenc.dll
2013-05-10 05:49:27 30720 —-a-w- C:\windows\System32\cryptdlg.dll
2013-05-10 03:20:54 24576 —-a-w- C:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39:01 1910632 —-a-w- C:\windows\System32\drivers\tcpip.sys
2013-05-08 06:10:12 770384 —-a-w- C:\windows\SysWow64\msvcr100.dll
2013-05-08 06:10:12 421200 —-a-w- C:\windows\SysWow64\msvcp100.dll
2013-05-06 06:03:49 1887744 —-a-w- C:\windows\System32\WMVDECOD.DLL
2013-05-06 04:56:35 1620480 —-a-w- C:\windows\SysWow64\WMVDECOD.DLL
2013-05-02 15:29:56 278800 ——w- C:\windows\System32\MpSigStub.exe
2013-05-01 07:59:12 94208 —-a-w- C:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 07:59:12 69632 —-a-w- C:\windows\SysWow64\QuickTime.qts
2013-04-26 05:51:36 751104 —-a-w- C:\windows\System32\win32spl.dll
2013-04-26 04:55:21 492544 —-a-w- C:\windows\SysWow64\win32spl.dll
2013-04-25 23:30:32 1505280 —-a-w- C:\windows\SysWow64\d3d11.dll
.
============= FINISH: 6:26:19.20 ===============



aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-07-23 06:33:31
—————————–
06:33:31.151 OS Version: Windows x64 6.1.7601 Service Pack 1
06:33:31.151 Number of processors: 2 586 0x602
06:33:31.152 ComputerName: SHERRY2-PC UserName: sherry2
06:33:34.593 Initialize success
06:41:22.666 AVAST engine defs: 13072300
06:41:33.274 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
06:41:33.283 Disk 0 Vendor: WDC_WD3200BEVT-26ZCT0 12.01A12 Size: 305245MB BusType: 11
06:41:33.642 Disk 0 MBR read successfully
06:41:33.650 Disk 0 MBR scan
06:41:33.683 Disk 0 Windows VISTA default MBR code
06:41:33.711 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
06:41:33.789 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 294603 MB offset 3074048
06:41:33.846 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 9141 MB offset 606420992
06:41:34.016 Disk 0 scanning C:\windows\system32\drivers
06:41:54.868 Service scanning
06:42:43.790 Modules scanning
06:42:43.817 Disk 0 trace - called modules:
06:42:43.901 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
06:42:43.915 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004abc060]
06:42:43.935 3 CLASSPNP.SYS[fffff8800181743f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004a25060]
06:42:46.948 AVAST engine scan C:\windows
06:42:52.526 AVAST engine scan C:\windows\system32
06:52:41.574 AVAST engine scan C:\windows\system32\drivers
06:53:41.355 AVAST engine scan C:\Users\sherry2
07:00:33.899 AVAST engine scan C:\ProgramData
07:03:50.100 Scan finished successfully
07:04:35.167 Disk 0 MBR has been saved successfully to "C:\Users\sherry2\Desktop\MBR.dat"
07:04:35.186 The log file has been saved successfully to "C:\Users\sherry2\Desktop\aswMBR.txt"




Results of screen317's Security Check version 0.99.71
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
SlimCleaner
JavaFX 2.1.1
Java 7 Update 25
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (22.0)
Google Chrome 28.0.1500.71
Google Chrome 28.0.1500.72
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

Attachments:

Post #4
Hello, sLeven7.

Thank you for your logs. We need to take care of some malware that has infected your system.

Please run the following scans

1. OTL
  • Please download OTL to your desktop from HERE or HERE.
  • Close all other applications and windows so that you have nothing open.
  • Double click on the [external image: Posted Image]icon on your desktop.

Note: Vista and Windows 7 users right-click and select Run As Administrator. If you receive a UAC prompt asking if you would like to continue running the program, you should press the Continue button.

  • Under Output, click Minimal Output to select it.
  • Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
  • Then click the Run Fix button at the top.
:OTL
uStart Page = hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN35281739206954322&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9
uRun: [SearchProtect] C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe
mRun: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&CUI=UN65523040813424239&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN65523040813424239&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&SearchSource=2&CUI=UN65523040813424239&UM=2&q=
R2 CltMngSvc;Search Protect by Conduit Updater;C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe [2013-5-8 97056]

:Files
C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe
C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe

:Commands

[CLEARALLRESTOREPOINTS]
[emptytemp]
[resethosts]
  • Let the program run unhindered; it will reboot when it is done. If it does not, please reboot your system.
  • Post the new log in your next reply.
2. AdwCleaner

Please download AdwCleaner from HERE.
  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on the Delete button.
  • A logfile will automatically open after the scan has finished.
  • You can also find the logfile at C:\AdwCleaner[S1].txt.
Copy and paste the adwcleaner.txt report into your next reply.

3. Junkware Removal Tool

Please download Junkware Removal Tool from HERE and save it to your desktop.
  • Shutdown your antivirus to avoid any potential conflicts.
  • Right-mouse click JRT.exe and select Run as Administrator.
  • JRTwill begin to backup your registry and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, the log JRT.txt is saved on your desktop and will automatically open.
Post the contents of JRT.txt into your next reply.

CHECKLIST: In your next reply, please post the following:
  • OTL log
  • adwcleaner.txt
  • JRT.txt
  • Let me know how your computer is running now.
Post #5
The process that was hogging resources is no longer running, thank you. All processes killed ========== OTL ========== Prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&CUI=UN65523040813424239&UM=2&SearchSource=3&q={searchTerms} removed from refs.js Prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN65523040813424239&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9 removed from refs.js Prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&SearchSource=2&CUI=UN65523040813424239&UM=2&q= removed from refs.js ========== FILES ========== C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe moved successfully. C:\Users\sherry2\AppData\Roaming\SearchProtect\bin\cltmng.exe moved successfully. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes User: miranda ->Temp folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: sherry2 ->Temp folder emptied: 99295091 bytes ->Temporary Internet Files folder emptied: 93227436 bytes ->Java cache emptied: 37762 bytes ->FireFox cache emptied: 177652527 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 1107 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 54414 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 353.00 mb C:\windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.69.0 log created on 07242013_121649 Files\Folders moved on Reboot… C:\Users\sherry2\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. File move failed. C:\Users\sherry2\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot. PendingFileRenameOperations files… Registry entries deleted on Reboot… # AdwCleaner v2.306 - Logfile created 07/24/2013 at 12:29:28 # Updated 19/07/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : sherry2 - SHERRY2-PC # Boot Mode : Normal # Running from : C:\Users\sherry2\Desktop\AdwCleaner.exe # Option [Delete] ***** [Services] ***** Stopped & Deleted : CltMngSvc ***** [Files / Folders] ***** Deleted on reboot : C:\Users\sherry2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Deleted on reboot : C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\p60t33h1.default\extensions\[removed] File Deleted : C:\END File Deleted : C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\searchplugins\Conduit.xml Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Program Files (x86)\SearchProtect Folder Deleted : C:\ProgramData\Conduit Folder Deleted : C:\Users\sherry2\AppData\Local\Conduit Folder Deleted : C:\Users\sherry2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Folder Deleted : C:\Users\sherry2\AppData\LocalLow\Conduit Folder Deleted : C:\Users\sherry2\AppData\Roaming\SearchProtect ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Key Deleted : HKCU\Software\SearchProtect Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\SearchProtect Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchProtectAll] ***** [Internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16635 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&SearchSource=61&CUI=UN35281739206954322&UM=2&UP=SP45333DBD-C951-4B8F-B41F-8C3E9C8CEAE9 –> hxxp://www.google.com -\\ Mozilla Firefox v22.0 (en-US) File : C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\prefs.js Deleted : user_pref("CT3288691_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[…] Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3288691&octid=CT328869[…] Deleted : user_pref("Smartbar.ConduitSearchEngineList", "DivX Browser Bar Customized Web Search"); Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691[…] Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", ""); Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3288691"); Deleted : user_pref("browser.search.defaultthis.engineName", "DivX Browser Bar Customized Web Search"); Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&CUI[…] Deleted : user_pref("browser.search.selectedEngine", "DivX Browser Bar Customized Web Search"); Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3288691&octid=CT3288691&Sea[…] Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3288691&SearchSource=2&CU[…] Deleted : user_pref("smartbar.machineId", "742XYHZ8GPRNKJ3WWGID6VA+CXHQ02ELQWJDUZJTLBTQL3AKMBLHYKJW7YSQ3TFUN2M[…] File : C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\p60t33h1.default\prefs.js [OK] File is clean. -\\ Google Chrome v28.0.1500.72 File : C:\Users\sherry2\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[S1].txt - [4163 octets] - [24/07/2013 12:29:28] ########## EOF - C:\AdwCleaner[S1].txt - [4223 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.2.2 (07.22.2013:2) OS: Windows 7 Home Premium x64 Ran by [removed] on Wed 07/24/2013 at 12:41:17.94 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{34EB7A1A-A946-40C6-990C-72C7FABC661D} ~~~ Files Successfully deleted: [File] C:\eula.1028.txt Successfully deleted: [File] C:\eula.1031.txt Successfully deleted: [File] C:\eula.1033.txt Successfully deleted: [File] C:\eula.1036.txt Successfully deleted: [File] C:\eula.1040.txt Successfully deleted: [File] C:\eula.1041.txt Successfully deleted: [File] C:\eula.1042.txt Successfully deleted: [File] C:\eula.2052.txt Successfully deleted: [File] C:\install.res.1028.dll Successfully deleted: [File] C:\install.res.1031.dll Successfully deleted: [File] C:\install.res.1033.dll Successfully deleted: [File] C:\install.res.1036.dll Successfully deleted: [File] C:\install.res.1040.dll Successfully deleted: [File] C:\install.res.1041.dll Successfully deleted: [File] C:\install.res.1042.dll Successfully deleted: [File] C:\install.res.2052.dll Successfully deleted: [File] C:\install.res.3082.dll ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\sherry2\appdata\local\{293E15A0-9DA7-42CF-8897-32B4E753615A} Successfully deleted: [Empty Folder] C:\Users\sherry2\appdata\local\{FB60009B-947D-4044-B0EB-0594E82D2FF1} ~~~ FireFox Successfully deleted: [File] "C:\Users\sherry2\AppData\Roaming\mozilla\firefox\profiles\crep3gwi.default\extensions\[removed]" Successfully deleted the following from C:\Users\sherry2\AppData\Roaming\mozilla\firefox\profiles\crep3gwi.default\prefs.js user_pref("extensions.crossrider.bic", "13d5adba02da128e53df87350ee83eff"); user_pref("google.toolbar.button_option.cached.gtbSearchBlogs", "
Post #6
Hello, sLeven7.

Thank you for the logs. I'm pleased to hear that your system is now running well. To ensure that malware has not resurfaced during the cleaning phase, as is sometimes the case, please proceed with the following task.

Scan your system with DDS

Please download DDS from HERE. Click Save File. The file will save to your default location.
  • Disable any script blocking protection. (How to Temporarily Disable Security Programs: Anti-virus/Anti-spyware/Firewall)
  • Double click dds.com > Click Run.
  • At the next prompt, ensure check marks appear next to dds.com and attach.txt > Click Start to begin the scan. When done, click OK to close the DDS window.
  • Two reports will automatically open: dds.txt and Attach.txt. These reports are also saved to your desktop.
Please copy and paste the scan results of DDS.txt.

Please attach the second file: Attach.txt.

To attach a file, do the following:
  • Under the reply panel is the Attachments Panel.
  • Browse for the attachment file you want to upload, then click the green Upload button.
  • Once it has uploaded, click the Manage Current Attachments drop down box.
  • Click on [external image: Posted Image] to insert the attachment into your post.
Post #7
Thank again for all the help. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16635 BrowserJavaVersion: 10.25.2 Run by [removed] at 8:42:33 on 2013-07-25 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.2205 [GMT -4:00] . AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} . ============== Running Processes =============== . C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k GPSvcGroup C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\atieclxx.exe C:\windows\system32\svchost.exe -k NetworkService C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\windows\system32\taskhost.exe C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe C:\windows\SysWOW64\svchost.exe -k Akamai C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files\Microsoft Security Client\msseces.exe C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe C:\Program Files (x86)\Windows Sidebar\sidebar.exe C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe C:\Users\sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe C:\windows\system32\svchost.exe -k imgsvc C:\Windows\system32\TODDSrv.exe C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe C:\Program Files\TOSHIBA\TECO\TecoService.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe C:\windows\system32\taskeng.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\windows\splwow64.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\System32\WUDFHost.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\LSI SoftModem\agr64svc.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\TOSHIBA\rselect\RSelSvc.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com uDefault_Search_URL = hxxp://www.google.com/ie uProxyOverride = 127.0.0.1:9421;192.168.*.*; uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll uRun: [Akamai NetSession Interface] "C:\Users\sherry2\AppData\Local\Akamai\netsession_win.exe" uRun: [VueMinder] "C:\Program Files (x86)\VueSoft\VueMinder\VueMinder.exe" 1 uRun: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe uRun: [1A7660B26AC462035AF5AB4A35435CCA01AA57E1._service_run] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" –type=service mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon mRun: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\Users\sherry2\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\sherry2\AppData\Roaming\Dropbox\bin\Dropbox.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:221 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:28 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Add to Google Photos Screensa&ver - C:\windows\System32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\OFFICE11\EXCEL.EXE/3000 IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . TCP: NameServer = 65.32.5.111 65.32.5.112 TCP: Interfaces\{A2DAF245-EF74-4D98-8FA2-4A0C8FBCBDDD} : DHCPNameServer = [removed] [removed] TCP: Interfaces\{A2DAF245-EF74-4D98-8FA2-4A0C8FBCBDDD}\85D445F53597374756D637 : DHCPNameServer = 192.168.10.1 mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon x64-Run: [Logitech Download Assistant] C:\windows\System32\rundll32.exe C:\windows\System32\LogiLDA.dll,LogiFetch x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\ FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files (x86)\mozilla firefox\extensions\[removed]\components\KavLinkFilter.dll FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll FF - component: C:\Users\sherry2\AppData\Roaming\Mozilla\Firefox\Profiles\crep3gwi.default\extensions\[removed]\components\plugins.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll FF - plugin: C:\windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\windows\SysWOW64\npmproxy.dll . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2013-1-20 230320] R0 RapportKE64;RapportKE64;C:\windows\System32\drivers\RapportKE64.sys [2013-2-9 236688] R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\drivers\tos_sps64.sys [2010-5-22 482384] R1 RapportCerberus_53984;RapportCerberus_53984;C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\53984\RapportCerberus64_53984.sys [2013-6-23 588048] R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2013-6-18 229040] R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2013-6-18 357712] R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928] R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368] R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672] R2 Akamai;Akamai NetSession Interface;C:\windows\System32\svchost.exe -k Akamai [2009-7-13 27136] R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2010-5-22 203264] R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688] R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368] R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448] R2 Garmin Core Update Service;Garmin Core Update Service;C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-12 185688] R2 MotoHelper;MotoHelper Service;C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-12-6 214896] R2 RapportMgmtService;Rapport Management Service;C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2013-6-18 1124632] R2 RSELSVC;TOSHIBA Modem region select service;C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [2009-7-7 65904] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-27 251760] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472] R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2010-5-22 35008] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2010-5-22 215040] R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\System32\drivers\rtl8192se.sys [2010-4-26 1103904] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 WiseBootAssistant;Wise Boot Assistant;C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [2012-11-25 580232] S3 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2010-10-24 130008] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\windows\System32\drivers\rdpvideominiport.sys [2012-10-26 19456] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2010-5-22 222208] S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-5-22 54136] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560] S3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224] S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2012-10-26 57856] S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2010-7-24 1255736] . =============== File Associations =============== . FileExt: .txt: textfile="C:\Program Files (x86)\Windows NT\Accessories\WORDPAD.EXE" "%1" [UserChoice] FileExt: .jse: JSEFile=NOTEPAD.EXE %1 FileExt: .wsf: WSFFile=NOTEPAD.EXE %1 . =============== Created Last 30 ================ . 2013-07-25 04:01:52 76232 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1625B780-7A3C-4A2C-945F-9309A8A0EEB7}\offreg.dll 2013-07-25 03:59:50 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1625B780-7A3C-4A2C-945F-9309A8A0EEB7}\mpengine.dll 2013-07-24 17:31:48 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-07-24 16:41:12 ——– d—–w- C:\windows\ERUNT 2013-07-24 16:29:46 300 —-a-w- C:\windows\DeleteOnReboot.bat 2013-07-24 16:16:49 ——– d—–w- C:\_OTL 2013-07-17 03:43:40 941720 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{DF2CE67D-7DC2-4316-9672-2D988B120B46}\gapaengine.dll 2013-07-11 09:05:12 2706432 —-a-w- C:\windows\System32\mshtml.tlb 2013-07-11 09:05:11 2706432 —-a-w- C:\windows\SysWow64\mshtml.tlb 2013-07-10 12:54:45 1643520 —-a-w- C:\windows\System32\DWrite.dll 2013-07-10 12:54:44 1247744 —-a-w- C:\windows\SysWow64\DWrite.dll 2013-07-04 12:50:42 96168 —-a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll . ==================== Find3M ==================== . 2013-07-17 00:38:19 71048 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-17 00:38:19 692104 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2013-07-04 12:49:09 867240 —-a-w- C:\windows\SysWow64\npDeployJava1.dll 2013-07-04 12:49:08 789416 —-a-w- C:\windows\SysWow64\deployJava1.dll 2013-06-18 20:14:30 236688 —-a-w- C:\windows\System32\drivers\RapportKE64.sys 2013-06-11 23:43:37 1767936 —-a-w- C:\windows\SysWow64\wininet.dll 2013-06-11 23:43:00 2877440 —-a-w- C:\windows\SysWow64\jscript9.dll 2013-06-11 23:42:58 61440 —-a-w- C:\windows\SysWow64\iesetup.dll 2013-06-11 23:42:58 109056 —-a-w- C:\windows\SysWow64\iesysprep.dll 2013-06-11 23:26:20 2241024 —-a-w- C:\windows\System32\wininet.dll 2013-06-11 23:25:16 3958784 —-a-w- C:\windows\System32\jscript9.dll 2013-06-11 23:25:13 67072 —-a-w- C:\windows\System32\iesetup.dll 2013-06-11 23:25:13 136704 —-a-w- C:\windows\System32\iesysprep.dll 2013-06-11 22:51:45 71680 —-a-w- C:\windows\SysWow64\RegisterIEPKEYs.exe 2013-06-11 22:50:58 89600 —-a-w- C:\windows\System32\RegisterIEPKEYs.exe 2013-06-05 03:34:27 3153920 —-a-w- C:\windows\System32\win32k.sys 2013-06-04 06:00:13 624128 —-a-w- C:\windows\System32\qedit.dll 2013-06-04 04:53:07 509440 —-a-w- C:\windows\SysWow64\qedit.dll 2013-05-27 14:04:19 81536 —-a-w- C:\ministub.exe 2013-05-13 05:51:01 184320 —-a-w- C:\windows\System32\cryptsvc.dll 2013-05-13 05:51:00 1464320 —-a-w- C:\windows\System32\crypt32.dll 2013-05-13 05:51:00 139776 —-a-w- C:\windows\System32\cryptnet.dll 2013-05-13 05:50:40 52224 —-a-w- C:\windows\System32\certenc.dll 2013-05-13 04:45:55 140288 —-a-w- C:\windows\SysWow64\cryptsvc.dll 2013-05-13 04:45:55 1160192 —-a-w- C:\windows\SysWow64\crypt32.dll 2013-05-13 04:45:55 103936 —-a-w- C:\windows\SysWow64\cryptnet.dll 2013-05-13 03:43:55 1192448 —-a-w- C:\windows\System32\certutil.exe 2013-05-13 03:08:10 903168 —-a-w- C:\windows\SysWow64\certutil.exe 2013-05-13 03:08:06 43008 —-a-w- C:\windows\SysWow64\certenc.dll 2013-05-10 05:49:27 30720 —-a-w- C:\windows\System32\cryptdlg.dll 2013-05-10 03:20:54 24576 —-a-w- C:\windows\SysWow64\cryptdlg.dll 2013-05-08 06:39:01 1910632 —-a-w- C:\windows\System32\drivers\tcpip.sys 2013-05-08 06:10:12 770384 —-a-w- C:\windows\SysWow64\msvcr100.dll 2013-05-08 06:10:12 421200 —-a-w- C:\windows\SysWow64\msvcp100.dll 2013-05-06 06:03:49 1887744 —-a-w- C:\windows\System32\WMVDECOD.DLL 2013-05-06 04:56:35 1620480 —-a-w- C:\windows\SysWow64\WMVDECOD.DLL 2013-05-02 15:29:56 278800 ——w- C:\windows\System32\MpSigStub.exe 2013-05-01 07:59:12 94208 —-a-w- C:\windows\SysWow64\QuickTimeVR.qtx 2013-05-01 07:59:12 69632 —-a-w- C:\windows\SysWow64\QuickTime.qts . ============= FINISH: 8:43:28.69 ===============

Attachments:

Post #8 last edited
Hello, sLeven7.

Thank you for the DDS log. It indicates that you have a nice, clean healthy system. I would like to walk you through a a bit of housekeeping.

CleanUp with OTL
  • Double-click OTL.exe to run it. (Vista users, please right click on OTL.exe and select "Run as an Administrator.")
  • Close all other programs apart from OTL as this step will require a reboot.
  • On the OTL main screen, click on the CleanUp! button.
  • Click Yes to begin the Cleanup process, and then allow the program to reboot your computer.
  • After the reboot, delete any tools we used from your desktop.
Tool Removal

You no longer need the following tools. Please delete these and any logs from your machine: HJT, DDS, AdwCleaner, and JRT,.

Clean Up Temp Files

Please download TFC by OldTimer to your desktop.
  • Close any open windows.
  • Double click the TFC icon to run the program.
  • TFC will close all open programs itself in order to run.
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish.
  • Once complete, it should automatically reboot your machine.
  • If your computer does not automatically reboot, manually reboot to ensure a complete clean.
Update Adobe Flash

To improve the funtionaility and security of your software, please update Adobe Flash HERE.

Recommended Reading

To help you maintain a clean, safe, and healthy system, the following informative articles may be of interest to you:

How to Prevent Malware by Miekiemoes HERE
So How Did I Get Infected In the First Place? By Tony Klein HERE
Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams HERE
Create Strong Passwords by Microsoft HERE
PC Safety and Security – What do I need to do? by Glaswegian HERE

Please respond to this thread one last time so that we can mark the problem solved and close this topic.

Wishing you always a safe browsing experience.
~fbfbfb

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI