What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser hijacked by conduit [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I did not expect to be back here so soon, for sure. I tried to view a video I had downloaded and it would not display correctly. Nothing has worked correctly with RealPlayer since I had to wipe my hard drive about a month ago. So, since I lost Winamp when I wiped it, I decided to go to a well known place on the net where I have always felt it was safe to download from - in fact, the only place I will download from.

I went through all the steps correctly and of course, there were all kinds of other things that you had to keep an eye on and uncheck because these other things wanted to install with Winamp. I am positive I unchecked everything. Well guess what, I got hijacked, anyway by this conduit dot com browser add-on. I went into IE and disabled it and also in Chrome but it's still there in IE and that's what comes up when I click IE, which I rarely use. It also messed up Chrome and I am not even sure I got that back, correctly or if what I am seeing is actually Chrome or something else. Please help me get this thing off my computer and anything else that came with it. :(

AND I got an error right off the bat saying my system has denied access to the Hosts file and if there is an infection in there, it might not be reported or fixed or something to that effect. :smack:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:59:52 PM, on 8/17/2013
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16502)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\PLFSetI.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files (x86)\AOL Desktop 9.7\waol.exe
C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSMSNLoader32.exe
C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Common Files\AOL\1373719338\ee\aolsoftware.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\AOL Desktop 9.7\shellmon.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_6930
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&…;ctid=CT3300196
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_6930
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_6930
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: WhiteSmoke New V3 Toolbar - {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: WhiteSmoke New V3 - {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: TopArcadeHits Games - {A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - C:\Users\arwen\AppData\Local\TopArcadeHits\Toparcadehits.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: WhiteSmoke New V3 Toolbar - {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files (x86)\Acer\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [LManager] C:\PROGRA~2\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ApnTBMon] "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
O4 - HKLM\..\Run: [HostManager] "C:\Program Files (x86)\Common Files\AOL\1373719338\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LTCM Client] C:\Program Files (x86)\LTCM Client\ltcmClient.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ConduitFloatingPlugin_lcgnmdipgajofmpanhpdinhkgmeifmdo] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll",RunConduitFloatingPlugin lcgnmdipgajofmpanhpdinhkgmeifmdo
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files (x86)\AOL Desktop 9.7\AOL.EXE" -b
O4 - Startup: Acer Product Registration.lnk = C:\Program Files (x86)\Acer\Acer Registration\ACE1.exe
O4 - Global Startup: Start GeekBuddy.lnk = C:\Program Files (x86)\Comodo\GeekBuddy\launcher.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)

–
End of file - 12893 bytes
Post #2
Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
  • Please be sure to subscribe to the topic if you have not already done so.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that…. [external image: Posted Image] Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
———-

[external image: Posted Image] AdwCleaner

Please download AdwCleaner by Xplode onto your desktop.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • A logfile will automatically open after the scan has finished.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[R1].txt as well.
———-
Post #3 last edited
I can't get the aswMBR to download correctly. It downloads but shows up with a different name and appears to be corrupt. I've tried over and over, at least 5 times. Should I go ahead and run the other two and post their logs or wait? Thanks! EDIT: OK, I clicked next to the file as it was downloading and it took me directly to the mbr download page and the file downloaded correctly, as far as I know. So I will run it as instructed.
Post #4
I don't know if this was supposed to happen but after all programs were done and the computer rebooted because of the last program saying it had to in order to complete, when I went to get back on with Chrome, I got a message that none of my preferences were saved and possibly that something was corrupt??? Anyway, here are the files. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16502 BrowserJavaVersion: 10.25.2 Run by [removed] at 22:45:10 on 2013-08-18 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4024.2762 [GMT -5:00] . AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe C:\Program Files\Acer\Empowering Technology\Service\ETService.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Acer\Mobility Center\MobilityService.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio64.exe C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSLoader.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Windows\RAVCpl64.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\PLFSetI.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSMSNLoader32.exe C:\Users\arwen\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files (x86)\Launch Manager\QtZgAcer.EXE C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Common Files\AOL\1373719338\ee\aolsoftware.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe C:\Windows\System32\notepad.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://search.conduit.com?SearchSource=10&CUI=UN91179364280021584&UM=2&ctid=CT3300196 uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 uURLSearchHooks: WhiteSmoke New V3 Toolbar: {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll mURLSearchHooks: WhiteSmoke New V3 Toolbar: {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll mWinlogon: Userinit = userinit.exe BHO: WhiteSmoke New V3 Toolbar: {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: TopArcadeHits Games: {A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - C:\Users\arwen\AppData\Local\TopArcadeHits\Toparcadehits.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: WhiteSmoke New V3 Toolbar: {068969A9-46CD-4E38-9DDB-4939814A3E32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll TB: WhiteSmoke New V3 Toolbar: {068969a9-46cd-4e38-9ddb-4939814a3e32} - C:\Program Files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [ConduitFloatingPlugin_lcgnmdipgajofmpanhpdinhkgmeifmdo] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll",RunConduitFloatingPlugin lcgnmdipgajofmpanhpdinhkgmeifmdo uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" mRun: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" mRun: [BkupTray] "C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" mRun: [Acer Product Registration] "C:\Program Files (x86)\Acer\Acer Registration\ACE1.exe" /startup mRun: [LManager] C:\PROGRA~2\LAUNCH~1\QtZgAcer.EXE mRun: [eRecoveryService] StartupFolder: C:\Users\arwen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ACERPR~1.LNK - C:\Program Files (x86)\Acer\Acer Registration\ACE1.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\STARTG~1.LNK - C:\Program Files (x86)\Comodo\GeekBuddy\launcher.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll TCP: NameServer = 97.64.183.164 97.64.209.37 TCP: Interfaces\{E93E5B99-0B10-4A51-92DE-58B98276B5AE} : DHCPNameServer = [removed] [removed] LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome x64-mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 x64-mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 x64-BHO: ShowBarObj Class: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\ActiveToolBand.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDStoolbar.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [Windows Defender] C:\Program Files (x86)\Windows Defender\MSASCui.exe -hide x64-Run: [IAAnotif] "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" x64-Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe x64-Run: [eDataSecurity Loader] "C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe x64-Run: [RtHDVCpl] RAVCpl64.exe x64-Run: [Skytel] Skytel.exe x64-Run: [PLFSetI] C:\Windows\PLFSetI.exe x64-Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe x64-mPolicies-Explorer: NoActiveDesktop = dword:1 x64-mPolicies-Explorer: NoActiveDesktopChanges = dword:1 x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 x64-mPolicies-System: EnableUIADesktopToggle = dword:0 x64-Notify: igfxcui - igfxdev.dll . ============= SERVICES / DRIVERS =============== . R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2013-7-13 28600] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [2013-7-13 32240] R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2013-7-13 84024] R2 AntiVirService;Avira Real-Time Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2013-7-13 108088] R2 AntiVirWebService;Avira Web Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe [2013-7-13 589368] R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2013-7-13 100712] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-3-3 16384] R2 CLHNService;CLHNService;C:\Program Files (x86)\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2013-7-13 81504] R2 ETService;Empowering Technology Service;C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-12-18 24576] R2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-4-26 45056] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-4-26 131072] R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-4-16 39056] R3 CAXHWAZL;CAXHWAZL;C:\Windows\System32\drivers\CAXHWAZL.sys [2008-12-18 294400] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\System32\drivers\IntcHdmi.sys [2008-12-18 129536] R3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;C:\Windows\System32\drivers\NETw5v64.sys [2008-12-18 4730368] R3 winbondcir;Winbond IR Transceiver;C:\Windows\System32\drivers\winbondcir.sys [2007-3-28 46592] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-4-19 1022632] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2013-7-14 89920] . =============== File Associations =============== . FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %* FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* . =============== Created Last 30 ================ . . ==================== Find3M ==================== . 2013-08-15 04:55:39 78161360 —-a-w- C:\Windows\System32\mrt.exe 2013-07-30 06:48:59 96168 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-07-30 06:48:55 867240 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll 2013-07-30 06:48:55 263592 —-a-w- C:\Windows\SysWow64\javaws.exe 2013-07-30 06:48:55 175016 —-a-w- C:\Windows\SysWow64\javaw.exe 2013-07-30 06:48:55 175016 —-a-w- C:\Windows\SysWow64\java.exe 2013-07-30 06:48:54 789416 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2013-07-25 03:54:29 17830400 —-a-w- C:\Windows\System32\mshtml.dll 2013-07-25 03:37:25 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2013-07-25 03:35:45 10926080 —-a-w- C:\Windows\System32\ieframe.dll 2013-07-25 03:31:23 1346560 —-a-w- C:\Windows\System32\urlmon.dll 2013-07-25 03:30:49 1392128 —-a-w- C:\Windows\System32\wininet.dll 2013-07-25 03:29:41 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2013-07-25 03:29:21 237056 —-a-w- C:\Windows\System32\url.dll 2013-07-25 03:29:06 86016 —-a-w- C:\Windows\System32\jsproxy.dll 2013-07-25 03:28:46 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2013-07-25 03:28:31 599040 —-a-w- C:\Windows\System32\vbscript.dll 2013-07-25 03:28:27 816640 —-a-w- C:\Windows\System32\jscript.dll 2013-07-25 03:28:24 2147840 —-a-w- C:\Windows\System32\iertutil.dll 2013-07-25 03:28:18 729088 —-a-w- C:\Windows\System32\msfeeds.dll 2013-07-25 03:27:29 96768 —-a-w- C:\Windows\System32\mshtmled.dll 2013-07-25 03:27:20 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2013-07-25 03:26:53 248320 —-a-w- C:\Windows\System32\ieui.dll 2013-07-25 02:40:07 12334080 —-a-w- C:\Windows\SysWow64\mshtml.dll 2013-07-25 02:32:35 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2013-07-25 02:30:47 9738752 —-a-w- C:\Windows\SysWow64\ieframe.dll 2013-07-25 02:26:45 1104384 —-a-w- C:\Windows\SysWow64\urlmon.dll 2013-07-25 02:26:10 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2013-07-25 02:25:30 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2013-07-25 02:24:39 231936 —-a-w- C:\Windows\SysWow64\url.dll 2013-07-25 02:24:24 65536 —-a-w- C:\Windows\SysWow64\jsproxy.dll 2013-07-25 02:23:59 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2013-07-25 02:23:58 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2013-07-25 02:23:51 717824 —-a-w- C:\Windows\SysWow64\jscript.dll 2013-07-25 02:23:30 1796096 —-a-w- C:\Windows\SysWow64\iertutil.dll 2013-07-25 02:23:27 607744 —-a-w- C:\Windows\SysWow64\msfeeds.dll 2013-07-25 02:22:47 73216 —-a-w- C:\Windows\SysWow64\mshtmled.dll 2013-07-25 02:22:35 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2013-07-25 02:22:04 176640 —-a-w- C:\Windows\SysWow64\ieui.dll 2013-07-20 06:57:44 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-20 06:57:44 692104 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-07-19 08:30:17 201872 —-a-w- C:\Windows\SysWow64\rmoc3260.dll 2013-07-19 08:30:08 6656 —-a-w- C:\Windows\SysWow64\pndx5016.dll 2013-07-19 08:30:08 5632 —-a-w- C:\Windows\SysWow64\pndx5032.dll 2013-07-19 08:30:06 272896 —-a-w- C:\Windows\SysWow64\pncrt.dll 2013-07-17 20:01:51 2048 —-a-w- C:\Windows\System32\tzres.dll 2013-07-17 19:41:34 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2013-07-17 10:53:52 979456 —-a-w- C:\Windows\SysWow64\MFH264Dec.dll 2013-07-17 10:52:55 519680 —-a-w- C:\Windows\SysWow64\d3d11.dll 2013-07-13 12:32:47 58696 —-a-w- C:\Windows\SysWow64\AOLParconLink.exe 2013-07-13 09:03:22 28600 —-a-w- C:\Windows\System32\drivers\avkmgr.sys 2013-07-13 09:03:22 130016 —-a-w- C:\Windows\System32\drivers\avipbb.sys 2013-07-13 09:03:22 100712 —-a-w- C:\Windows\System32\drivers\avgntflt.sys 2013-07-13 05:57:04 525792 —-a-w- C:\Windows\DIFxAPI.dll 2013-07-13 05:56:59 319488 —-a-w- C:\Windows\HideWin.exe 2013-07-10 09:47:49 677888 —-a-w- C:\Windows\SysWow64\rpcrt4.dll 2013-07-10 09:42:55 1303552 —-a-w- C:\Windows\System32\rpcrt4.dll 2013-07-09 12:04:30 1585256 —-a-w- C:\Windows\System32\ntdll.dll 2013-07-09 12:04:30 1168088 —-a-w- C:\Windows\SysWow64\ntdll.dll 2013-07-08 04:51:57 4691904 —-a-w- C:\Windows\System32\ntoskrnl.exe 2013-07-08 04:20:17 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2013-07-08 04:20:04 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2013-07-08 04:18:51 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2013-07-08 04:16:55 98304 —-a-w- C:\Windows\SysWow64\cryptnet.dll 2013-07-08 04:16:55 133120 —-a-w- C:\Windows\SysWow64\cryptsvc.dll 2013-07-08 04:16:54 992768 —-a-w- C:\Windows\SysWow64\crypt32.dll 2013-07-08 04:16:33 43008 —-a-w- C:\Windows\apppatch\acwow64.dll 2013-07-08 04:15:39 234496 —-a-w- C:\Windows\System32\wow64.dll 2013-07-08 04:15:25 218624 —-a-w- C:\Windows\System32\wintrust.dll 2013-07-08 04:14:21 16384 —-a-w- C:\Windows\System32\ntvdm64.dll 2013-07-08 04:12:34 174592 —-a-w- C:\Windows\System32\cryptsvc.dll 2013-07-08 04:12:34 132096 —-a-w- C:\Windows\System32\cryptnet.dll 2013-07-08 04:12:34 1276416 —-a-w- C:\Windows\System32\crypt32.dll 2013-07-08 01:39:04 26112 —-a-w- C:\Windows\SysWow64\setup16.exe 2013-07-08 01:39:03 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2013-07-08 01:39:02 2560 —-a-w- C:\Windows\SysWow64\user.exe 2013-07-05 04:45:27 1423808 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2013-06-15 13:27:51 20480 —-a-w- C:\Windows\System32\icaapi.dll 2013-06-15 11:38:39 29184 —-a-w- C:\Windows\System32\drivers\tssecsrv.sys 2013-06-04 04:17:26 52736 —-a-w- C:\Windows\apppatch\iebrshim.dll 2013-06-04 04:17:01 145920 —-a-w- C:\Windows\apppatch\AppPatch64\iebrshim.dll 2013-06-04 02:03:07 2775040 —-a-w- C:\Windows\System32\win32k.sys 2013-06-01 04:19:22 619008 —-a-w- C:\Windows\System32\qedit.dll 2013-06-01 04:06:08 505344 —-a-w- C:\Windows\SysWow64\qedit.dll . ============= FINISH: 22:45:45.86 ===============
Post #5
. UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 7/13/2013 1:43:48 AM System Uptime: 8/18/2013 6:32:34 PM (4 hours ago) . Motherboard: Acer | | Makalu Processor: Intel® Core™2 Duo CPU T6400 @ 2.00GHz | U2E1 | 2000/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 143 GiB total, 80.017 GiB free. D: is FIXED (NTFS) - 139 GiB total, 101.111 GiB free. E: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . Acer Arcade Deluxe Acer Crystal Eye Webcam 2.0.8 Acer eAudio Management Acer eDataSecurity Management Acer Empowering Technology Acer ePower Management Acer eRecovery Management Acer eSettings Management Acer GameZone Console 2.0.1.1 Acer GridVista Acer Mobility Center Plug-In Acer Registration Acer ScreenSaver Acrobat.com Activation Assistant for the 2007 Microsoft Office suites Adobe AIR Adobe Flash Player 11 ActiveX Adobe Reader X (10.1.4) Agatha Christie Death on the Nile Alice Greenfingers AOL Uninstaller (Choose which Products to Remove) Apple Application Support Apple Software Update Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver Avira Free Antivirus Avira SearchFree Toolbar plus Web Protection Azada Backspin Billiards Big Kahuna Reef Bookworm Deluxe Bricks of Egypt Cake Mania CCleaner Chicken Invaders 3 Chuzzle CyberLink PowerDirector Diner Dash Flo on the Go eSobi v2 Flip Words 2 GeekBuddy Google Chrome Google Toolbar for Internet Explorer Google Update Helper HDAUDIO Soft Data Fax Modem with SmartCP HiJackThis Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver Intel® Matrix Storage Manager Java 7 Update 25 Java Auto Updater Jewel Quest Solitaire Kick N Rush Launch Manager LightScribe 1.4.142.1 LTCM Client Mahjong Escape Ancient China Mahjongg Artifacts Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft VC9 runtime libraries Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Works MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Mystery Case Files - Huntsville Mystery Solitaire - Secret Island NTI Backup Now 5 NTI Backup Now Standard NTI Media Maker 8 PhotoNow! QuickTime RealDownloader RealNetworks - Microsoft Visual C++ 2008 Runtime RealNetworks - Microsoft Visual C++ 2010 Runtime RealPlayer Realtek High Definition Audio Driver Realtek USB 2.0 Card Reader RealUpgrade 1.1 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407) Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Software Version Updater Synaptics Pointing Device Driver TopArcadeHits Turbo Pizza Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Viewpoint Media Player WhiteSmoke New V3 Toolbar Winamp Winamp Detector Plug-in Winbond CIR Device Drivers Zuma Deluxe . ==== End Of File ===========================
Post #6
aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-08-18 22:59:11 —————————– 22:59:11.854 OS Version: Windows x64 6.0.6002 Service Pack 2 22:59:11.854 Number of processors: 2 586 0x170A 22:59:11.854 ComputerName: ARWEN-PC UserName: arwen 22:59:13.039 Initialize success 22:59:35.425 AVAST engine defs: 13081801 22:59:42.352 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 22:59:42.352 Disk 0 Vendor: Hitachi_ FB4O Size: 305245MB BusType: 3 22:59:42.820 Disk 0 MBR read successfully 22:59:42.820 Disk 0 MBR scan 22:59:42.835 Disk 0 unknown MBR code 22:59:42.851 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12288 MB offset 2048 22:59:42.882 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 146477 MB offset 25167872 22:59:42.898 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 142848 MB offset 325152768 22:59:42.929 Disk 0 Partition 4 00 12 Compaq diag NTFS 3630 MB offset 617705472 22:59:43.257 Disk 0 scanning C:\Windows\system32\drivers 22:59:56.361 Service scanning 23:00:26.203 Modules scanning 23:00:26.203 Disk 0 trace - called modules: 23:00:26.734 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys iaStor.sys hal.dll 23:00:26.749 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80067b5630] 23:00:26.749 3 CLASSPNP.SYS[fffffa6000fcfc33] -> nt!IofCallDriver -> [0xfffffa8004b95d10] 23:00:26.765 5 acpi.sys[fffffa60008e6fde] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004b98050] 23:00:27.873 AVAST engine scan C:\Windows 23:00:31.320 AVAST engine scan C:\Windows\system32 23:04:28.581 AVAST engine scan C:\Windows\system32\drivers 23:04:40.717 AVAST engine scan C:\Users\arwen 23:06:15.753 AVAST engine scan C:\ProgramData 23:06:44.956 Scan finished successfully 23:06:55.267 Disk 0 MBR has been saved successfully to "C:\Users\arwen\Desktop\MBR.dat" 23:06:55.283 The log file has been saved successfully to "C:\Users\arwen\Desktop\aswMBR.txt"
Post #7
# AdwCleaner v2.306 - Logfile created 08/18/2013 at 23:07:38 # Updated 19/07/2013 by Xplode # Operating system : Windows ™ Vista Home Premium Service Pack 2 (64 bits) # User : arwen - ARWEN-PC # Boot Mode : Normal # Running from : C:\Users\arwen\Desktop\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\Conduit Deleted on reboot : C:\Program Files (x86)\Viewpoint Deleted on reboot : C:\Program Files (x86)\WhiteSmoke_New_V3 Deleted on reboot : C:\ProgramData\Viewpoint Deleted on reboot : C:\Users\arwen\AppData\Local\Conduit Deleted on reboot : C:\Users\arwen\AppData\Local\SwvUpdater Deleted on reboot : C:\Users\arwen\AppData\LocalLow\Conduit Deleted on reboot : C:\Users\arwen\AppData\LocalLow\PriceGong Deleted on reboot : C:\Users\arwen\AppData\LocalLow\WhiteSmoke_New_V3 File Deleted : C:\Windows\Tasks\AmiUpdXp.job ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Software\WhiteSmoke_New_V3 Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\AskPartnerNetwork Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WhiteSmoke_New_V3 Toolbar Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{068969A9-46CD-4E38-9DDB-4939814A3E32} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{068969A9-46CD-4E38-9DDB-4939814A3E32} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C91FA958-A258-427B-8DBF-1E87659FC6A8} Key Deleted : HKLM\Software\AskPartnerNetwork Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1 Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3300196 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} Key Deleted : HKLM\SOFTWARE\Classes\Updater.AmiUpd Key Deleted : HKLM\SOFTWARE\Classes\Updater.AmiUpd.1 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\MetaStream Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C91FA958-A258-427B-8DBF-1E87659FC6A8} Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP Key Deleted : HKLM\Software\Viewpoint Key Deleted : HKLM\Software\WhiteSmoke_New_V3 Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{068969A9-46CD-4E38-9DDB-4939814A3E32} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C91FA958-A258-427B-8DBF-1E87659FC6A8} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21BBA96C-83EF-455E-9B6E-BBB080BA32A4} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2519DFB3-F3CC-458C-9371-3CDCC0104CCE} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{068969A9-46CD-4E38-9DDB-4939814A3E32} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WhiteSmoke_New_V3 Toolbar Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{068969A9-46CD-4E38-9DDB-4939814A3E32}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{068969A9-46CD-4E38-9DDB-4939814A3E32}] Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{068969A9-46CD-4E38-9DDB-4939814A3E32}] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon] Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{068969A9-46CD-4E38-9DDB-4939814A3E32}] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16502 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&CUI=UN91179364280021584&UM=2&ctid=CT3300196 –> hxxp://www.google.com -\\ Google Chrome v28.0.1500.95 File : C:\Users\arwen\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.3455] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?ctid=CT3300196&SearchSource=48&CUI[…] ************************* AdwCleaner[S1].txt - [5977 octets] - [18/08/2013 23:07:39] ########## EOF - C:\AdwCleaner[S1].txt - [6037 octets] ##########
Post #8
Oh man, it reinstalled itself. I just got on Facebook and this popped up. I did not click finish. I reloaded the page but it is obvious I am not on Chrome and it just popped up on here, saying it was on my browser. :wacko:

Attachments:

Post #9
Hi,

Thanks for letting me know what is going on with your system. :)

ComboFix

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.


——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #10
OK, this was tricky. First, let me explain that ever since I shut off the web protection for Avira, I cannot get it to load, again. I get an error that the Web protection toolbar has been uninstalled. I don't recall installing that but if it came with Avira, then I guess I did. Avira popped right up even though I had disabled it and blocked Combofix from the registry so I rebooted as instructed and it did it the 2nd time I tried to run Combofix so I went into the Avira program and disabled everything from within the program. I did not reboot, again, but started Combofix and it appears to have run correctly but I can't locate what I disabled in Avira even after rebooting, again. I think it may have reset everything back to the way it was but I am unsure. Here is the log. ComboFix 13-08-19.02 - arwen 08/20/2013 1:53.1.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4024.2107 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Acer\Acer Registration\ACE1.exe c:\users\arwen\AppData\Local\Temp\RtkBtMnt.exe c:\users\arwen\AppData\Local\TopArcadeHits c:\users\arwen\AppData\Local\TopArcadeHits\tah.config c:\users\arwen\AppData\Local\TopArcadeHits\Toparcadehits.dll c:\users\arwen\AppData\Local\TopArcadeHits\uninstaller.exe c:\users\arwen\AppData\Local\TopArcadeHits\updater.exe c:\windows\Tasks\TopArcadeHits.job . . ((((((((((((((((((((((((( Files Created from 2013-07-20 to 2013-08-20 ))))))))))))))))))))))))))))))) . . 2013-08-20 07:03 . 2013-08-20 07:03 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-08-18 04:52 . 2013-08-18 04:52 388096 —-a-r- c:\users\arwen\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-08-18 04:40 . 2013-08-18 04:40 ——– d—–w- c:\program files (x86)\Trend Micro 2013-08-17 10:40 . 2013-08-17 10:40 ——– d—–w- c:\program files\CCleaner 2013-08-16 09:38 . 2009-09-04 22:29 1892184 —-a-w- c:\windows\SysWow64\D3DX9_42.dll 2013-08-16 09:38 . 2006-09-28 21:05 2414360 —-a-w- c:\windows\SysWow64\d3dx9_31.dll 2013-08-16 09:38 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp Detect 2013-08-16 09:37 . 2013-08-16 09:37 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2013-08-16 09:37 . 2013-08-17 10:42 ——– d—–w- c:\users\arwen\AppData\Roaming\Winamp 2013-08-16 09:37 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp 2013-08-16 09:12 . 2013-08-16 09:12 ——– d—–w- c:\users\arwen\AppData\Local\CRE 2013-08-16 09:12 . 2013-08-16 09:12 ——– d—–w- c:\program files (x86)\Conduit 2013-08-16 09:12 . 2013-08-16 09:12 ——– d—–w- c:\users\AppData 2013-08-16 09:12 . 2013-08-16 09:12 ——– d—–w- c:\program files (x86)\WhiteSmoke_New_V3 2013-08-15 00:15 . 2013-07-08 04:51 4691904 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-08-12 05:32 . 2013-08-12 05:32 ——– d—–w- c:\users\arwen\AppData\Local\Apple Computer 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\program files (x86)\QuickTime 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\programdata\Apple Computer 2013-07-31 23:42 . 2013-07-31 23:42 ——– d—–w- c:\users\arwen\AppData\Roaming\Apple Computer 2013-07-31 10:30 . 2013-07-31 10:30 ——– d—–w- c:\program files (x86)\Common Files\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\users\arwen\AppData\Local\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\program files (x86)\Apple Software Update 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\programdata\Apple 2013-07-30 06:49 . 2013-07-30 06:49 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-07-30 06:49 . 2013-07-30 06:48 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-07-30 06:48 . 2013-07-30 06:48 ——– d—–w- c:\program files (x86)\Java 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\users\arwen\AppData\Roaming\Leader Technologies 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\program files (x86)\LTCM Client 2013-07-21 10:08 . 2013-07-21 10:08 ——– d—–w- c:\users\Default\AppData\Local\Microsoft Help . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-15 04:55 . 2006-11-02 12:35 78161360 —-a-w- c:\windows\system32\mrt.exe 2013-07-20 06:57 . 2013-07-20 06:57 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-20 06:57 . 2013-07-20 06:57 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-17 10:55 . 2013-07-17 10:55 161792 —-a-w- c:\windows\SysWow64\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 63488 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 367104 —-a-w- c:\windows\SysWow64\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 152064 —-a-w- c:\windows\SysWow64\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 35840 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 11776 —-a-w- c:\windows\SysWow64\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 101888 —-a-w- c:\windows\SysWow64\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 222208 —-a-w- c:\windows\system32\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 55296 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-07-17 10:55 . 2013-07-17 10:55 49664 —-a-w- c:\windows\system32\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 267776 —-a-w- c:\windows\system32\ieaksie.dll 2013-07-17 10:55 . 2013-07-17 10:55 197120 —-a-w- c:\windows\system32\msrating.dll 2013-07-17 10:55 . 2013-07-17 10:55 163840 —-a-w- c:\windows\system32\ieakui.dll 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\ieakeng.dll 2013-07-17 10:55 . 2013-07-17 10:55 145920 —-a-w- c:\windows\system32\iepeers.dll 2013-07-17 10:55 . 2013-07-17 10:55 136192 —-a-w- c:\windows\system32\advpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 135168 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 12288 —-a-w- c:\windows\system32\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 114176 —-a-w- c:\windows\system32\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 111616 —-a-w- c:\windows\system32\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 10752 —-a-w- c:\windows\system32\msfeedssync.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\ie4uinit.exe 2013-07-17 10:55 . 2013-07-17 10:55 85504 —-a-w- c:\windows\system32\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 82432 —-a-w- c:\windows\system32\icardie.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\system32\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 534528 —-a-w- c:\windows\system32\ieapfltr.dll 2013-07-17 10:55 . 2013-07-17 10:55 452608 —-a-w- c:\windows\system32\dxtmsft.dll 2013-07-17 10:55 . 2013-07-17 10:55 448512 —-a-w- c:\windows\system32\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 403248 —-a-w- c:\windows\system32\iedkcs32.dll 2013-07-17 10:55 . 2013-07-17 10:55 39936 —-a-w- c:\windows\system32\iernonce.dll 2013-07-17 10:55 . 2013-07-17 10:55 3695416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-07-17 10:55 . 2013-07-17 10:55 30720 —-a-w- c:\windows\system32\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 282112 —-a-w- c:\windows\system32\dxtrans.dll 2013-07-17 10:55 . 2013-07-17 10:55 249344 —-a-w- c:\windows\system32\webcheck.dll 2013-07-17 10:55 . 2013-07-17 10:55 165888 —-a-w- c:\windows\system32\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 103936 —-a-w- c:\windows\system32\inseng.dll 2013-07-17 10:55 . 2013-07-17 10:55 65024 —-a-w- c:\windows\system32\pngfilt.dll 2013-07-17 10:55 . 2013-07-17 10:55 149504 —-a-w- c:\windows\system32\occache.dll 2013-07-17 10:53 . 2013-07-17 10:53 979456 —-a-w- c:\windows\SysWow64\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 1257984 —-a-w- c:\windows\system32\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 98816 —-a-w- c:\windows\SysWow64\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 428544 —-a-w- c:\windows\system32\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 377344 —-a-w- c:\windows\system32\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 357376 —-a-w- c:\windows\SysWow64\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 3548672 —-a-w- c:\windows\system32\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 345088 —-a-w- c:\windows\system32\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 34304 —-a-w- c:\windows\system32\mfpmp.exe 2013-07-17 10:53 . 2013-07-17 10:53 302592 —-a-w- c:\windows\SysWow64\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 2873344 —-a-w- c:\windows\SysWow64\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 278528 —-a-w- c:\windows\system32\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 261632 —-a-w- c:\windows\SysWow64\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 209920 —-a-w- c:\windows\SysWow64\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 195072 —-a-w- c:\windows\system32\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 748544 —-a-w- c:\windows\system32\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 586240 —-a-w- c:\windows\SysWow64\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 1204224 —-a-w- c:\windows\system32\shdocvw.dll 2013-07-17 10:53 . 2013-07-17 10:53 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2013-07-17 10:53 . 2013-07-17 10:53 847360 —-a-w- c:\windows\SysWow64\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 625152 —-a-w- c:\windows\system32\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 478720 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 366592 —-a-w- c:\windows\system32\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2013-07-17 10:53 . 2013-07-17 10:53 258048 —-a-w- c:\windows\SysWow64\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 1461760 —-a-w- c:\windows\system32\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2013-07-17 10:53 . 2013-07-17 10:53 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1554432 —-a-w- c:\windows\SysWow64\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 135680 —-a-w- c:\windows\SysWow64\XpsRasterService.dll 2013-07-17 10:52 . 2013-07-17 10:52 519680 —-a-w- c:\windows\SysWow64\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 369664 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 328192 —-a-w- c:\windows\system32\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 262656 —-a-w- c:\windows\system32\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 252928 —-a-w- c:\windows\SysWow64\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 195584 —-a-w- c:\windows\SysWow64\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 974848 —-a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-07-17 10:52 . 2013-07-17 10:52 792576 —-a-w- c:\windows\system32\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 321024 —-a-w- c:\windows\SysWow64\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 189440 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2013-07-13 12:32 . 2013-07-13 12:44 58696 —-a-w- c:\windows\SysWow64\AOLParconLink.exe 2013-07-13 09:03 . 2013-07-13 09:06 28600 —-a-w- c:\windows\system32\drivers\avkmgr.sys 2013-07-13 09:03 . 2013-07-13 09:06 130016 —-a-w- c:\windows\system32\drivers\avipbb.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:52 121392 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ConduitFloatingPlugin_lcgnmdipgajofmpanhpdinhkgmeifmdo"="c:\program files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll" [1622-05-15 287008] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-07-13 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-12 781824] "BkupTray"="c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672] "LManager"="c:\progra~2\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672] "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-07-24 147456] "CLMLServer"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-07-24 167936] "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-07-13 345144] "HostManager"="c:\program files (x86)\Common Files\AOL\1373719338\ee\AOLSoftware.exe" [2010-03-08 41800] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2013-07-19 295512] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "LTCM Client"="c:\program files (x86)\LTCM Client\ltcmClient.exe" [2011-04-07 2756864] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Start GeekBuddy.lnk - c:\program files (x86)\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2013-4-17 49352] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-08-01 10:10 1173456 —-a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . 2013-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:53 50736 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 481792] "eDataSecurity Loader"="c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-07-30 561200] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 151064] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 209432] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 181784] "RtHDVCpl"="RAVCpl64.exe" [2008-09-18 6495264] "Skytel"="Skytel.exe" [2008-09-18 1833504] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1237288] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll TCP: DhcpNameServer = [removed] [removed] . - - - - ORPHANS REMOVED - - - - . BHO-{A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - c:\users\arwen\AppData\Local\TopArcadeHits\Toparcadehits.dll Wow6432Node-HKLM-Run-Acer Product Registration - c:\program files (x86)\Acer\Acer Registration\ACE1.exe Wow6432Node-HKLM-Run-eRecoveryService - (no file) c:\users\arwen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Acer Product Registration.lnk - c:\program files (x86)\Acer\Acer Registration\ACE1.exe /remind /language=ENU /PRNM="Acer Product Registration" SafeBoot-WudfPf SafeBoot-WudfRd AddRemove-{C1C3E833-420E-4D78-9BA7-86AEBB272384} - c:\users\arwen\AppData\Local\TopArcadeHits\uninstaller.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0011) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0011) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0011) @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0011) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-08-20 02:14:50 ComboFix-quarantined-files.txt 2013-08-20 07:14 . Pre-Run: 83,156,865,024 bytes free Post-Run: 81,972,924,416 bytes free . - - End Of File - - 12A8E2180ED5F12C617A62C8E1E10219 BB9D3A6A13C5010348DA7C900BB6AF50
Post #11
ComboFix
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


    ClearJavaCache::

    File::
    c:\program files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll

    Folder::
    c:\program files (x86)\Conduit
    c:\program files (x86)\WhiteSmoke_New_V3

    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ConduitFloatingPlugin_lcgnmdipgajofmpanhpdinhkgmeifmdo"=-

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log to your next reply and also let me know how your system is running. :)
Post #12
Not sure how the computer is running, so far. I seem to have lost Avira after this last scan and a lot of pages are stalling and not wanting to open. I am going to post the log and reboot and see if that doesn't do the trick. ComboFix 13-08-19.02 - arwen 08/20/2013 19:43:44.2.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4024.2633 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\arwen\Desktop\CFScript.txt AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Conduit c:\program files (x86)\Conduit\Community Alerts\Alert.dll c:\program files (x86)\Conduit\CT3300196\plugins\TBVerifier.dll c:\program files (x86)\WhiteSmoke_New_V3 c:\program files (x86)\WhiteSmoke_New_V3\GottenAppsContextMenu.xml c:\program files (x86)\WhiteSmoke_New_V3\hk64tbWhit.dll c:\program files (x86)\WhiteSmoke_New_V3\hktbWhit.dll c:\program files (x86)\WhiteSmoke_New_V3\ldrtbWhit.dll c:\program files (x86)\WhiteSmoke_New_V3\OtherAppsContextMenu.xml c:\program files (x86)\WhiteSmoke_New_V3\prxtbWhit.dll c:\program files (x86)\WhiteSmoke_New_V3\SharedAppsContextMenu.xml c:\program files (x86)\WhiteSmoke_New_V3\tbWhit.dll c:\program files (x86)\WhiteSmoke_New_V3\toolbar.cfg c:\program files (x86)\WhiteSmoke_New_V3\ToolbarContextMenu.xml c:\program files (x86)\WhiteSmoke_New_V3\uninstall.exe c:\program files (x86)\WhiteSmoke_New_V3\WhiteSmoke_New_V3ToolbarHelper.exe c:\users\arwen\AppData\Local\Temp\RtkBtMnt.exe . . ((((((((((((((((((((((((( Files Created from 2013-07-21 to 2013-08-21 ))))))))))))))))))))))))))))))) . . 2013-08-21 00:49 . 2013-08-21 00:49 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-08-18 04:52 . 2013-08-18 04:52 388096 —-a-r- c:\users\arwen\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-08-18 04:40 . 2013-08-18 04:40 ——– d—–w- c:\program files (x86)\Trend Micro 2013-08-17 10:40 . 2013-08-17 10:40 ——– d—–w- c:\program files\CCleaner 2013-08-16 09:38 . 2009-09-04 22:29 1892184 —-a-w- c:\windows\SysWow64\D3DX9_42.dll 2013-08-16 09:38 . 2006-09-28 21:05 2414360 —-a-w- c:\windows\SysWow64\d3dx9_31.dll 2013-08-16 09:38 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp Detect 2013-08-16 09:37 . 2013-08-16 09:37 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2013-08-16 09:37 . 2013-08-17 10:42 ——– d—–w- c:\users\arwen\AppData\Roaming\Winamp 2013-08-16 09:37 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp 2013-08-16 09:12 . 2013-08-16 09:12 ——– d—–w- c:\users\arwen\AppData\Local\CRE 2013-08-16 09:12 . 2013-08-20 07:15 ——– d—–w- c:\users\AppData 2013-08-15 00:15 . 2013-07-08 04:51 4691904 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-08-12 05:32 . 2013-08-12 05:32 ——– d—–w- c:\users\arwen\AppData\Local\Apple Computer 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\program files (x86)\QuickTime 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\programdata\Apple Computer 2013-07-31 23:42 . 2013-07-31 23:42 ——– d—–w- c:\users\arwen\AppData\Roaming\Apple Computer 2013-07-31 10:30 . 2013-07-31 10:30 ——– d—–w- c:\program files (x86)\Common Files\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\users\arwen\AppData\Local\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\program files (x86)\Apple Software Update 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\programdata\Apple 2013-07-30 06:49 . 2013-07-30 06:49 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-07-30 06:49 . 2013-07-30 06:48 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-07-30 06:48 . 2013-07-30 06:48 ——– d—–w- c:\program files (x86)\Java 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\users\arwen\AppData\Roaming\Leader Technologies 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\program files (x86)\LTCM Client . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-15 04:55 . 2006-11-02 12:35 78161360 —-a-w- c:\windows\system32\mrt.exe 2013-07-20 06:57 . 2013-07-20 06:57 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-20 06:57 . 2013-07-20 06:57 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-17 10:55 . 2013-07-17 10:55 161792 —-a-w- c:\windows\SysWow64\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 63488 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 367104 —-a-w- c:\windows\SysWow64\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 152064 —-a-w- c:\windows\SysWow64\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 35840 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 11776 —-a-w- c:\windows\SysWow64\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 101888 —-a-w- c:\windows\SysWow64\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 222208 —-a-w- c:\windows\system32\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 55296 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-07-17 10:55 . 2013-07-17 10:55 49664 —-a-w- c:\windows\system32\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 267776 —-a-w- c:\windows\system32\ieaksie.dll 2013-07-17 10:55 . 2013-07-17 10:55 197120 —-a-w- c:\windows\system32\msrating.dll 2013-07-17 10:55 . 2013-07-17 10:55 163840 —-a-w- c:\windows\system32\ieakui.dll 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\ieakeng.dll 2013-07-17 10:55 . 2013-07-17 10:55 145920 —-a-w- c:\windows\system32\iepeers.dll 2013-07-17 10:55 . 2013-07-17 10:55 136192 —-a-w- c:\windows\system32\advpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 135168 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 12288 —-a-w- c:\windows\system32\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 114176 —-a-w- c:\windows\system32\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 111616 —-a-w- c:\windows\system32\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 10752 —-a-w- c:\windows\system32\msfeedssync.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\ie4uinit.exe 2013-07-17 10:55 . 2013-07-17 10:55 85504 —-a-w- c:\windows\system32\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 82432 —-a-w- c:\windows\system32\icardie.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\system32\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 534528 —-a-w- c:\windows\system32\ieapfltr.dll 2013-07-17 10:55 . 2013-07-17 10:55 452608 —-a-w- c:\windows\system32\dxtmsft.dll 2013-07-17 10:55 . 2013-07-17 10:55 448512 —-a-w- c:\windows\system32\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 403248 —-a-w- c:\windows\system32\iedkcs32.dll 2013-07-17 10:55 . 2013-07-17 10:55 39936 —-a-w- c:\windows\system32\iernonce.dll 2013-07-17 10:55 . 2013-07-17 10:55 3695416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-07-17 10:55 . 2013-07-17 10:55 30720 —-a-w- c:\windows\system32\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 282112 —-a-w- c:\windows\system32\dxtrans.dll 2013-07-17 10:55 . 2013-07-17 10:55 249344 —-a-w- c:\windows\system32\webcheck.dll 2013-07-17 10:55 . 2013-07-17 10:55 165888 —-a-w- c:\windows\system32\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 103936 —-a-w- c:\windows\system32\inseng.dll 2013-07-17 10:55 . 2013-07-17 10:55 65024 —-a-w- c:\windows\system32\pngfilt.dll 2013-07-17 10:55 . 2013-07-17 10:55 149504 —-a-w- c:\windows\system32\occache.dll 2013-07-17 10:53 . 2013-07-17 10:53 979456 —-a-w- c:\windows\SysWow64\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 1257984 —-a-w- c:\windows\system32\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 98816 —-a-w- c:\windows\SysWow64\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 428544 —-a-w- c:\windows\system32\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 377344 —-a-w- c:\windows\system32\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 357376 —-a-w- c:\windows\SysWow64\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 3548672 —-a-w- c:\windows\system32\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 345088 —-a-w- c:\windows\system32\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 34304 —-a-w- c:\windows\system32\mfpmp.exe 2013-07-17 10:53 . 2013-07-17 10:53 302592 —-a-w- c:\windows\SysWow64\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 2873344 —-a-w- c:\windows\SysWow64\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 278528 —-a-w- c:\windows\system32\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 261632 —-a-w- c:\windows\SysWow64\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 209920 —-a-w- c:\windows\SysWow64\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 195072 —-a-w- c:\windows\system32\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 748544 —-a-w- c:\windows\system32\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 586240 —-a-w- c:\windows\SysWow64\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 1204224 —-a-w- c:\windows\system32\shdocvw.dll 2013-07-17 10:53 . 2013-07-17 10:53 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2013-07-17 10:53 . 2013-07-17 10:53 847360 —-a-w- c:\windows\SysWow64\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 625152 —-a-w- c:\windows\system32\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 478720 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 366592 —-a-w- c:\windows\system32\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2013-07-17 10:53 . 2013-07-17 10:53 258048 —-a-w- c:\windows\SysWow64\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 1461760 —-a-w- c:\windows\system32\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2013-07-17 10:53 . 2013-07-17 10:53 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1554432 —-a-w- c:\windows\SysWow64\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 135680 —-a-w- c:\windows\SysWow64\XpsRasterService.dll 2013-07-17 10:52 . 2013-07-17 10:52 519680 —-a-w- c:\windows\SysWow64\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 369664 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 328192 —-a-w- c:\windows\system32\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 262656 —-a-w- c:\windows\system32\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 252928 —-a-w- c:\windows\SysWow64\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 195584 —-a-w- c:\windows\SysWow64\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 974848 —-a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-07-17 10:52 . 2013-07-17 10:52 792576 —-a-w- c:\windows\system32\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 321024 —-a-w- c:\windows\SysWow64\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 189440 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2013-07-13 12:32 . 2013-07-13 12:44 58696 —-a-w- c:\windows\SysWow64\AOLParconLink.exe 2013-07-13 09:03 . 2013-07-13 09:06 28600 —-a-w- c:\windows\system32\drivers\avkmgr.sys 2013-07-13 09:03 . 2013-07-13 09:06 130016 —-a-w- c:\windows\system32\drivers\avipbb.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA}] c:\users\arwen\AppData\Local\TopArcadeHits\Toparcadehits.dll [BU] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:52 121392 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-07-13 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-12 781824] "BkupTray"="c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672] "LManager"="c:\progra~2\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672] "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-07-24 147456] "CLMLServer"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-07-24 167936] "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-07-13 345144] "HostManager"="c:\program files (x86)\Common Files\AOL\1373719338\ee\AOLSoftware.exe" [2010-03-08 41800] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2013-07-19 295512] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "LTCM Client"="c:\program files (x86)\LTCM Client\ltcmClient.exe" [2011-04-07 2756864] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Start GeekBuddy.lnk - c:\program files (x86)\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2013-4-17 49352] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-08-01 10:10 1173456 —-a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . 2013-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:53 50736 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 481792] "eDataSecurity Loader"="c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-07-30 561200] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 151064] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 209432] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 181784] "RtHDVCpl"="RAVCpl64.exe" [2008-09-18 6495264] "Skytel"="Skytel.exe" [2008-09-18 1833504] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1237288] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll TCP: DhcpNameServer = [removed] [removed] . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0011) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0011) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0011) @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0011) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-08-20 19:51:59 ComboFix-quarantined-files.txt 2013-08-21 00:51 ComboFix2.txt 2013-08-20 07:15 . Pre-Run: 81,873,461,248 bytes free Post-Run: 83,201,744,896 bytes free . - - End Of File - - E79D04E0FE5FF0282008D2E0CFFD9480 BB9D3A6A13C5010348DA7C900BB6AF50
Post #13
I don't usually use IE but I clicked it to see if the hijack was gone. It appeared as normal but this popped up at the bottom. Of course, I clicked DON'T enable! B) The TopAracadeHits Games' add-on from an unknown publisher is ready for use. Enable or Don't enable.
Post #14
Hi,

No don't enable that. :)

Run the tool below and once complete post the log created and let me know if there is any change.


[external image: Posted Image] Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
Post #15 last edited
I got an error that this version was outdated and there was a newer version. It asked if I wanted to update to that and I clicked NO. I am sure you guys are aware of current versions, etc. Here is the log. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.5.2 (08.20.2013:1) OS: Windows ™ Vista Home Premium x64 Ran by [removed] on Thu 08/22/2013 at 4:51:44.90 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{36472399-A9E5-41AE-B23D-A33B160C0AEF} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\viewpoint" Successfully deleted: [Folder] "C:\Users\arwen\appdata\local\cre" Successfully deleted: [Folder] "C:\Users\arwen\appdata\locallow\conduit" Successfully deleted: [Folder] "C:\Program Files (x86)\viewpoint" Successfully deleted: [Folder] "C:\Users\arwen\AppData\Roaming\microsoft\windows\start menu\programs\toparcadehits" ~~~ Chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Thu 08/22/2013 at 4:57:40.29 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI