What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Snap.do [Solved]

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Here are the log files from the DDS scan. Thank you again for your help on this ongoing issue. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16635 BrowserJavaVersion: 10.25.2 Run by [removed] at 17:02:34 on 2013-08-06 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3836.2654 [GMT -4:00] . AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_14e7194c26fb7998\STacSV64.exe C:\Windows\system32\Hpservice.exe C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atibtmon.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_14e7194c26fb7998\AESTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Windows\System32\StikyNot.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Windows\system32\taskeng.exe c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com uSearchAssistant = hxxp://www.google.com BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam" mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TCP: NameServer = 192.168.1.1 TCP: Interfaces\{5DB5E617-2694-4DBA-81EA-0CCEE6828EB1} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{5DB5E617-2694-4DBA-81EA-0CCEE6828EB1}\D6F6D6 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{D656838C-974C-4A02-A5EA-2FA8BD87B045} : DHCPNameServer = [removed] [removed] [removed] SSODL: WebCheck - mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - x64-Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe x64-Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey x64-SSODL: WebCheck - . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-1-20 230320] R1 DVMIO;DVMIO;C:\SPLASH.SYS\config\dvmio.sys [2009-9-27 21624] R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_14e7194c26fb7998\AESTSr64.exe [2013-1-17 89600] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-8-5 203264] R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2009-7-8 30520] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-7-23 418376] R2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-7-10 1598128] R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-11-9 228408] R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-5-20 70656] R3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2009-7-28 140128] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-7-23 25928] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-1-17 215040] R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2013-1-17 34872] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-7-23 701512] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368] S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 130008] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864] S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-7-22 59392] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-7-22 1255736] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120] . =============== Created Last 30 ================ . 2013-08-05 19:54:53 789416 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-08-05 19:54:52 867240 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-08-05 19:54:45 96168 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-08-04 14:12:16 ——– d—–w- C:\Program Files (x86)\ESET 2013-08-04 14:11:10 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{04A80EED-0CB2-45B8-BBC1-503CB53C9DA1}\mpengine.dll 2013-08-04 04:48:25 9460976 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-08-04 04:42:55 1643520 —-a-w- C:\Windows\System32\DWrite.dll 2013-08-04 04:42:55 1247744 —-a-w- C:\Windows\SysWow64\DWrite.dll 2013-08-04 04:14:17 ——– d—–w- C:\Users\Owner\AppData\Local\AVG Secure Search 2013-08-04 04:09:50 9728 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-08-03 00:49:10 ——– d-sh–w- C:\$RECYCLE.BIN 2013-08-01 17:38:20 98816 —-a-w- C:\Windows\sed.exe 2013-08-01 17:38:20 256000 —-a-w- C:\Windows\PEV.exe 2013-08-01 17:38:20 208896 —-a-w- C:\Windows\MBR.exe 2013-08-01 17:38:16 ——– d—–w- C:\ComboFix 2013-07-31 18:18:22 ——– d—–w- C:\Windows\ERUNT 2013-07-31 18:11:14 121 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\LocalCopy\{6C5FFD2C-49C7-ED35-CFD0-F7E35CA7E68D}-DeleteOnReboot.bat 2013-07-31 18:10:48 121 —-a-w- C:\Windows\DeleteOnReboot.bat 2013-07-31 15:30:36 55296 —-a-w- C:\Windows\System32\dhcpcsvc6.dll 2013-07-31 15:30:36 44032 —-a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2013-07-31 15:30:36 226816 —-a-w- C:\Windows\System32\dhcpcore6.dll 2013-07-31 15:30:36 193536 —-a-w- C:\Windows\SysWow64\dhcpcore6.dll 2013-07-31 15:30:23 1910632 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2013-07-31 15:29:41 983400 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2013-07-31 15:29:41 265064 —-a-w- C:\Windows\System32\drivers\dxgmms1.sys 2013-07-31 15:29:41 144384 —-a-w- C:\Windows\System32\cdd.dll 2013-07-31 15:29:10 571904 —-a-w- C:\Program Files\Windows Defender\MpClient.dll 2013-07-31 15:29:10 392704 —-a-w- C:\Program Files (x86)\Windows Defender\MpClient.dll 2013-07-31 15:29:10 1011712 —-a-w- C:\Program Files\Windows Defender\MpSvc.dll 2013-07-31 15:29:09 9216 —-a-w- C:\Program Files (x86)\Windows Defender\MpAsDesc.dll 2013-07-31 15:29:09 54784 —-a-w- C:\Program Files (x86)\Windows Defender\MpOAV.dll 2013-07-31 15:29:09 4608 —-a-w- C:\Program Files (x86)\Windows Defender\MsMpLics.dll 2013-07-31 15:29:09 314880 —-a-w- C:\Program Files\Windows Defender\MpCommu.dll 2013-07-31 15:28:26 950128 —-a-w- C:\Windows\System32\drivers\ndis.sys 2013-07-31 15:28:25 41472 —-a-w- C:\Windows\System32\drivers\RNDISMP.sys 2013-07-31 15:28:09 1930752 —-a-w- C:\Windows\System32\authui.dll 2013-07-31 15:28:08 1796096 —-a-w- C:\Windows\SysWow64\authui.dll 2013-07-31 15:28:08 111448 —-a-w- C:\Windows\System32\consent.exe 2013-07-31 15:28:07 70144 —-a-w- C:\Windows\System32\appinfo.dll 2013-07-31 15:27:12 48640 —-a-w- C:\Windows\System32\wwanprotdim.dll 2013-07-31 15:27:12 230400 —-a-w- C:\Windows\System32\wwansvc.dll 2013-07-31 15:27:08 624128 —-a-w- C:\Windows\System32\qedit.dll 2013-07-31 15:27:08 509440 —-a-w- C:\Windows\SysWow64\qedit.dll 2013-07-31 15:27:00 246272 —-a-w- C:\Windows\System32\netcorehc.dll 2013-07-31 15:27:00 216576 —-a-w- C:\Windows\System32\ncsi.dll 2013-07-31 15:27:00 156672 —-a-w- C:\Windows\SysWow64\ncsi.dll 2013-07-31 15:26:59 569344 —-a-w- C:\Windows\System32\iphlpsvc.dll 2013-07-31 15:26:59 303104 —-a-w- C:\Windows\System32\nlasvc.dll 2013-07-31 15:26:58 52224 —-a-w- C:\Windows\SysWow64\nlaapi.dll 2013-07-31 15:26:58 175104 —-a-w- C:\Windows\SysWow64\netcorehc.dll 2013-07-31 15:26:56 70656 —-a-w- C:\Windows\System32\nlaapi.dll 2013-07-31 15:26:56 45568 —-a-w- C:\Windows\System32\drivers\tcpipreg.sys 2013-07-31 15:26:55 18944 —-a-w- C:\Windows\SysWow64\netevent.dll 2013-07-31 15:26:55 18944 —-a-w- C:\Windows\System32\netevent.dll 2013-07-31 15:26:07 1887744 —-a-w- C:\Windows\System32\WMVDECOD.DLL 2013-07-31 15:26:06 1620480 —-a-w- C:\Windows\SysWow64\WMVDECOD.DLL 2013-07-31 15:26:01 245760 —-a-w- C:\Windows\System32\OxpsConverter.exe 2013-07-31 15:24:22 3153920 —-a-w- C:\Windows\System32\win32k.sys 2013-07-31 15:23:07 751104 —-a-w- C:\Windows\System32\win32spl.dll 2013-07-31 15:23:07 492544 —-a-w- C:\Windows\SysWow64\win32spl.dll 2013-07-30 18:31:17 68608 —-a-w- C:\Windows\System32\taskhost.exe 2013-07-30 18:31:14 30720 —-a-w- C:\Windows\System32\cryptdlg.dll 2013-07-30 18:31:13 24576 —-a-w- C:\Windows\SysWow64\cryptdlg.dll 2013-07-30 18:31:03 1367040 —-a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-30 18:31:02 936448 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-30 18:30:47 903168 —-a-w- C:\Windows\SysWow64\certutil.exe 2013-07-30 18:30:47 1192448 —-a-w- C:\Windows\System32\certutil.exe 2013-07-30 18:30:46 184320 —-a-w- C:\Windows\System32\cryptsvc.dll 2013-07-30 18:30:46 1464320 —-a-w- C:\Windows\System32\crypt32.dll 2013-07-30 18:30:46 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll 2013-07-30 18:30:46 139776 —-a-w- C:\Windows\System32\cryptnet.dll 2013-07-30 18:30:46 1160192 —-a-w- C:\Windows\SysWow64\crypt32.dll 2013-07-30 18:30:46 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll 2013-07-30 18:30:45 52224 —-a-w- C:\Windows\System32\certenc.dll 2013-07-30 18:30:45 43008 —-a-w- C:\Windows\SysWow64\certenc.dll 2013-07-30 18:30:17 1887232 —-a-w- C:\Windows\System32\d3d11.dll 2013-07-30 18:30:17 1505280 —-a-w- C:\Windows\SysWow64\d3d11.dll 2013-07-30 18:10:25 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2013-07-24 02:59:38 ——– d—–w- C:\Windows\System32\SPReview 2013-07-24 02:59:11 ——– d—–w- C:\Windows\System32\EventProviders 2013-07-24 02:33:24 388096 —-a-r- C:\Users\Owner\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-07-24 02:33:24 ——– d—–w- C:\Program Files (x86)\Trend Micro 2013-07-24 00:55:26 ——– d—–w- C:\Users\Owner\AppData\Roaming\Malwarebytes 2013-07-24 00:55:10 ——– d—–w- C:\ProgramData\Malwarebytes 2013-07-24 00:55:07 25928 —-a-w- C:\Windows\System32\drivers\mbam.sys 2013-07-24 00:55:07 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-24 00:54:45 ——– d—–w- C:\Users\Owner\AppData\Local\Programs 2013-07-24 00:08:24 941720 ——w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0D53ADB4-4432-40C4-96AF-54538CE8AAE2}\gapaengine.dll 2013-07-24 00:02:03 ——– d—–w- C:\Program Files (x86)\Microsoft Security Client 2013-07-24 00:01:54 ——– d—–w- C:\Program Files\Microsoft Security Client 2013-07-23 23:33:09 ——– d—–w- C:\922cc84fe089fcc045b577 2013-07-23 23:28:52 ——– d—–w- C:\Users\Owner\AppData\Local\emaze 2013-07-23 01:42:38 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-23 01:42:38 692104 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-07-23 00:56:31 ——– d—–w- C:\Users\Owner\AppData\Local\Applications 2013-07-23 00:56:02 48976 —-a-w- C:\Windows\System32\netfxperf.dll 2013-07-23 00:56:02 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2013-07-23 00:54:59 594432 —-a-w- C:\Windows\System32\comdlg32.dll 2013-07-23 00:53:59 983040 —-a-w- C:\Program Files (x86)\Windows Media Player\WMPDMC.exe 2013-07-23 00:52:59 72192 —-a-w- C:\Windows\System32\napdsnap.dll 2013-07-23 00:51:21 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2013-07-23 00:51:20 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll 2013-07-23 00:51:20 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll 2013-07-23 00:43:45 529408 —-a-w- C:\Windows\System32\wbemcomn.dll 2013-07-23 00:43:45 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll 2013-07-23 00:43:37 244736 —-a-w- C:\Windows\System32\sqmapi.dll 2013-07-22 23:52:09 ——– d—–w- C:\Windows\SysWow64\Wat 2013-07-22 23:52:09 ——– d—–w- C:\Windows\System32\Wat 2013-07-22 22:16:03 9728 —-a-w- C:\Windows\System32\Wdfres.dll 2013-07-22 22:16:03 785512 —-a-w- C:\Windows\System32\drivers\Wdf01000.sys 2013-07-22 22:16:03 54376 —-a-w- C:\Windows\System32\drivers\WdfLdr.sys 2013-07-22 22:16:03 2560 —-a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui 2013-07-22 21:27:54 70656 —-a-w- C:\Windows\SysWow64\fontsub.dll 2013-07-22 21:27:54 46080 —-a-w- C:\Windows\System32\atmlib.dll 2013-07-22 21:27:54 367616 —-a-w- C:\Windows\System32\atmfd.dll 2013-07-22 21:27:54 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2013-07-22 21:27:54 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll 2013-07-22 21:27:54 100864 —-a-w- C:\Windows\System32\fontsub.dll 2013-07-22 21:26:13 87040 —-a-w- C:\Windows\System32\drivers\WUDFPf.sys 2013-07-22 21:26:13 84992 —-a-w- C:\Windows\System32\WUDFSvc.dll 2013-07-22 21:26:13 198656 —-a-w- C:\Windows\System32\drivers\WUDFRd.sys 2013-07-22 21:26:13 194048 —-a-w- C:\Windows\System32\WUDFPlatform.dll 2013-07-22 21:26:12 744448 —-a-w- C:\Windows\System32\WUDFx.dll 2013-07-22 21:26:12 45056 —-a-w- C:\Windows\System32\WUDFCoinstaller.dll 2013-07-22 21:26:12 229888 —-a-w- C:\Windows\System32\WUDFHost.exe 2013-07-22 21:19:06 81408 —-a-w- C:\Windows\System32\imagehlp.dll 2013-07-22 21:19:06 5120 —-a-w- C:\Windows\SysWow64\wmi.dll 2013-07-22 21:19:06 5120 —-a-w- C:\Windows\System32\wmi.dll 2013-07-22 21:19:06 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys 2013-07-22 21:19:06 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2013-07-12 20:05:43 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2013-07-10 22:36:45 2871808 —-a-w- C:\Windows\explorer.exe 2013-07-10 22:35:52 288768 —-a-w- C:\Windows\System32\drivers\mrxsmb10.sys 2013-07-10 22:35:52 158208 —-a-w- C:\Windows\System32\drivers\mrxsmb.sys 2013-07-10 22:35:52 128000 —-a-w- C:\Windows\System32\drivers\mrxsmb20.sys 2013-07-10 22:35:50 395776 —-a-w- C:\Windows\System32\webio.dll 2013-07-10 22:35:50 314880 —-a-w- C:\Windows\SysWow64\webio.dll 2013-07-10 22:35:14 1656680 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2013-07-10 22:35:12 515584 —-a-w- C:\Windows\System32\timedate.cpl 2013-07-10 22:35:12 478720 —-a-w- C:\Windows\SysWow64\timedate.cpl 2013-07-10 22:33:54 2002432 —-a-w- C:\Windows\System32\msxml6.dll 2013-07-10 22:32:36 478208 —-a-w- C:\Windows\System32\dpnet.dll 2013-07-10 22:31:57 467456 —-a-w- C:\Windows\System32\drivers\srv.sys 2013-07-10 22:30:51 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2013-07-10 22:30:12 498688 —-a-w- C:\Windows\System32\drivers\afd.sys 2013-07-10 22:30:09 75120 —-a-w- C:\Windows\System32\drivers\partmgr.sys 2013-07-10 22:30:07 715776 —-a-w- C:\Windows\System32\kerberos.dll 2013-07-10 22:30:06 542208 —-a-w- C:\Windows\SysWow64\kerberos.dll 2013-07-10 22:28:17 95744 —-a-w- C:\Windows\System32\synceng.dll 2013-07-10 22:28:17 78336 —-a-w- C:\Windows\SysWow64\synceng.dll 2013-07-10 22:28:16 642944 —-a-w- C:\Windows\System32\winload.efi 2013-07-10 22:28:16 605552 —-a-w- C:\Windows\System32\winload.exe 2013-07-10 22:28:16 566208 —-a-w- C:\Windows\System32\winresume.efi 2013-07-10 22:28:16 518672 —-a-w- C:\Windows\System32\winresume.exe 2013-07-10 22:28:15 20352 —-a-w- C:\Windows\System32\kdusb.dll 2013-07-10 22:28:15 19328 —-a-w- C:\Windows\System32\kd1394.dll 2013-07-10 22:28:15 17792 —-a-w- C:\Windows\System32\kdcom.dll 2013-07-10 22:28:14 63488 —-a-w- C:\Windows\System32\setbcdlocale.dll 2013-07-10 22:27:14 64512 —-a-w- C:\Windows\SysWow64\devobj.dll 2013-07-10 22:27:14 44544 —-a-w- C:\Windows\SysWow64\devrtl.dll 2013-07-10 22:27:14 404480 —-a-w- C:\Windows\System32\umpnpmgr.dll 2013-07-10 22:27:14 252928 —-a-w- C:\Windows\SysWow64\drvinst.exe 2013-07-10 22:27:14 207872 —-a-w- C:\Windows\System32\cfgmgr32.dll 2013-07-10 22:27:14 145920 —-a-w- C:\Windows\SysWow64\cfgmgr32.dll 2013-07-10 22:25:57 466944 —-a-w- C:\Program Files\Common Files\System\ado\msadomd.dll 2013-07-10 22:23:48 77312 —-a-w- C:\Windows\System32\packager.dll 2013-07-10 22:23:48 67072 —-a-w- C:\Windows\SysWow64\packager.dll 2013-07-10 22:08:06 ——– d—–w- C:\Users\Owner\AppData\Roaming\hpqlog 2013-07-10 22:01:33 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2013-07-10 22:01:33 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2013-07-10 22:01:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2013-07-10 21:58:26 2622464 —-a-w- C:\Windows\System32\wucltux.dll 2013-07-10 21:58:16 99840 —-a-w- C:\Windows\System32\wudriver.dll 2013-07-10 21:58:05 36864 —-a-w- C:\Windows\System32\wuapp.exe 2013-07-10 21:58:05 186752 —-a-w- C:\Windows\System32\wuwebv.dll 2013-07-10 21:30:03 ——– d—–w- C:\Users\Owner\AppData\Local\Apple Computer 2013-07-10 21:29:53 33240 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2013-07-10 21:29:01 ——– d—–w- C:\Program Files\iPod 2013-07-10 21:29:00 ——– d—–w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-07-10 21:29:00 ——– d—–w- C:\Program Files\iTunes 2013-07-10 21:29:00 ——– d—–w- C:\Program Files (x86)\iTunes 2013-07-10 21:28:30 ——– d—–w- C:\Users\Owner\AppData\Local\Apple 2013-07-10 21:27:55 ——– d—–w- C:\Program Files\Bonjour 2013-07-10 21:27:55 ——– d—–w- C:\Program Files (x86)\Bonjour 2013-07-10 21:10:55 ——– d—–w- C:\Users\Owner\AppData\Local\Google 2013-07-10 21:10:20 ——– d—–w- C:\Users\Owner\AppData\Local\Deployment 2013-07-10 21:10:20 ——– d—–w- C:\Users\Owner\AppData\Local\Apps 2013-07-10 21:09:06 ——– d—–w- C:\Users\Owner\AppData\Local\AVG SafeGuard toolbar 2013-07-10 21:08:55 ——– d—–w- C:\Users\Owner\AppData\Roaming\TuneUp Software 2013-07-10 21:08:38 ——– d—–w- C:\Program Files (x86)\Common Files\AVG Secure Search 2013-07-10 21:04:59 ——– d–h–w- C:\ProgramData\Common Files 2013-07-10 21:01:42 ——– d—–w- C:\Users\Owner\AppData\Roaming\HpUpdate . ==================== Find3M ==================== . 2013-08-04 04:09:50 9728 —ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-07-29 17:58:20 175616 —-a-w- C:\Windows\System32\msclmd.dll 2013-07-29 17:58:20 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll . ============= FINISH: 17:03:39.48 ===============

Attachments:

Post #17
Hi there,

You're welcome.

Follow these steps to display hidden files and folders.

  • Open Folder Options by clicking the Start button [external image: Posted Image], clicking Control Panel, clicking Appearance and Personalization, and then clicking Folder Options.
  • Click the View tab.
  • Under Advanced settings, click Show hidden files and folders
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan


click on Browse, and upload the following file for analysis:
C:\Windows\Installer\50fb309.msi

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

Download Revo Uninstaller
  • Double click the installation file on the desktop to run the installer.
  • Let it install to the default location.
  • Double click the new Revo Uninstaller Icon on the desktop to start the program.
You will now see a list of installed programs that Revo Uninstaller can remove.
  • Locate the program you are uninstalling

    Snap.Do
    Snap.Do Engine

  • Right Click the Icon then choose Uninstall.
  • Click yes to the warning and choose the Uninstall Mode
  • Choose the Advanced option and then click Next.
  • This will launch the programs built in uninstaller. Be patient it can take several seconds.
  • Once the uninstaller is done click Next.
  • Revo Uninstaller will now scan for leftover information. Be patient it can take several seconds.
  • Once this scan is done click Next.
  • You will then be presented of the leftover entries found by Revo Uninstaller
  • Look at ALL of the entries to ensure they relate to the uninstall.
  • Next click Select All > Delete to remove the entries.
  • Click Next.
  • If there are any program file folders left over you will be presented with a list to be removed.
  • Again look at ALL of the entries to ensure they are related to the uninstall.
  • Click Select All > Delete to remove the entries.
  • Click Finish to go back to the uninstall list.
  • Close the program

===================================================

On your next reply please post :
File scanner result


Please STOP and let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #21
You can now remove the tools we used if you don't have any outstanding issues.

Follow these steps to uninstall Combofix
  • Click START then RUN
  • Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.
Combofix /Uninstall
[external image: Posted Image]

===================================================

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.


Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.


SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
  • How Did I Get Infected In The First Place? by TonyKlein
  • How to Prevent Malware by miekiemoes
  • PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop

WOT has an add-on available for both Firefox and IE.

  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Download Host.zip and Save it to your Desktop.
  • Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
  • Follow the prompts and click 'Finish'.
  • This will open the newly created hosts folder on your Desktop.
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  • Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI