What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Tricked by fake iTunes, need Adware Malware removal [Solved]

66 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org
 
Database version: v2013.12.09.07
 
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
jeffhess :: JEFFHESS-PC [administrator]
 
12/9/2013 4:51:29 PM
mbar-log-2013-12-09 (16-51-29).txt
 
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 241845
Time elapsed: 20 minute(s), 49 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 0
(No malicious items detected)
 
Physical Sectors Detected: 0
(No malicious items detected)
 
(end)
Post #32
Hi jhess23a,

Scan with SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following code box into the main textfield:
:filefind
*scorpion
saver*
*adpeak*

:regfind
Scorpion Saver
Adpeak
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt



***


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL

:Files
C:\wajam_validate.exe
C:\Windows\SysNative\AdpeakProxy64.dll
C:\temp\InstallServices64.msi 
C:\Windows\Installer\212bab5.msi 


:Commands
[resethosts]
[purity]
[emptytemp]
[Reboot]
    NOTICE: This script was written specifically for this user, for use on that particular machine.
    Running this on another machine may cause damage to your operating system.
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script.
Post #33

thanks! ScorpionSaver is no longer showing in my Programs and Features, but the QuickShare is. There is also a Microsoft Visual C++ 2008 Redistributable installed on 11/27 which was the day after we first were infected. I don't know if that's a legitimate program.

 

SystemLook 30.07.11 by jpshortstuff
Log created at 13:21 on 10/12/2013 by jeffhess
Administrator - Elevation successful
 
========== filefind ==========
 
Searching for "*scorpion"
No files found.
 
Searching for "saver*"
No files found.
 
Searching for "*adpeak*"
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\Windows\System32\AdpeakProxy64.dll –a—- 439296 bytes [11:07 02/12/2013] [15:18 16/10/2013] 78857BF5996E9BC8E82C1B671CBF85E6
 
========== regfind ==========
 
Searching for "Scorpion Saver"
[HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
[HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\Scorpion Saver]
[HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\Scorpion Saver]
 
Searching for "Adpeak"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
"LocalService"="AdpeakProxy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
"LocalService"="AdpeakProxy"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}\LocalServer32]
@=""C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
"LocalService"="AdpeakProxy"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\AdpeakProxy]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\AppId_Catalog\049970F0]
"AppFullPath"="C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\AdpeakProxy]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\WinSock2\Parameters\AppId_Catalog\049970F0]
"AppFullPath"="C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AdpeakProxy]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\AppId_Catalog\049970F0]
"AppFullPath"="C:\Program Files\ScorpionSaver Services\AdpeakProxy.exe"
 
-= EOF =-
Post #34

The OTL scan with fix.

 

All processes killed
========== OTL ==========
========== FILES ==========
C:\wajam_validate.exe moved successfully.
C:\Windows\SysNative\AdpeakProxy64.dll moved successfully.
C:\temp\InstallServices64.msi moved successfully.
File\Folder C:\Windows\Installer\212bab5.msi not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: jeffhess
->Temp folder emptied: 12677447 bytes
->Temporary Internet Files folder emptied: 3677560 bytes
->Java cache emptied: 69 bytes
->Google Chrome cache emptied: 160325875 bytes
->Flash cache emptied: 506 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 129728 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18092 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 34947072 bytes
 
Total Files Cleaned = 202.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 12102013_132949
 
Files\Folders moved on Reboot…
C:\Users\jeffhess\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\jeffhess\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
 
PendingFileRenameOperations files…
 
Registry entries deleted on Reboot…
Post #35

OTL number 2

 

OTL logfile created on: 12/10/2013 1:38:40 PM - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\jeffhess\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.68 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 63.34% Memory free
7.36 Gb Paging File | 5.78 Gb Available in Paging File | 78.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.99 Gb Total Space | 155.58 Gb Free Space | 54.78% Space Free | Partition Type: NTFS
 
Computer Name: JEFFHESS-PC | User Name: jeffhess | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Users\jeffhess\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppgooglenaclpluginchrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\a65a89dc687715adf46de23e717b842b\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll ()
MOD - C:\Program Files (x86)\Launch Manager\CdDirIo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (IEEtwCollectorService) – C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (ePowerSvc) – C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV:64bit: - (Updater Service) – C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV - (LeapFrog Connect Device Service) – C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (GoToAssist) – C:\Program Files (x86)\Citrix\GoToAssist\615\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (McComponentHostService) – C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe (McAfee, Inc.)
SRV - (DsiWMIService) – C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (NTI IScheduleSvc) – C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.)
SRV - (NOBU) – C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (MWLService) – C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (IAStorDataMgrSvc) – C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (GameConsoleService) – C:\Program Files (x86)\Acer Games\Acer Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (GREGService) – C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (EPSON_PM_RPCV4_01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (SEIKO EPSON CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (fssfltr) – C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (FlyUsb) – C:\Windows\SysNative\drivers\FlyUsb.sys (LeapFrog)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (UBHelper) – C:\Windows\SysNative\drivers\UBHelper.sys (NTI Corporation)
DRV:64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (k57nd60a) – C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (NTIDrvr) – C:\Windows\SysNative\drivers\NTIDrvr.sys (NTI Corporation)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (HECIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mwlPSDVDisk) – C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) – C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) – C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form;=AARTDF&pc;=MAAR&src;=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls;=com.microsoft:{language}:{referrer:source?}&ie;={inputEncoding}&oe;={outputEncoding}&sourceid;=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\jeffhess\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O1DPlugin: C:\Users\jeffhess\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\jeffhess\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\jeffhess\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\jeffhess\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - Extension: Google Docs = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Google Wallet = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Gmail = C:\Users\jeffhess\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2013/12/10 13:29:50 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Monitor] C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files (x86)\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O9 - Extra 'Tools' menuitem : Add to &VideoGet; - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files (x86)\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab (Photo Upload Plugin Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5783EDF0-2FD1-468D-82C7-ED8EA7F655C2}: DhcpNameServer = [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4D6B147-593F-45C7-AEC3-EBB12A23D49F}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll) - C:\Program Files (x86)\Citrix\GoToAssist\615\g2awinlogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/12/10 13:29:49 | 000,000,000 | —D | C] – C:\_OTL
[2013/12/09 16:51:16 | 000,117,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013/12/08 17:45:58 | 000,000,000 | —D | C] – C:\Users\jeffhess\Desktop\Gift of Heart 2013
[2013/12/08 10:23:32 | 002,347,384 | —- | C] (ESET) – C:\Users\jeffhess\Desktop\esetsmartinstaller_enu.exe
[2013/12/07 19:51:20 | 000,000,000 | —D | C] – C:\ProgramData\Oracle
[2013/12/07 19:50:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/12/07 19:50:48 | 000,264,616 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/12/07 19:50:35 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/12/07 19:50:35 | 000,174,504 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/12/07 19:50:35 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/12/07 19:50:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/12/06 17:43:35 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/12/06 16:14:21 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/12/06 16:14:21 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/12/06 16:14:21 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/12/06 16:14:08 | 000,000,000 | —D | C] – C:\Qoobox
[2013/12/06 16:13:51 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/12/06 16:12:46 | 005,153,080 | R— | C] (Swearware) – C:\Users\jeffhess\Desktop\ComboFix.exe
[2013/12/05 06:07:09 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013/12/04 16:20:16 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/12/04 16:00:17 | 000,091,352 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013/12/04 15:59:44 | 000,000,000 | —D | C] – C:\Users\jeffhess\Desktop\mbar
[2013/12/04 15:59:19 | 012,576,792 | —- | C] (Malwarebytes Corp.) – C:\Users\jeffhess\Desktop\mbar-1.07.0.1007.exe
[2013/12/02 12:50:28 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\jeffhess\Desktop\OTL.exe
[2013/11/27 12:02:21 | 000,028,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEUDINIT.EXE
[2013/11/27 12:00:01 | 000,940,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013/11/27 12:00:01 | 000,194,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013/11/27 11:59:59 | 001,926,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/11/27 11:59:59 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013/11/27 11:59:59 | 000,645,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013/11/27 11:59:59 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013/11/27 11:59:59 | 000,440,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/11/27 11:59:59 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013/11/27 11:59:59 | 000,235,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013/11/27 11:59:59 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/11/27 11:59:59 | 000,164,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013/11/27 11:59:59 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/11/27 11:59:59 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013/11/27 11:59:59 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013/11/27 11:59:59 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013/11/27 11:59:58 | 005,765,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/11/27 11:59:58 | 001,993,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/11/27 11:59:58 | 001,228,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013/11/27 11:59:58 | 001,051,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013/11/27 11:59:58 | 000,942,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013/11/27 11:59:58 | 000,817,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013/11/27 11:59:58 | 000,774,144 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/11/27 11:59:58 | 000,708,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013/11/27 11:59:58 | 000,626,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/11/27 11:59:58 | 000,616,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013/11/27 11:59:58 | 000,610,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/11/27 11:59:58 | 000,574,976 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/11/27 11:59:58 | 000,553,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013/11/27 11:59:58 | 000,548,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/11/27 11:59:58 | 000,453,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013/11/27 11:59:58 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013/11/27 11:59:58 | 000,296,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013/11/27 11:59:58 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013/11/27 11:59:58 | 000,235,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/11/27 11:59:58 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/11/27 11:59:58 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013/11/27 11:59:58 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013/11/27 11:59:58 | 000,151,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013/11/27 11:59:58 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013/11/27 11:59:58 | 000,143,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013/11/27 11:59:58 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013/11/27 11:59:58 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/11/27 11:59:58 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013/11/27 11:59:58 | 000,131,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013/11/27 11:59:58 | 000,127,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013/11/27 11:59:58 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013/11/27 11:59:58 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/11/27 11:59:58 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013/11/27 11:59:58 | 000,111,616 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013/11/27 11:59:58 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/11/27 11:59:58 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013/11/27 11:59:58 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013/11/27 11:59:58 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/11/27 11:59:58 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/11/27 11:59:58 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/11/27 11:59:58 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013/11/27 11:59:58 | 000,083,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013/11/27 11:59:58 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013/11/27 11:59:58 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013/11/27 11:59:58 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013/11/27 11:59:58 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/11/27 11:59:58 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/11/27 11:59:58 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013/11/27 11:59:58 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013/11/27 11:59:58 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/11/27 11:59:58 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013/11/27 11:59:58 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013/11/27 11:59:58 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013/11/27 11:59:58 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013/11/27 11:59:58 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/11/27 11:59:58 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/11/27 11:59:58 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013/11/27 11:59:58 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013/11/27 11:59:58 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013/11/27 11:59:58 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013/11/27 11:59:58 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013/11/27 11:59:58 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013/11/27 07:31:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/11/26 17:31:39 | 000,000,000 | —D | C] – C:\Users\jeffhess\AppData\Local\cache
[2013/11/26 17:31:35 | 000,000,000 | —D | C] – C:\Users\jeffhess\AppData\Local\Mobogenie
[2013/11/26 17:28:52 | 000,000,000 | —D | C] – C:\temp
[2013/11/16 07:35:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/11/13 19:17:17 | 001,474,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013/11/13 19:17:08 | 001,930,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2013/11/13 19:17:08 | 001,796,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2013/11/13 19:17:08 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\credui.dll
[2013/11/13 19:17:08 | 000,190,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SmartcardCredentialProvider.dll
[2013/11/13 19:17:08 | 000,152,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SmartcardCredentialProvider.dll
[2013/11/13 19:16:53 | 001,447,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\lsasrv.dll
[2013/11/13 19:16:53 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspicli.dll
[2013/11/13 19:16:52 | 000,307,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ncrypt.dll
[2013/11/13 19:16:52 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\sspisrv.dll
[2013/11/13 19:16:52 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\secur32.dll
[2013/11/13 19:16:49 | 000,404,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gdi32.dll
[2013/11/13 19:16:48 | 000,324,096 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\FWPUCLNT.DLL
[2013/11/13 19:16:47 | 000,830,464 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\nshwfp.dll
[2013/11/13 19:16:47 | 000,656,896 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\nshwfp.dll
[2013/11/13 19:16:47 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\FWPUCLNT.DLL
 
========== Files - Modified Within 30 Days ==========
 
[2013/12/10 13:38:43 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/12/10 13:38:43 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/12/10 13:36:00 | 000,000,902 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/12/10 13:30:59 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/12/10 13:30:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/12/10 13:30:45 | 2962,259,968 | -HS- | M] () – C:\hiberfil.sys
[2013/12/10 13:30:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/12/10 13:29:50 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2013/12/10 13:20:48 | 000,165,376 | —- | M] () – C:\Users\jeffhess\Desktop\SystemLook_x64.exe
[2013/12/10 13:18:45 | 000,726,444 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/12/10 13:18:45 | 000,624,412 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/12/10 13:18:45 | 000,106,756 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/12/10 13:17:56 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-892468639-2113563247-567691228-1001UA.job
[2013/12/10 06:02:43 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-892468639-2113563247-567691228-1001Core.job
[2013/12/09 17:18:32 | 000,417,416 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/12/09 16:51:16 | 000,117,464 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013/12/09 16:50:12 | 000,001,569 | —- | M] () – C:\Users\jeffhess\Desktop\mbar-1.07.0.1008 - Shortcut.lnk
[2013/12/09 16:48:50 | 000,018,103 | —- | M] () – C:\Users\jeffhess\Documents\Gift 2013.wlmp
[2013/12/09 16:44:28 | 000,079,117 | —- | M] () – C:\Users\jeffhess\Desktop\QuickSaver Program Uninstall Fail.jpg
[2013/12/08 10:23:32 | 002,347,384 | —- | M] (ESET) – C:\Users\jeffhess\Desktop\esetsmartinstaller_enu.exe
[2013/12/07 19:50:27 | 000,264,616 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/12/07 19:50:27 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/12/07 19:50:27 | 000,174,504 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/12/07 19:50:27 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/12/06 16:12:56 | 005,153,080 | R— | M] (Swearware) – C:\Users\jeffhess\Desktop\ComboFix.exe
[2013/12/05 22:01:09 | 000,000,565 | —- | M] () – C:\Users\jeffhess\Desktop\MBR.zip
[2013/12/05 21:51:23 | 000,000,512 | —- | M] () – C:\Users\jeffhess\Desktop\MBR.dat
[2013/12/05 17:14:46 | 000,002,187 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/12/05 06:06:42 | 000,091,352 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013/12/04 16:20:10 | 000,001,515 | —- | M] () – C:\Users\jeffhess\Desktop\AdwCleaner - Shortcut.lnk
[2013/12/04 15:59:21 | 012,576,792 | —- | M] (Malwarebytes Corp.) – C:\Users\jeffhess\Desktop\mbar-1.07.0.1007.exe
[2013/12/04 15:47:19 | 000,891,200 | —- | M] () – C:\Users\jeffhess\Desktop\SecurityCheck.exe
[2013/12/02 12:50:31 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\jeffhess\Desktop\OTL.exe
[2013/12/01 20:29:25 | 000,002,283 | —- | M] () – C:\Users\jeffhess\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/11/27 12:00:01 | 000,940,032 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013/11/27 12:00:01 | 000,194,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\elshyph.dll
[2013/11/27 11:59:59 | 001,926,656 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/11/27 11:59:59 | 000,703,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2013/11/27 11:59:59 | 000,645,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jsIntl.dll
[2013/11/27 11:59:59 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2013/11/27 11:59:59 | 000,440,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/11/27 11:59:59 | 000,337,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2013/11/27 11:59:59 | 000,235,008 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\elshyph.dll
[2013/11/27 11:59:59 | 000,233,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/11/27 11:59:59 | 000,164,864 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2013/11/27 11:59:59 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/11/27 11:59:59 | 000,069,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2013/11/27 11:59:59 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2013/11/27 11:59:59 | 000,034,816 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013/11/27 11:59:59 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2013/11/27 11:59:58 | 005,765,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/11/27 11:59:58 | 001,993,728 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/11/27 11:59:58 | 001,228,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmlmedia.dll
[2013/11/27 11:59:58 | 001,051,136 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmlmedia.dll
[2013/11/27 11:59:58 | 000,942,592 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jsIntl.dll
[2013/11/27 11:59:58 | 000,817,664 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2013/11/27 11:59:58 | 000,774,144 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/11/27 11:59:58 | 000,708,608 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\jscript9diag.dll
[2013/11/27 11:59:58 | 000,626,176 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/11/27 11:59:58 | 000,616,104 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2013/11/27 11:59:58 | 000,610,304 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/11/27 11:59:58 | 000,574,976 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/11/27 11:59:58 | 000,553,472 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9diag.dll
[2013/11/27 11:59:58 | 000,548,352 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/11/27 11:59:58 | 000,453,120 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2013/11/27 11:59:58 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2013/11/27 11:59:58 | 000,296,960 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2013/11/27 11:59:58 | 000,247,808 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2013/11/27 11:59:58 | 000,235,520 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/11/27 11:59:58 | 000,218,624 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/11/27 11:59:58 | 000,195,584 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2013/11/27 11:59:58 | 000,167,424 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2013/11/27 11:59:58 | 000,151,552 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2013/11/27 11:59:58 | 000,147,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2013/11/27 11:59:58 | 000,143,872 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2013/11/27 11:59:58 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2013/11/27 11:59:58 | 000,139,264 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/11/27 11:59:58 | 000,135,680 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2013/11/27 11:59:58 | 000,131,072 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2013/11/27 11:59:58 | 000,127,488 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2013/11/27 11:59:58 | 000,116,736 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2013/11/27 11:59:58 | 000,112,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/11/27 11:59:58 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollector.exe
[2013/11/27 11:59:58 | 000,111,616 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2013/11/27 11:59:58 | 000,105,984 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/11/27 11:59:58 | 000,101,376 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2013/11/27 11:59:58 | 000,090,112 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2013/11/27 11:59:58 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/11/27 11:59:58 | 000,086,016 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/11/27 11:59:58 | 000,084,992 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/11/27 11:59:58 | 000,083,968 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\MshtmlDac.dll
[2013/11/27 11:59:58 | 000,083,456 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2013/11/27 11:59:58 | 000,081,408 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2013/11/27 11:59:58 | 000,077,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2013/11/27 11:59:58 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013/11/27 11:59:58 | 000,069,632 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/11/27 11:59:58 | 000,066,048 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/11/27 11:59:58 | 000,062,464 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2013/11/27 11:59:58 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\MshtmlDac.dll
[2013/11/27 11:59:58 | 000,061,952 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/11/27 11:59:58 | 000,056,832 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2013/11/27 11:59:58 | 000,051,200 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\ieetwproxystub.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2013/11/27 11:59:58 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwproxystub.dll
[2013/11/27 11:59:58 | 000,048,128 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2013/11/27 11:59:58 | 000,040,448 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013/11/27 11:59:58 | 000,033,792 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/11/27 11:59:58 | 000,032,768 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/11/27 11:59:58 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2013/11/27 11:59:58 | 000,016,284 | —- | M] () – C:\Windows\SysWow64\ieuinit.inf
[2013/11/27 11:59:58 | 000,016,284 | —- | M] () – C:\Windows\SysNative\ieuinit.inf
[2013/11/27 11:59:58 | 000,013,824 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2013/11/27 11:59:58 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2013/11/27 11:59:58 | 000,012,800 | —- | M] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2013/11/27 11:59:58 | 000,004,096 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\ieetwcollectorres.dll
[2013/11/27 07:12:55 | 000,000,826 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2013/11/17 20:40:54 | 000,000,896 | —- | M] () – C:\Users\jeffhess\.powerschool_gradebook.properties
 
========== Files Created - No Company Name ==========
 
[2013/12/10 13:20:46 | 000,165,376 | —- | C] () – C:\Users\jeffhess\Desktop\SystemLook_x64.exe
[2013/12/09 17:18:12 | 000,417,416 | —- | C] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/12/09 16:50:03 | 000,001,569 | —- | C] () – C:\Users\jeffhess\Desktop\mbar-1.07.0.1008 - Shortcut.lnk
[2013/12/09 16:44:27 | 000,079,117 | —- | C] () – C:\Users\jeffhess\Desktop\QuickSaver Program Uninstall Fail.jpg
[2013/12/08 18:51:41 | 000,018,103 | —- | C] () – C:\Users\jeffhess\Documents\Gift 2013.wlmp
[2013/12/06 16:14:21 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/12/06 16:14:21 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/12/06 16:14:21 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/12/06 16:14:21 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/12/06 16:14:21 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/12/05 22:01:09 | 000,000,565 | —- | C] () – C:\Users\jeffhess\Desktop\MBR.zip
[2013/12/05 21:51:23 | 000,000,512 | —- | C] () – C:\Users\jeffhess\Desktop\MBR.dat
[2013/12/04 16:19:56 | 000,001,515 | —- | C] () – C:\Users\jeffhess\Desktop\AdwCleaner - Shortcut.lnk
[2013/12/04 15:46:54 | 000,891,200 | —- | C] () – C:\Users\jeffhess\Desktop\SecurityCheck.exe
[2013/11/27 11:59:58 | 000,016,284 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2013/11/27 11:59:58 | 000,016,284 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2013/11/27 07:31:35 | 000,002,283 | —- | C] () – C:\Users\jeffhess\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/11/27 07:31:35 | 000,002,187 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2013/11/27 07:31:00 | 000,000,902 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/27 07:30:59 | 000,000,898 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/26 17:30:58 | 000,016,896 | —- | C] () – C:\Windows\SysNative\sasnative64.exe
[2013/11/02 06:23:05 | 000,002,111 | —- | C] () – C:\Users\jeffhess\AppData\Roaming\evpro32.prf
[2011/09/24 19:19:36 | 000,000,896 | —- | C] () – C:\Users\jeffhess\.powerschool_gradebook.properties
[2011/09/24 19:14:25 | 000,000,012 | —- | C] () – C:\Users\jeffhess\.gradebook_userdict.tlx
[2011/08/25 14:41:01 | 000,103,784 | —- | C] () – C:\Users\jeffhess\GoToAssistDownloadHelper.exe
[2011/06/11 07:50:32 | 000,003,584 | —- | C] () – C:\Users\jeffhess\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/07/25 21:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/25 20:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
< End of report >
Post #36
Hi jhess23a,

Scan with SystemLook again:
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following code box into the main textfield:
:filefind
*QuickShare*
*ScorpionSaver*

:regfind
QuickShare
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #37
SystemLook 30.07.11 by jpshortstuff
Log created at 06:14 on 11/12/2013 by jeffhess
Administrator - Elevation successful
 
========== filefind ==========
 
Searching for "*QuickShare*"
No files found.
 
Searching for "*ScorpionSaver*"
No files found.
 
========== regfind ==========
 
Searching for "QuickShare"
[HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\DC11704F3B065F54585C1FAA04C0B1E6]
"ProductName"="QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"URLInfoAbout"="http://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"DisplayName"="QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F40711CD-60B3-45F5-85C5-F1AA400C1B6E}]
"URLInfoAbout"="http://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F40711CD-60B3-45F5-85C5-F1AA400C1B6E}]
"DisplayName"="QuickShare"
[HKEY_USERS\S-1-5-21-892468639-2113563247-567691228-1001\Software\Microsoft\Installer\Products\DC11704F3B065F54585C1FAA04C0B1E6]
"ProductName"="QuickShare"
 
-= EOF =-
Post #38
Hi jhess23a,

Tweaking.com Registry Backup
  • Download the tool found here to your Desktop so it is easy to find.
  • Double click on the file you just downloaded to install it to your system.
  • Once the tool is installed, double-click on the Tweaking.com Registry Backup icon

    *Note:* The tool should automatically open to the Backup Registry tab.
  • Press Backup Now
  • When the back up is complete, the tool will tell you that Successful */* Files Backed Up
  • You have now successfully backed up your Registry.

***


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL

:Files
C:\Windows\System32\AdpeakProxy64.dll

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
[-HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\Scorpion Saver]
[-HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\Scorpion Saver]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{AE91F9CE-0900-4E2A-B673-F3F6E4FC54D9}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}\LocalServer32]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AdpeakProxy]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\AppId_Catalog\049970F0]
[-HKEY_CURRENT_USER\So ftware\Microsoft\Installer\Products\DC11704F3B065F54585C1FAA04C0B1E6]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F40711CD-60B3-45F5-85C5-F1AA400C1B6E}]
[-HKEY_USERS\S-1-5-21-892468639-2113563247-567691228-1001\Software\Microsoft\Installer\Products\DC11704F3B065F54585C1FAA04C0B1E6]


:Commands
[purity]
[Reboot]
    NOTICE: This script was written specifically for this user, for use on that particular machine.
    Running this on another machine may cause damage to your operating system.
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post Fix OTL log.

***


Scan with SystemLook again:
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following code box into the main textfield:
:filefind
*QuickShare*
*ScorpionSaver*
*Scorpion Saver*
*Adpeak*

:regfind
QuickShare
ScorpionSaver
Scorpion Saver
Adpeak
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #39

OK. thanks! I ran all three programs but I couldn't find the OTL fix log. 

 

SystemLook 30.07.11 by jpshortstuff
Log created at 17:02 on 11/12/2013 by jeffhess
Administrator - Elevation successful
 
========== filefind ==========
 
Searching for "*QuickShare*"
No files found.
 
Searching for "*ScorpionSaver*"
No files found.
 
Searching for "*Scorpion Saver*"
No files found.
 
Searching for "*Adpeak*"
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\_OTL\MovedFiles\12102013_132949\C_Windows\SysNative\AdpeakProxy64.dll –a—- 439296 bytes [11:07 02/12/2013] [15:18 16/10/2013] 78857BF5996E9BC8E82C1B671CBF85E6
 
========== regfind ==========
 
Searching for "QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"URLInfoAbout"="http://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"DisplayName"="QuickShare"
 
Searching for "ScorpionSaver"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Wow6432Node\CLSID\B4AECD8C-1CA3-44B5-9E51-3F6B4DA032AD]
@="ScorpionSaver"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Wow6432Node\CLSID\B4AECD8C-1CA3-44B5-9E51-3F6B4DA032AD\InProcServer32]
@="C:\Program Files(x86)\ScorpionSaver\IECore.dll"
 
Searching for "Scorpion Saver"
[HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
 
Searching for "Adpeak"
No data found.
 
-= EOF =-
Post #40 last edited

I am also clicking "Run as Administrator" for all programs instead of double clicking, I hope that is correct. EDIT: And I still can't find the newest OTL log.

 

The QuickShare looks like it's GONE from my Programs and Features! There is a Desktop shortcup icon remaining called Install Facade. I think it was a game someone tried to download. I did a search and some say this game might have viruses, too. Can we erase this?

 

If I click on Properties I get

 

Target C:\Users\jeffhess\Downloads\cbsidlm-tr1_14-Facade-SEO-10414037.exe

 

Start In C:\Users\jeffhess\AppData\Local\Temp\nsfDDB9.tmp\12

Post #41
Hi jhess23a,
 

I am also clicking "Run as Administrator" for all programs instead of double clicking, I hope that is correct.

That's OK.
 

***


Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Wow6432Node\CLSID\B4AECD8C-1CA3-44B5-9E51-3F6B4DA032AD\InProcServer32] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Wow6432Node\CLSID\B4AECD8C-1CA3-44B5-9E51-3F6B4DA032AD] 


:Commands
[purity]
[Reboot]
    NOTICE: This script was written specifically for this user, for use on that particular machine.
    Running this on another machine may cause damage to your operating system.
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post Fix OTL log.

***


Scan with SystemLook again:
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following code box into the main textfield:
:filefind
*QuickShare*
*ScorpionSaver*
*Scorpion Saver*
*Adpeak*

:regfind
QuickShare
ScorpionSaver
Scorpion Saver
Adpeak
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


***


You can erase C:\Users\jeffhess\Downloads\cbsidlm-tr1_14-Facade-SEO-10414037.exe and that Desktop shortcup icon.
Post #42

I still can't find a Fix OTL log, but I ran the OTL program with the custom scan/run fix. Here is the other log. Thank you!

 

SystemLook 30.07.11 by jpshortstuff
Log created at 06:13 on 13/12/2013 by jeffhess
Administrator - Elevation successful
 
========== filefind ==========
 
Searching for "*QuickShare*"
No files found.
 
Searching for "*ScorpionSaver*"
No files found.
 
Searching for "*Scorpion Saver*"
No files found.
 
Searching for "*Adpeak*"
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxy.ini.vir –a—- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E
C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxyOff.ini.vir –a—- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347
C:\_OTL\MovedFiles\12102013_132949\C_Windows\SysNative\AdpeakProxy64.dll –a—- 439296 bytes [11:07 02/12/2013] [15:18 16/10/2013] 78857BF5996E9BC8E82C1B671CBF85E6
 
========== regfind ==========
 
Searching for "QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"URLInfoAbout"="http://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties]
"DisplayName"="QuickShare"
 
Searching for "ScorpionSaver"
No data found.
 
Searching for "Scorpion Saver"
[HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
 
Searching for "Adpeak"
No data found.
 
-= EOF =-
Post #43
Hi jhess23a,

Please follow all previous instructions regarding security programs.
Disable your antivirus!
Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6\InstallProperties] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-892468639-2113563247-567691228-1001\Products\DC11704F3B065F54585C1FAA04C0B1E6]
In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again. Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: CFScriptB-4.gif]

When finished, it shall produce a log for you. Post that log in your next reply.

Enable your antivirus!
Post #44
OK here goes!
 
ComboFix 13-12-06.01 - jeffhess 12/14/2013   8:15.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3767.2362 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\jeffhess\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((   Files Created from 2013-11-14 to 2013-12-14  )))))))))))))))))))))))))))))))
.
.
2013-12-14 13:23 . 2013-12-14 13:23 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-12-14 12:12 . 2013-12-14 12:12 75888 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D29E21D8-61EA-4508-AEA0-14AFC1388F16}\offreg.dll
2013-12-13 22:00 . 2013-11-08 03:12 10285968 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D29E21D8-61EA-4508-AEA0-14AFC1388F16}\mpengine.dll
2013-12-11 21:48 . 2013-12-11 21:48 ——– d—–w- C:\RegBackup
2013-12-11 21:48 . 2013-12-11 21:48 ——– d—–w- c:\program files (x86)\Tweaking.com
2013-12-11 11:18 . 2013-05-10 04:30 167424 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 11:18 . 2013-05-10 03:48 164864 —-a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 11:18 . 2013-05-10 05:56 12625920 —-a-w- c:\windows\system32\wmploc.DLL
2013-12-11 11:18 . 2013-05-10 04:56 12625408 —-a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-11 11:18 . 2013-05-10 05:56 14631424 —-a-w- c:\windows\system32\wmp.dll
2013-12-10 20:19 . 2013-10-30 02:32 335360 —-a-w- c:\windows\system32\msieftp.dll
2013-12-10 18:29 . 2013-12-10 18:29 ——– d—–w- C:\_OTL
2013-12-09 21:51 . 2013-12-09 21:51 117464 —-a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-12-08 00:51 . 2013-12-08 00:51 ——– d—–w- c:\programdata\Oracle
2013-12-08 00:50 . 2013-12-08 00:50 ——– d—–w- c:\program files (x86)\Common Files\Java
2013-12-08 00:50 . 2013-12-08 00:50 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-05 11:07 . 2013-12-09 22:12 ——– d—–w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-12-04 21:20 . 2013-12-04 21:28 ——– d—–w- C:\AdwCleaner
2013-12-04 21:00 . 2013-12-05 11:06 91352 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-11-27 17:02 . 2013-10-14 23:00 28368 —-a-w- c:\windows\system32\IEUDINIT.EXE
2013-11-27 17:00 . 2013-11-27 17:00 940032 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-27 17:00 . 2013-11-27 17:00 194048 —-a-w- c:\windows\SysWow64\elshyph.dll
2013-11-26 22:31 . 2013-11-26 22:31 ——– d—–w- c:\users\jeffhess\AppData\Local\cache
2013-11-26 22:31 . 2013-11-26 22:46 ——– d—–w- c:\users\jeffhess\AppData\Local\Mobogenie
2013-11-26 22:30 . 2012-07-25 17:03 16896 —-a-w- c:\windows\system32\sasnative64.exe
2013-11-26 22:28 . 2013-12-10 18:29 ——– d—–w- C:\temp
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-11 01:30 . 2012-09-15 00:49 692616 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-11 01:30 . 2011-06-06 02:33 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-14 21:44 . 2011-10-29 12:59 82896128 —-a-w- c:\windows\system32\MRT.exe
2013-11-11 10:50 . 2012-03-15 01:14 267936 ——w- c:\windows\system32\MpSigStub.exe
2013-10-12 02:30 . 2013-11-14 00:16 830464 —-a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-14 00:16 859648 —-a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-14 00:16 324096 —-a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-14 00:16 656896 —-a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-14 00:16 216576 —-a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-05 20:25 . 2013-11-14 00:17 1474048 —-a-w- c:\windows\system32\crypt32.dll
2013-10-05 19:57 . 2013-11-14 00:17 1168384 —-a-w- c:\windows\SysWow64\crypt32.dll
2013-10-04 02:28 . 2013-11-14 00:17 190464 —-a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 02:25 . 2013-11-14 00:17 197120 —-a-w- c:\windows\system32\credui.dll
2013-10-04 02:24 . 2013-11-14 00:17 1930752 —-a-w- c:\windows\system32\authui.dll
2013-10-04 01:58 . 2013-11-14 00:17 152576 —-a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-14 00:17 168960 —-a-w- c:\windows\SysWow64\credui.dll
2013-10-04 01:56 . 2013-11-14 00:17 1796096 —-a-w- c:\windows\SysWow64\authui.dll
2013-10-03 02:23 . 2013-11-14 00:16 404480 —-a-w- c:\windows\system32\gdi32.dll
2013-10-03 02:00 . 2013-11-14 00:16 311808 —-a-w- c:\windows\SysWow64\gdi32.dll
2013-09-28 01:09 . 2013-11-14 00:17 497152 —-a-w- c:\windows\system32\drivers\afd.sys
2013-09-25 02:26 . 2013-11-14 00:16 95680 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2013-09-25 02:26 . 2013-11-14 00:16 154560 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-09-25 02:23 . 2013-11-14 00:16 135680 —-a-w- c:\windows\system32\sspicli.dll
2013-09-25 02:23 . 2013-11-14 00:16 28672 —-a-w- c:\windows\system32\sspisrv.dll
2013-09-25 02:23 . 2013-11-14 00:16 28160 —-a-w- c:\windows\system32\secur32.dll
2013-09-25 02:22 . 2013-11-14 00:16 340992 —-a-w- c:\windows\system32\schannel.dll
2013-09-25 02:21 . 2013-11-14 00:16 307200 —-a-w- c:\windows\system32\ncrypt.dll
2013-09-25 02:21 . 2013-11-14 00:16 1447936 —-a-w- c:\windows\system32\lsasrv.dll
2013-09-25 01:58 . 2013-11-14 00:16 96768 —-a-w- c:\windows\SysWow64\sspicli.dll
2013-09-25 01:57 . 2013-11-14 00:16 22016 —-a-w- c:\windows\SysWow64\secur32.dll
2013-09-25 01:57 . 2013-11-14 00:16 247808 —-a-w- c:\windows\SysWow64\schannel.dll
2013-09-25 01:56 . 2013-11-14 00:16 220160 —-a-w- c:\windows\SysWow64\ncrypt.dll
2013-09-25 01:03 . 2013-11-14 00:16 30720 —-a-w- c:\windows\system32\lsass.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-03-17 17:55 220632 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-03-17 17:55 220632 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-03-17 17:55 220632 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:40 120176 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Monitor"="c:\program files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe" [2013-10-31 106496]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 FlyUsb;FLY Fusion;c:\windows\system32\DRIVERS\FlyUsb.sys;c:\windows\SYSNATIVE\DRIVERS\FlyUsb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-05 22:12 1210320 —-a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-12-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-15 01:30]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-27 12:30]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-27 12:30]
.
2013-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-892468639-2113563247-567691228-1001Core.job
- c:\users\jeffhess\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-17 13:29]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-892468639-2113563247-567691228-1001UA.job
- c:\users\jeffhess\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-17 13:29]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-03-17 17:55 244696 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-03-17 17:55 244696 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-03-17 17:55 244696 —-a-w- c:\users\jeffhess\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:42 137584 —-a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-10-21 206208]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-12-14  08:34:07
ComboFix-quarantined-files.txt  2013-12-14 13:34
ComboFix2.txt  2013-12-06 22:43
.
Pre-Run: 163,416,240,128 bytes free
Post-Run: 163,401,678,848 bytes free
.
- - End Of File - - 22784B78D49B714425C685B57E9E2BAF
Post #45
Hi jhess23a,

Scan with SystemLook again:
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following code box into the main textfield:
:filefind
*QuickShare*
*Scorpion*
*Adpeak*

:regfind
QuickShare
Scorpion
ScorpionSaver
Adpeak
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt



***


Uninstall old versions:
Please go to Start > Control Panel > Add Remove Programs (XP)
Or Start > Control Panel > Programs and Features ( Vista | Windows 7/8 ).

Locate the following programs:
  • all Java versions
  • Adobe Reader 9, 10
Uninstall them all.

Install these programs:
  • Install latest Adobe Reader:
  • Go to http://get.adobe.com/reader/otherversions/
  • Use the drop down menu's to select your operating system
  • Select your language > Select The current version of Adobe Reader for your language
  • Remove the check mark from the box "Install Chrome as standard browser and Google Toolbar for Internet explorer"
  • Click the Download button, and follow the onscreen directions to complete the installation.
  • Install latest Java 7 update:
    JAVA Click this link and click on the Free JAVA Download.
Restart your pc:

How the computer is running now?
Any remaining issues?


***

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI