WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Internet Slow, Weird webpages pop up. [Closed]

Started by sparkey75 , Dec 06 2013 11:25 PM

This topic is locked

18 replies to this topic

#1 sparkey75

Authentic Member

Authentic Member
31 posts

Posted 06 December 2013 - 11:25 PM

My son downloaded some programs and now we have issues I did already ran malwarebytes and combofix. trying to fix it myself Sorry!! I couldn't run combofix after downloading it I had to use another computer and download to a thumb drive and then run it for there.

Thanks for your help!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:18:38 PM, on 12/6/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16736)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\CE\CovenantEyes.exe

C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Browny02\Brother\BrStMonW.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Nuance\PaperPort\pptd40nt.exe

C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe

C:\Program Files\ControlCenter4\BrCtrlCntr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft LifeCam\LifeExp.exe

C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

C:\Program Files\CE\CovenantEyesHelper.exe

C:\Program Files\ControlCenter4\BrCcUxSys.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Users\Administrator\Downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8080

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll

O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\pandasecuritytb\pandasecurityDx.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Panda Security Toolbar - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\pandasecuritytb\pandasecurityDx.dll

O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [NMSVC] C:\Program Files\CE\CovenantEyes.exe

O4 - HKLM\..\Run: [Panda Security URL Filtering] "C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN

O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\Nuance\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\Nuance\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [PPort12reminder] "C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"

O4 - HKLM\..\Run: [PDFHook] C:\Program Files\Nuance\PDF Viewer Plus\pdfpro5hook.exe

O4 - HKLM\..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe

O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [PSUAMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe" /LaunchSysTray

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"

O4 - HKCU\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

O4 - HKUS\S-1-5-18\..\RunOnce: [panda2_0dn] reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [panda2_0dn_XP] reg.exe delete "HKCU\Software\panda2_0dn" /f (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [panda4_0dn] reg.exe delete "HKCU\Software\AppDataLow\Software\panda4_0dn" /f (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [panda4_0dn_XP] reg.exe delete "HKCU\Software\panda4_0dn" /f (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [panda2_0dn] reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\nmnsp.dll

O10 - Unknown file in Winsock LSP: cespy.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Auth Service - Unknown owner - C:\Windows\system32\authServer.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files\Browny02\BrYNSvc.exe

O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: GorillaPrice - Unknown owner - C:\Program Files\GorillaPrice\GorillaPrice.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Panda Cloud Antivirus Service (NanoServiceMain) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

O23 - Service: PDFProFiltSrvPP - Nuance Communications, Inc. - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe

O23 - Service: Panda Product Service (PSUAService) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe

O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: WatGorp - Unknown owner - C:\ProgramData\GorillaPrice\WatGorp.exe

End of file - 9732 bytes

DDS (Ver_11-03-05.01) - NTFSx86

Run by Administrator at 23:05:54.25 on Fri 12/06/2013

Internet Explorer: 9.10.9200.16736 BrowserJavaVersion: 10.25.2

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1526.252 [GMT -6:00]

AV: Panda Cloud Antivirus *Enabled/Updated* {3456760B-FDAA-FFFD-06C2-7BB528D2066C}

SP: Panda Cloud Antivirus *Enabled/Updated* {8F3797EF-DB90-F073-3C72-40C753554CD1}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Cloud Antivirus Firewall *Disabled* {0C6DF72E-B7C5-FEA5-2D9D-D280D6014117}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\authServer.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe

C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe

C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\ProgramData\GorillaPrice\WatGorp.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Browny02\BrYNSvc.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\CE\CovenantEyes.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\Browny02\Brother\BrStMonW.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Nuance\PaperPort\pptd40nt.exe

C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe

C:\Program Files\ControlCenter4\BrCtrlCntr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft LifeCam\LifeExp.exe

C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

C:\Program Files\CE\CovenantEyesHelper.exe

C:\Program Files\ControlCenter4\BrCcUxSys.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\GorillaPrice\GorillaPrice.exe

C:\Windows\notepad.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Users\Administrator\Downloads\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = *.local

uInternet Settings,ProxyServer = http=127.0.0.1:8080

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll

BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Panda Security Toolbar: {b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4} - c:\program files\pandasecuritytb\pandasecurityDx.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: Panda Security Toolbar: {b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4} - c:\program files\pandasecuritytb\pandasecurityDx.dll

uRun: [ISUSPM] c:\programdata\flexnet\connect\11\ISUSPM.exe -scheduler

mRun: [IgfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [NMSVC] c:\program files\ce\CovenantEyes.exe

mRun: [Panda Security URL Filtering] "c:\programdata\panda security url filtering\Panda_URL_Filtering.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN

mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [BrStsMon00] c:\program files\browny02\brother\BrStMonW.exe /AUTORUN

mRun: [IndexSearch] "c:\program files\nuance\paperport\IndexSearch.exe"

mRun: [PaperPort PTD] "c:\program files\nuance\paperport\pptd40nt.exe"

mRun: [PPort12reminder] "c:\program files\nuance\paperport\ereg\ereg.exe" -r "c:\programdata\scansoft\paperport\12\config\ereg\Ereg.ini"

mRun: [PDFHook] c:\program files\nuance\pdf viewer plus\pdfpro5hook.exe

mRun: [PDF5 Registry Controller] c:\program files\nuance\pdf viewer plus\RegistryController.exe

mRun: [ControlCenter4] c:\program files\controlcenter4\BrCcBoot.exe /autorun

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [PSUAMain] "c:\program files\panda security\panda cloud antivirus\PSUAMain.exe" /LaunchSysTray

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"

dRunOnce: [panda2_0dn] reg.exe delete "HKCU\Software\AppDataLow\Software\panda2_0dn" /f

dRunOnce: [panda2_0dn_XP] reg.exe delete "HKCU\Software\panda2_0dn" /f

dRunOnce: [panda4_0dn] reg.exe delete "HKCU\Software\AppDataLow\Software\panda4_0dn" /f

dRunOnce: [panda4_0dn_XP] reg.exe delete "HKCU\Software\panda4_0dn" /f

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

LSP: CESpy.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\progra~1\google\google~1\googledesktopnetwork3.dll c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\31.0.1650.63\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

============= SERVICES / DRIVERS ===============

R1 NNSALPC;NNSALPC;c:\windows\system32\drivers\NNSAlpc.sys [2013-5-29 84200]

R1 NNSHTTP;NNSHTTP;c:\windows\system32\drivers\NNSHttp.sys [2013-5-29 126184]

R1 NNSHTTPS;NNSHTTPS;c:\windows\system32\drivers\NNSHttps.sys [2013-5-29 107752]

R1 NNSIDS;NNSIDS;c:\windows\system32\drivers\NNSIds.sys [2013-5-29 124648]

R1 NNSPICC;NNSPICC;c:\windows\system32\drivers\NNSpicc.sys [2013-5-29 95464]

R1 NNSPOP3;NNSPOP3;c:\windows\system32\drivers\NNSPop3.sys [2013-5-29 106344]

R1 NNSPROT;NNSPROT;c:\windows\system32\drivers\NNSProt.sys [2013-5-29 287336]

R1 NNSPRV;NNSPRV;c:\windows\system32\drivers\NNSPrv.sys [2013-5-29 161384]

R1 NNSSMTP;NNSSMTP;c:\windows\system32\drivers\NNSSmtp.sys [2013-5-29 108904]

R1 NNSSTRM;NNSSTRM;c:\windows\system32\drivers\NNSStrm.sys [2013-5-29 230376]

R1 NNSTLSC;NNSTLSC;c:\windows\system32\drivers\NNStlsc.sys [2013-5-29 93928]

R1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [2013-5-28 175848]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2013-5-10 65640]

R2 Auth Service;Auth Service;c:\windows\system32\authServer.exe [2011-5-26 1633280]

R2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\garmin\core update service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-27 185688]

R2 GorillaPrice;GorillaPrice;c:\program files\gorillaprice\gorillaprice.exe -service --> c:\program files\gorillaprice\GorillaPrice.exe -service [?]

R2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\panda security\panda cloud antivirus\PSANHost.exe [2013-5-28 140768]

R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\nuance\paperport\PDFProFiltSrvPP.exe [2010-3-9 144672]

R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2013-5-28 145128]

R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2013-5-28 105704]

R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2013-5-28 114920]

R2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2013-5-29 127720]

R2 PSUAService;Panda Product Service;c:\program files\panda security\panda cloud antivirus\PSUAService.exe [2013-5-28 37344]

R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2013-10-9 3275136]

R2 WatGorp;WatGorp;c:\programdata\gorillaprice\watgorp.exe -service --> c:\programdata\gorillaprice\WatGorp.exe -service [?]

R3 BrYNSvc;BrYNSvc;c:\program files\browny02\BrYNSvc.exe [2011-11-9 245760]

R3 PSKMAD;PSKMAD;c:\windows\system32\drivers\PSKMAD.sys [2013-12-5 47632]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-3-1 139776]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-10-22 116648]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-21 162408]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-8-23 257416]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2011-11-9 71424]

S3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSib.sys [2011-11-9 11520]

S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [2006-3-10 39424]

S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-9-12 30192]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-10-22 116648]

S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [2010-5-20 30576]

S3 PSINReg;PSINReg;c:\windows\system32\drivers\PSINReg.sys [2013-5-28 97512]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-2 52224]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-5-26 1343400]

S4 NNSPIHSW;NNSPIHSW;c:\windows\system32\drivers\NNSPihsw.sys [2013-5-29 61672]

=============== Created Last 30 ================

2013-12-07 01:11:43 7772552 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{13a602ef-03da-44f2-8c1d-4b66a7c4d11f}\mpengine.dll

2013-12-05 16:32:28 -------- d-sh--w- C:\$RECYCLE.BIN

2013-12-05 16:32:22 -------- d-----w- c:\users\admini~1\appdata\local\temp

2013-12-05 15:55:15 47632 ----a-w- c:\windows\system32\drivers\PSKMAD.sys

2013-11-25 01:13:11 -------- d-----w- c:\program files\CAM Development

2013-11-18 22:50:04 -------- d-----w- c:\users\admini~1\appdata\roaming\Open Download Manager

2013-11-18 20:44:10 -------- d-----w- c:\users\admini~1\appdata\local\Programs

2013-11-18 20:36:34 -------- d-----w- c:\users\admini~1\appdata\roaming\Malwarebytes

2013-11-18 20:35:14 -------- d-----w- c:\users\admini~1\appdata\roaming\SearchProtect

2013-11-17 19:45:59 3092480 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\asapsdk.dll

2013-11-15 19:23:54 -------- d-----w- c:\program files\DivX

2013-11-15 19:22:24 -------- d-----w- c:\program files\DSP-worx

2013-11-15 19:22:17 -------- d-----w- c:\progra~2\DivX

2013-11-15 19:21:46 -------- d-----w- c:\program files\OpenSource Flash Video Splitter

2013-11-14 19:41:21 -------- d-----w- c:\program files\Mysearchdial

2013-11-13 10:33:13 369848 ----a-w- c:\windows\system32\drivers\cng.sys

2013-11-13 10:33:13 247808 ----a-w- c:\windows\system32\schannel.dll

2013-11-13 10:33:13 136640 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2013-11-13 10:33:12 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2013-11-13 10:33:12 1038848 ----a-w- c:\windows\system32\lsasrv.dll

2013-11-13 10:33:11 99840 ----a-w- c:\windows\system32\sspicli.dll

2013-11-13 10:33:11 220160 ----a-w- c:\windows\system32\ncrypt.dll

2013-11-13 10:33:11 22016 ----a-w- c:\windows\system32\lsass.exe

2013-11-13 10:33:10 22016 ----a-w- c:\windows\system32\secur32.dll

2013-11-13 10:33:09 15872 ----a-w- c:\windows\system32\sspisrv.dll

2013-11-13 10:32:44 305152 ----a-w- c:\windows\system32\gdi32.dll

2013-11-13 10:32:40 679424 ----a-w- c:\windows\system32\IKEEXT.DLL

2013-11-13 10:32:38 216576 ----a-w- c:\windows\system32\FWPUCLNT.DLL

2013-11-13 10:32:37 656896 ----a-w- c:\windows\system32\nshwfp.dll

2013-11-13 10:32:28 1168384 ----a-w- c:\windows\system32\crypt32.dll

==================== Find3M ====================

2013-11-11 11:50:18 230048 ------w- c:\windows\system32\MpSigStub.exe

2013-11-04 08:23:13 183776 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psenlc.dll

2013-10-22 09:25:20 83936 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psenutil.dll

2013-10-22 09:25:19 397280 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANModAV.dll

2013-10-22 09:25:17 346080 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANUpgSI.dll

2013-10-20 06:24:42 3188192 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNPnlConfig.dll

2013-10-19 05:21:41 919520 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSCCGUIUtils.dll

2013-10-18 18:53:31 135136 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psenfilter.dll

2013-10-18 18:53:30 307168 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANModCfg.dll

2013-10-17 19:31:31 167904 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSINEnAg.dll

2013-10-17 19:31:30 145640 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\vista\PSINAflt.sys

2013-10-17 19:31:29 169192 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\vista\PSINAflt.sys

2013-10-17 19:31:28 145640 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\w7\PSINAflt.sys

2013-10-17 19:31:26 169192 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\w7\PSINAflt.sys

2013-10-17 19:31:25 145640 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\drivers\psinaflt\x86_w8\PSINAflt.sys

2013-10-17 19:31:24 169192 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\drivers\psinaflt\x64_w8\PSINAflt.sys

2013-10-17 19:31:22 145640 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\xp\PSINAflt.sys

2013-10-17 15:32:44 901928 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\Setup.exe

2013-10-17 15:31:58 355624 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSINanoRun.exe

2013-10-17 15:30:46 241960 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\Launcher.exe

2013-10-15 11:34:22 111072 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psenlog.dll

2013-10-15 11:34:20 331744 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANCU.exe

2013-10-14 16:28:20 1461728 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSAUI.dll

2013-10-14 16:28:19 370656 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSAEng.dll

2013-10-12 07:03:50 1767936 ----a-w- c:\windows\system32\wininet.dll

2013-10-12 07:02:33 2877952 ----a-w- c:\windows\system32\jscript9.dll

2013-10-12 07:02:29 61440 ----a-w- c:\windows\system32\iesetup.dll

2013-10-12 07:02:29 109056 ----a-w- c:\windows\system32\iesysprep.dll

2013-10-12 06:08:58 2706432 ----a-w- c:\windows\system32\mshtml.tlb

2013-10-12 05:15:39 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2013-10-11 09:47:23 97896 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\xp\PSINReg.sys

2013-10-11 09:45:56 137960 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\vista\PSINProt.sys

2013-10-11 09:45:56 124648 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\vista\PSINProc.sys

2013-10-11 09:45:55 206056 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\vista\PSINKNC.sys

2013-10-11 09:45:55 122600 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system64\drivers\vista\PSINFile.sys

2013-10-11 09:45:49 175848 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\w7\PSINKNC.sys

2013-10-11 09:45:49 105704 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\w7\PSINFile.sys

2013-10-11 09:45:32 280032 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSINPrSg.dll

2013-10-11 09:45:31 138208 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSINEvAg.dll

2013-10-11 09:45:30 163296 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSINApAg.dll

2013-10-11 09:45:28 127720 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\vista\PSINProt.sys

2013-10-11 09:45:28 114920 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\vista\PSINProc.sys

2013-10-11 09:45:27 175848 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\vista\PSINKNC.sys

2013-10-11 09:45:27 105704 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\system32\drivers\vista\PSINFile.sys

2013-10-10 15:38:08 227624 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\SMCLpav.exe

2013-10-10 15:38:07 364840 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\SMCLPav.dll

2013-10-10 15:38:06 229160 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\PGUse.exe

2013-10-10 15:38:05 479016 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\PAVSMCL.dll

2013-10-10 15:38:05 150312 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\PAV2WSC.dll

2013-10-10 15:38:04 135464 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\dg\DGNano.dll

2013-10-10 08:26:54 133600 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\pkndtr.dll

2013-10-08 21:59:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-10-08 21:59:49 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-10-08 15:55:44 105440 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNCSysInfo.dll

2013-10-07 13:36:59 2207712 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNReports.dll

2013-10-07 13:36:58 983520 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNMsg.dll

2013-10-07 12:48:25 238560 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNUtils.dll

2013-10-07 12:48:24 2298848 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNSuspects.dll

2013-10-07 12:48:23 2551264 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNScan.dll

2013-10-07 12:48:05 2238432 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNResources.dll

2013-10-07 12:48:04 2595808 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNProcMon.dll

2013-10-07 12:48:04 115168 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNProcMonMng.dll

2013-10-07 12:48:02 512992 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNMain.exe

2013-10-07 12:48:01 2404320 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNFwConfig.dll

2013-10-07 12:48:00 98784 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNConfigStore.dll

2013-10-07 12:48:00 520672 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUASBoot.exe

2013-10-07 12:47:59 35808 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANLang.dll

2013-10-07 11:06:12 101344 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUAResourcesEx.dll

2013-10-07 10:54:59 202208 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANModProcMon.dll

2013-10-07 10:37:38 90592 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\x64\PSNCSysAction.exe

2013-10-07 10:37:34 24544 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\x86\PSNCSysAction.exe

2013-10-07 10:37:21 69600 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNXml.dll

2013-10-07 10:37:21 56288 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNTypeReflection.dll

2013-10-07 10:37:20 64992 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNMuid.dll

2013-10-07 10:37:20 55776 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNCUpdMgr.dll

2013-10-07 10:37:20 47584 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNEvts.dll

2013-10-07 10:37:20 42976 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNReg.dll

2013-10-07 10:35:57 365024 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANUpgMgr.dll

2013-10-07 10:34:59 227808 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Prl.dll

2013-10-07 10:34:59 197600 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Quarantine.dll

2013-10-07 10:34:58 225248 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Notification.dll

2013-10-07 10:34:58 184288 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.License.dll

2013-10-07 10:34:57 234976 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.dll

2013-10-07 10:34:56 305632 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Configuration.dll

2013-10-07 10:34:56 210400 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Communication.dll

2013-10-07 10:34:55 221664 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Analysis.dll

2013-10-07 10:34:55 131552 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\NdkApi.Common.dll

2013-10-03 16:07:23 3845088 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUNConsole.dll

2013-10-03 16:07:21 2502112 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSUAConfig.dll

2013-10-03 15:15:59 64992 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNFiles.dll

2013-10-03 11:43:22 145888 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANMSrvc.dll

2013-10-03 11:43:03 164832 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANModCtrlCfg.dll

2013-10-03 06:15:33 35296 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSNWSC.dll

2013-10-03 06:15:14 92128 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psensfl.dll

2013-10-03 06:15:13 88544 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSENQMem.dll

2013-10-03 06:15:12 102368 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\psenplgb.dll

2013-10-03 06:14:58 114656 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSENMgrb.dll

2013-10-03 06:14:57 152544 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSENIExAg.dll

2013-10-03 06:14:41 125920 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANURLCounters.dll

2013-10-03 06:14:40 46560 ----a-w- c:\windows\system32\grouppolicy\machine\scripts\shutdown\pan5963.tmp\program files\panda security\panda cloud antivirus\PSANStatsSend.dll

============= FINISH: 23:07:24.21 ===============

Advertisements

Register to Remove

#2 Robybel

SuperMember

Visiting Fellow
1,536 posts

Posted 08 December 2013 - 01:04 AM

Hi and Welcome!! Sparkey75

My name is Robybel.

I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Having said that....Let's get going!!

====================================

Security Check

Download Security Check by screen317 from here or here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Next

AdwCleaner

Please download AdwCleaner by Xplode and save to your Desktop.
Double click on AdwCleaner.exe to run the tool
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Next

Junkware Removal Tool

Please download Junkware Removal Tool to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next

RogueKiller
Download RogueKiller and save it to your desktop.
Quit all other programs
Start RogueKiller.exe
Wait until the Prescan has finished ...
Click on Scan
Wait for the end of the scan
A report will be created on your desktop.
Click on the Delete button
Next click on the ShortcutsFix
another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

On your next reply please post :
checkup.txt
AdwCleaner[R0].txt
JRT.txt
All RKreport.txt
Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

- Proud Graduate of WTT Classroom -

Member of UNITE

Please Only Copy And Paste Reports Into Topic - Do Not Attach

If you are satisfied with the help that you have received, please consider a donation

#3 sparkey75

Authentic Member

Authentic Member
31 posts

Posted 08 December 2013 - 09:44 PM

I tried downloading security check and adware but my computer gave me an error message saying the files were corrupt. So I had to use another computer and downloaded on a thumb drive to then run on this computer. Here are the reports:

Results of screen317's Security Check version 0.99.77

Windows 7 Service Pack 1 x86 (UAC is enabled)

Internet Explorer 10 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Panda Cloud Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

CCleaner

Toolbar Cleaner 1.0

JavaFX 2.1.1

Java™ 6 Update 31

Java 7 Update 25

Java version out of Date!

Adobe Flash Player 11.9.900.117

Adobe Reader 10.1.8 Adobe Reader out of Date!

Google Chrome 31.0.1650.57

Google Chrome 31.0.1650.63

````````Process Check: objlist.exe by Laurent````````

Panda Security Panda Cloud Antivirus PSANHost.exe

Panda Security Panda Cloud Antivirus PSUAService.exe

Panda Security Panda Cloud Antivirus PSUAMain.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

# AdwCleaner v3.014 - Report created 08/12/2013 at 20:20:27

# Updated 01/12/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)

# Username : Administrator - DAN-LAPTOP

# Running from : C:\Users\Administrator\Desktop\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\END

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage-journal

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage

File Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal

File Found : C:\Users\Admin\AppData\Local\mysearchdial-speeddial.crx

Folder Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\giekjokemioblbkdkclpehonimdjgiee

Folder Found : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Folder Found : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\giekjokemioblbkdkclpehonimdjgiee

Folder Found C:\Program Files\Conduit

Folder Found C:\Program Files\Mysearchdial

Folder Found C:\Program Files\Searchprotect

Folder Found C:\Program Files\Toolbar Cleaner

Folder Found C:\ProgramData\blekko toolbars

Folder Found C:\ProgramData\boost_interprocess

Folder Found C:\ProgramData\Conduit

Folder Found C:\Users\Admin\AppData\Local\Conduit

Folder Found C:\Users\Admin\AppData\Local\NativeMessaging

Folder Found C:\Users\Admin\AppData\Local\WhiteListing

Folder Found C:\Users\Admin\AppData\LocalLow\Conduit

Folder Found C:\Users\Admin\AppData\LocalLow\PriceGong

Folder Found C:\Users\Admin\AppData\LocalLow\SweetPacks_A7

Folder Found C:\Users\Admin\AppData\Roaming\digitalsite

Folder Found C:\Users\Admin\AppData\Roaming\Searchprotect

Folder Found C:\Users\Administrator\AppData\Roaming\Searchprotect

Folder Found C:\Users\Dan\AppData\LocalLow\SweetPacks_A7

Folder Found C:\Users\Dan\AppData\Roaming\Searchprotect

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\FLEXnet

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKCU\Software\SearchProtect

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}

Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Found : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Key Found : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3314936

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\giekjokemioblbkdkclpehonimdjgiee

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29FEADFD-F050-457D-8AFD-7FE9198AEA69}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B34D6DC-FAEB-4E0C-B9A6-6828AE8D4482}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\BackgroundContainer Startup Task

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BF062B7C-3A0C-4B82-BBC0-A6718BB2F894}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B0C0123D-E2A6-451E-A3BD-A4B9C7326B53}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

Key Found : HKLM\Software\SearchProtect

Key Found : HKLM\Software\SweetPacks_A7

Key Found : HKLM\Software\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16736

Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://start.mysearchdial.com/?f=2&a=irmsd103&cd=2XzuyEtN2Y1L1QzutDtDtC0BtAzztC0DtBzz0D0Ezz0AzyyCtN0D0Tzu0SyCzzyEtN1L2XzutBtFtBtFtCtAtFtCtAtAzztN1L1CzutCtD1B1P1R&cr=942012373&ir=

-\\ Google Chrome v31.0.1650.63

[ File : C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ File : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage

Found : icon_url

Found : search_url

Found : keyword

Found : urls_to_restore_on_startup

[ File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [7033 octets] - [08/12/2013 20:20:27]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [7093 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Home Premium x86

Ran by Administrator on Sun 12/08/2013 at 20:55:45.18

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

Successfully stopped: [Service] gorillaprice

Successfully deleted: [Service] gorillaprice

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escort.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortapp.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escorteng.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortlbr.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\esrv.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\iehelperv2.5.0.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\searchprotect

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3314936

~~~ Files

Successfully deleted: [File] "C:\end"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\blekko toolbars"

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Folder] "C:\ProgramData\conduit"

Successfully deleted: [Folder] "C:\Users\Administrator\AppData\Roaming\searchprotect"

Successfully deleted: [Folder] "C:\Program Files\conduit"

Successfully deleted: [Folder] "C:\Program Files\mysearchdial"

Successfully deleted: [Folder] "C:\Program Files\searchprotect"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 12/08/2013 at 21:00:47.30

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RogueKiller V8.7.11 [Dec 3 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.co...es/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Administrator [Admin rights]

Mode : Scan -- Date : 12/08/2013 21:08:21

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[SUSP PATH] WatGorp.exe -- C:\ProgramData\GorillaPrice\WatGorp.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 7 ¤¤¤

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=127.0.0.1:8080 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND

[PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND

[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD3200BEVT-00A0RT0 ATA Device +++++

--- User ---

[MBR] bab8115d1d11ed1846639456a1252181

[BSP] b63f261ea300128fdd9f5bbb140a7bbf : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 303744 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_12082013_210821.txt >>

RogueKiller V8.7.11 [Dec 3 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.co...es/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Administrator [Admin rights]

Mode : Remove -- Date : 12/08/2013 21:11:58

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[SUSP PATH] WatGorp.exe -- C:\ProgramData\GorillaPrice\WatGorp.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 5 ¤¤¤

[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED

[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD3200BEVT-00A0RT0 ATA Device +++++

--- User ---

[MBR] bab8115d1d11ed1846639456a1252181

[BSP] b63f261ea300128fdd9f5bbb140a7bbf : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 303744 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_D_12082013_211158.txt >>

RKreport[0]_S_12082013_210821.txt

RogueKiller V8.7.11 [Dec 3 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.co...es/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Administrator [Admin rights]

Mode : Shortcuts HJfix -- Date : 12/08/2013 21:12:12

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[SUSP PATH] WatGorp.exe -- C:\ProgramData\GorillaPrice\WatGorp.exe [-] -> KILLED [TermProc]

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ File attributes restored: ¤¤¤

Desktop: Success 0 / Fail 0

Quick launch: Success 0 / Fail 0

Programs: Success 0 / Fail 0

Start menu: Success 0 / Fail 0

User folder: Success 6 / Fail 0

My documents: Success 0 / Fail 0

My favorites: Success 0 / Fail 0

My pictures: Success 0 / Fail 0

My music: Success 0 / Fail 0

My videos: Success 0 / Fail 0

Local drives: Success 2 / Fail 0

Backup: [NOT FOUND]

Drives:

[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored

[D:] \Device\CdRom0 -- 0x5 --> Skipped

¤¤¤ Infection : ¤¤¤

Finished : << RKreport[0]_SC_12082013_211212.txt >>

RKreport[0]_D_12082013_211158.txt;RKreport[0]_S_12082013_210821.txt

Thanks for your time!! Looks like it got a few things.

Edited by sparkey75, 08 December 2013 - 10:02 PM.

#4 sparkey75

Authentic Member

Authentic Member
31 posts

Posted 08 December 2013 - 09:48 PM

Opened up IE and this webpage opened up http://jumpingforfit...es/LastWeek.htm

Message From Bing

Several months ago you were given notice that your privacy settings needed to be updated regarding ads being displayed to you. Please update your preferences now for displaying ads for your Bing account. Failure to do so will result in immediate account termination.

Simply click on the ad below and select either “I want to opt-out from seeing ads” or “It’s ok to continue showing me ads.”

Laura Thompson

Bing Privacy Team

Bing, Inc.

Edited by sparkey75, 08 December 2013 - 09:56 PM.

#5 Robybel

SuperMember

Visiting Fellow
1,536 posts

Posted 09 December 2013 - 12:59 PM

Hi Sparkey

FRST

Download the 32 bit or 64 bit version for your system of FRST and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

#6 sparkey75

Authentic Member

Authentic Member
31 posts

Posted 09 December 2013 - 10:13 PM

Here you go!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-12-2013

Ran by SYSTEM on MININT-47PO2T5 on 09-12-2013 22:05:44

Running from F:\

Windows 7 Home Premium (X86) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1316136 2008-06-20] (Synaptics, Inc.)

HKLM\...\Run: [NMSVC] - C:\Program Files\CE\CovenantEyes.exe [2429440 2012-10-22] ()

HKLM\...\Run: [Panda Security URL Filtering] - C:\ProgramData\Panda Security URL Filtering\Panda_URL_Filtering.exe [235072 2013-04-11] (Visicom Media Inc.)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)

HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\BrCtrCen.exe [114688 2008-12-24] (Brother Industries, Ltd.)

HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-09-12] (Google)

HKLM\...\Run: [BrStsMon00] - C:\Program Files\Browny02\Brother\BrStMonW.exe [2629632 2010-12-23] (Brother Industries, Ltd.)

HKLM\...\Run: [IndexSearch] - C:\Program Files\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-08] (Nuance Communications, Inc.)

HKLM\...\Run: [PaperPort PTD] - C:\Program Files\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-08] (Nuance Communications, Inc.)

HKLM\...\Run: [PPort12reminder] - C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)

HKLM\...\Run: [PDFHook] - C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)

HKLM\...\Run: [PDF5 Registry Controller] - C:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)

HKLM\...\Run: [ControlCenter4] - C:\Program Files\ControlCenter4\BrCcBoot.exe [139264 2011-03-03] (Brother Industries, Ltd.)

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)

HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)

HKLM\...\Run: [PSUAMain] - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe [32736 2013-05-28] (Panda Security, S.L.)

HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)

HKLM\...\Run: [LifeCam] - C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)

HKU\Admin\...\Run: [Google Update] - C:\Users\Dan\AppData\Local\Google\Update\GoogleUpdate.exe [ 2011-05-25] (Google Inc.)

HKU\Admin\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [ 2009-05-05] (Acresso Corporation)

HKU\Admin\...\Run: [SearchProtect] - C:\Users\Admin\AppData\Roaming\SearchProtect\bin\cltmng.exe

HKU\Admin\...\Run: [BackgroundContainer] - "C:\Windows\system32\Rundll32.exe" "C:\Users\Admin\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun <===== ATTENTION

HKU\Admin\...\Run: [Weather] - C:\Program Files\AWS\WeatherBug\Weather.exe [ 2012-11-20] (AWS Convergence Technologies, Inc.)

HKU\Admin\...\Run: [Open Download Manager] - C:\Program Files\OpenDownloaderManager\odm.exe -autorun

HKU\Admin\...\RunOnce: [Del3518368] - cmd.exe /Q /D /c del "C:\Users\Admin\AppData\Local\Temp\0.del"

HKU\Admin\...\RunOnce: [Del3607928] - cmd.exe /Q /D /c del "C:\Users\Admin\AppData\Local\Temp\0.del"

HKU\Administrator\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [ 2009-05-05] (Acresso Corporation)

HKU\Dan\...\Run: [Google Update] - C:\Users\Dan\AppData\Local\Google\Update\GoogleUpdate.exe [ 2011-05-25] (Google Inc.)

HKU\Dan\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [ 2009-05-05] (Acresso Corporation)

HKU\Dan\...\Run: [MusicManager] - C:\Users\Dan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [ 2013-11-11] (Google Inc.)

HKU\Dan\...\Run: [GarminExpressTrayApp] - C:\Program Files\Garmin\Express Tray\ExpressTray.exe [ 2013-03-27] (Garmin Ltd or its subsidiaries)

HKU\Dan\...\Run: [SearchProtect] - C:\Users\Dan\AppData\Roaming\SearchProtect\bin\cltmng.exe

AppInit_DLLs: C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [ 2011-09-12] (Google)

========================== Services (Whitelisted) =================

S2 Auth Service; C:\Windows\system32\authServer.exe [1633280 2012-10-22] ()

S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)

S2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)

S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-09-12] (Google)

S2 GorillaPrice; C:\Program Files\GorillaPrice\GorillaPrice.exe [631808 2013-11-05] ()

S2 NanoServiceMain; C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [140768 2013-05-28] (Panda Security, S.L.)

S2 PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-08] (Nuance Communications, Inc.)

S2 PSUAService; C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe [37344 2013-05-28] (Panda Security, S.L.)

S2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3275136 2013-10-09] (Skype Technologies S.A.)

S2 WatGorp; C:\ProgramData\GorillaPrice\WatGorp.exe [70144 2013-11-05] ()

==================== Drivers (Whitelisted) ====================

S3 FANTOM; C:\Windows\System32\DRIVERS\fantom.sys [39424 2006-03-10] (National Instruments Corporation)

S1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [84200 2013-05-29] (Panda Security, S.L.)

S1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [126184 2013-05-29] (Panda Security, S.L.)

S1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [107752 2013-05-29] (Panda Security, S.L.)

S1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [124648 2013-05-29] (Panda Security, S.L.)

S1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95464 2013-05-29] (Panda Security, S.L.)

S4 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [61672 2013-05-29] (Panda Security, S.L.)

S1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [106344 2013-05-29] (Panda Security, S.L.)

S1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [287336 2013-05-29] (Panda Security, S.L.)

S1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [161384 2013-05-29] (Panda Security, S.L.)

S1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [108904 2013-05-29] (Panda Security, S.L.)

S1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [230376 2013-05-29] (Panda Security, S.L.)

S1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [93928 2013-05-29] (Panda Security, S.L.)

S2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [145128 2013-05-28] (Panda Security, S.L.)

S2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [105704 2013-05-28] (Panda Security, S.L.)

S1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [175848 2013-05-28] (Panda Security, S.L.)

S2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [114920 2013-05-28] (Panda Security, S.L.)

S2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [127720 2013-05-29] (Panda Security, S.L.)

S3 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [97512 2013-05-28] (Panda Security, S.L.)

S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)

S5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

S3 catchme; \??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-12-09 22:05 - 2013-12-09 22:05 - 00000000 ____D C:\FRST

2013-12-09 19:34 - 2013-12-09 19:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\CrashDumps

2013-12-08 19:12 - 2013-12-08 19:12 - 00001303 _____ C:\Users\Administrator\Desktop\RKreport[0]_SC_12082013_211212.txt

2013-12-08 19:11 - 2013-12-08 19:11 - 00001899 _____ C:\Users\Administrator\Desktop\RKreport[0]_D_12082013_211158.txt

2013-12-08 19:08 - 2013-12-08 19:08 - 00002067 _____ C:\Users\Administrator\Desktop\RKreport[0]_S_12082013_210821.txt

2013-12-08 19:04 - 2013-12-08 19:13 - 00000000 ____D C:\Users\Administrator\Desktop\RK_Quarantine

2013-12-08 19:04 - 2013-12-08 18:59 - 03580416 _____ C:\Users\Administrator\Desktop\RogueKiller.exe

2013-12-08 19:00 - 2013-12-08 19:00 - 00003248 _____ C:\Users\Administrator\Desktop\JRT.txt

2013-12-08 18:57 - 2013-12-08 18:57 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-12-08 18:55 - 2013-12-08 18:55 - 00000000 ____D C:\Windows\ERUNT

2013-12-08 18:53 - 2013-12-08 18:08 - 01034531 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe

2013-12-08 18:52 - 2013-12-08 18:52 - 00007173 _____ C:\Users\Administrator\Desktop\AdwCleaner[R0].txt

2013-12-08 18:20 - 2013-12-08 18:21 - 00000000 ____D C:\AdwCleaner

2013-12-08 18:19 - 2013-12-08 18:07 - 01110034 _____ C:\Users\Administrator\Desktop\AdwCleaner.exe

2013-12-08 18:15 - 2013-12-08 18:15 - 00001252 _____ C:\Users\Administrator\Desktop\checkup.txt

2013-12-08 18:05 - 2013-12-08 18:03 - 00891200 _____ C:\Users\Administrator\Desktop\SecurityCheck.exe

2013-12-08 17:51 - 2013-12-08 17:51 - 00332462 _____ C:\Users\Administrator\Downloads\SecurityCheck (2).exe

2013-12-08 17:50 - 2013-12-08 17:50 - 00284930 _____ C:\Users\Administrator\Downloads\SecurityCheck (1).exe

2013-12-08 17:49 - 2013-12-08 17:50 - 00199652 _____ C:\Users\Administrator\Downloads\SecurityCheck.exe

2013-12-07 06:51 - 2013-12-08 18:05 - 00000906 _____ C:\Windows\setupact.log

2013-12-07 06:51 - 2013-12-07 06:51 - 00000000 _____ C:\Windows\setuperr.log

2013-12-06 21:11 - 2013-12-06 21:11 - 00009651 _____ C:\Users\Administrator\Desktop\Attach.txt

2013-12-06 21:09 - 2013-12-06 21:09 - 00031348 _____ C:\Users\Administrator\Desktop\DDS.txt

2013-12-06 21:04 - 2013-12-06 21:05 - 00625664 _____ C:\Users\Administrator\Downloads\dds.scr

2013-12-06 21:03 - 2013-12-06 21:03 - 00484370 _____ C:\Users\Administrator\Desktop\OTL.Txt

2013-12-06 21:03 - 2013-12-06 21:03 - 00058926 _____ C:\Users\Administrator\Desktop\Extras.Txt

2013-12-06 21:00 - 2013-12-06 21:00 - 00058926 _____ C:\Users\Administrator\Downloads\Extras.Txt

2013-12-06 20:56 - 2013-12-06 20:56 - 00484370 _____ C:\Users\Administrator\Downloads\OTL.Txt

2013-12-06 20:20 - 2013-12-06 20:20 - 00602112 _____ (OldTimer Tools) C:\Users\Administrator\Downloads\OTL (1).exe

2013-12-06 20:20 - 2013-12-06 20:20 - 00009733 _____ C:\Users\Administrator\Desktop\hijackthis.log

2013-12-06 20:18 - 2013-12-06 20:18 - 00009733 _____ C:\Users\Administrator\Downloads\hijackthis.log

2013-12-06 20:17 - 2013-12-06 20:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\Administrator\Downloads\HiJackThis.exe

2013-12-06 20:17 - 2013-12-06 20:17 - 00041903 _____ C:\Users\Administrator\Desktop\index (1).htm

2013-12-06 20:16 - 2013-12-06 20:16 - 00065036 _____ C:\Users\Administrator\Desktop\index.htm

2013-12-06 20:14 - 2013-12-06 20:14 - 00547939 _____ C:\Users\Administrator\Downloads\OTL.exe

2013-12-06 17:17 - 2013-12-06 17:17 - 00496746 _____ (Piriform Ltd) C:\Users\Administrator\Downloads\dfsetup216.exe

2013-12-06 17:16 - 2013-12-06 17:16 - 00050106 _____ C:\Users\Administrator\Documents\cc_20131206_191605.reg

2013-12-06 17:03 - 2013-12-06 17:03 - 00069662 _____ C:\Users\Dan\Downloads\PageDefrag.zip

2013-12-05 08:32 - 2013-12-05 08:32 - 00018654 _____ C:\ComboFix.txt

2013-12-05 08:02 - 2013-12-05 08:03 - 01000366 _____ (Swearware) C:\Users\Dan\Downloads\ComboFix (2).exe

2013-12-05 08:01 - 2013-12-05 08:01 - 00782656 _____ (Swearware) C:\Users\Dan\Downloads\ComboFix (1).exe

2013-12-05 07:55 - 2013-04-29 06:17 - 00047632 _____ (Panda Security, S.L.) C:\Windows\System32\Drivers\PSKMAD.sys

2013-12-04 21:26 - 2013-12-04 21:27 - 05152313 ____R (Swearware) C:\Users\Dan\Downloads\ComboFix.exe

2013-12-04 14:00 - 2013-12-04 14:00 - 00136662 _____ C:\Users\Dan\Downloads\UnityWebPlayer.exe

2013-11-24 17:22 - 2013-11-24 17:22 - 00000000 ____D C:\Users\Dan\Documents\CAM Development

2013-11-24 17:13 - 2013-11-24 17:13 - 00000000 ____D C:\Program Files\CAM Development

2013-11-24 17:12 - 2013-11-24 17:12 - 00901072 _____ (CAM Development ) C:\Users\Dan\Downloads\cuz_setup.exe

2013-11-24 17:10 - 2013-11-24 17:10 - 00317070 _____ C:\Users\Dan\Downloads\cbsidlm-cbsi145-CAM_UnZip-SEO-10399651 (1).exe

2013-11-24 17:09 - 2013-11-24 17:09 - 00317070 _____ C:\Users\Dan\Downloads\cbsidlm-cbsi145-CAM_UnZip-SEO-10399651.exe

2013-11-24 15:11 - 2013-11-24 15:11 - 01284762 _____ C:\Users\Dan\Downloads\Wrath of the Fallen 1.6 (2).zip

2013-11-21 08:43 - 2013-11-21 08:43 - 00000000 ____D C:\Users\Dan\Desktop\Random

2013-11-21 07:51 - 2013-11-21 07:51 - 00000000 ____D C:\Users\Dan\Desktop\New folder

2013-11-21 07:47 - 2013-11-24 17:28 - 00000000 ____D C:\Users\Dan\Desktop\Xander's Games

2013-11-20 08:45 - 2013-11-20 08:45 - 00000155 _____ C:\Users\Dan\Downloads\download (1)

2013-11-20 08:44 - 2013-11-20 08:44 - 00000155 _____ C:\Users\Dan\Downloads\father

2013-11-20 05:17 - 2013-11-20 05:18 - 00243056 _____ C:\Users\Dan\Downloads\Withers Challenge 1.6.zip

2013-11-18 17:27 - 2013-11-18 17:27 - 00000000 ____D C:\Users\Administrator\Documents\My Games

2013-11-18 15:49 - 2013-11-18 15:49 - 00543598 _____ (Swearware) C:\Users\Administrator\Downloads\ComboFix-1.exe

2013-11-18 15:46 - 2013-11-18 15:46 - 00791044 _____ (Swearware) C:\Users\Administrator\Downloads\ComboFix (1).exe

2013-11-18 15:44 - 2013-11-18 15:45 - 00424768 _____ (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe

2013-11-18 14:50 - 2013-11-18 14:50 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Open Download Manager

2013-11-18 12:36 - 2013-11-18 12:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes

2013-11-17 14:27 - 2013-11-17 14:27 - 00183881 _____ C:\Users\Dan\Downloads\world4 (2).zip

2013-11-17 14:26 - 2013-11-17 14:26 - 00168340 _____ C:\Users\Dan\Downloads\MineCraftSetup.exe

2013-11-17 14:18 - 2013-11-17 14:18 - 00750369 _____ (Conduit) C:\Users\Dan\Downloads\7Zip_brch.exe

2013-11-17 14:15 - 2013-11-17 14:15 - 00234668 _____ C:\Users\Dan\Downloads\Herobrines Return 1.6 (1).zip

2013-11-17 14:15 - 2013-11-17 14:15 - 00142596 _____ C:\Users\Dan\Downloads\Herobrines Return 1.6 (2).zip

2013-11-15 14:45 - 2013-11-15 14:45 - 00001012 _____ C:\Users\Dan\Documents\mc storylibne.txt

2013-11-15 11:27 - 2013-11-15 11:27 - 00001126 _____ C:\Users\Admin\Desktop\Continue Codec Package Installation.lnk

2013-11-15 11:23 - 2013-11-15 11:23 - 00000000 ____D C:\Program Files\DivX

2013-11-15 11:22 - 2013-11-18 14:47 - 00000000 ____D C:\Program Files\DSP-worx

2013-11-15 11:22 - 2013-11-15 11:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\LavFilters

2013-11-15 11:22 - 2013-11-15 11:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\CDXReader

2013-11-15 11:22 - 2013-11-15 11:22 - 00000000 ____D C:\ProgramData\DivX

2013-11-15 11:21 - 2013-11-18 14:48 - 00000000 ____D C:\Program Files\OpenSource Flash Video Splitter

2013-11-15 11:12 - 2013-11-15 11:12 - 00992214 _____ C:\Users\Dan\Downloads\Wrath of the Fallen 1.6 (1).zip

2013-11-15 11:09 - 2013-11-15 11:09 - 00626304 _____ C:\Users\Dan\Downloads\Search for the Skyheart V1.2.1.zip

2013-11-14 18:19 - 2013-11-14 18:20 - 00014817 _____ C:\Users\Dan\Downloads\launcher-start (3).jar

2013-11-14 18:18 - 2013-11-14 18:18 - 00525088 _____ C:\Users\Dan\Downloads\chromeinstall-7u45 (1).exe

2013-11-14 14:40 - 2013-11-14 14:40 - 00262633 _____ C:\Users\Dan\Downloads\World4 (1).zip

2013-11-14 14:16 - 2013-11-14 14:16 - 00423331 _____ C:\Users\Dan\Downloads\world4.zip

2013-11-14 14:13 - 2013-11-14 14:14 - 01385222 _____ C:\Users\Dan\Downloads\Multiplex 2 The Village V0.99.zip

2013-11-14 14:07 - 2013-11-14 14:07 - 00322938 _____ C:\Users\Dan\Downloads\Amidst the Clouds.zip

2013-11-14 13:56 - 2013-11-14 13:56 - 01702160 _____ C:\Users\Dan\Downloads\Dreams I The Awakening (1).zip

2013-11-14 13:55 - 2013-11-14 13:55 - 01281702 _____ C:\Users\Dan\Downloads\-Father II- Adventure Map v1.3.zip

2013-11-14 13:51 - 2013-11-14 13:51 - 01515432 _____ C:\Users\Dan\Downloads\Firestorm Fortress v1.0.zip

2013-11-14 13:44 - 2013-11-14 13:44 - 01702160 _____ C:\Users\Dan\Downloads\Dreams I The Awakening.zip

2013-11-14 13:19 - 2013-11-14 13:19 - 01430154 _____ C:\Users\Dan\Downloads\Wrath of the Fallen 1.6.zip

2013-11-14 13:04 - 2013-11-14 13:05 - 01453920 _____ C:\Users\Dan\Downloads\Herobrines Mansion 1.6 (1).zip

2013-11-14 12:53 - 2013-11-14 12:53 - 00119147 _____ C:\Users\Dan\Downloads\wrar500 (1).exe

2013-11-14 12:50 - 2013-11-14 12:52 - 00000000 ____D C:\Program Files\WinRAR

2013-11-14 12:47 - 2013-11-14 12:47 - 00546029 _____ C:\Users\Dan\Downloads\wrar500.exe

2013-11-14 11:53 - 2013-11-14 11:53 - 00000000 ____D C:\Users\Admin\AppData\Local\WhiteListing

2013-11-14 11:47 - 2013-11-14 11:48 - 00269814 _____ C:\Users\Dan\Downloads\Herobrines Return 1.6.zip

2013-11-14 11:42 - 2013-11-14 11:41 - 00351124 _____ C:\Users\Admin\AppData\Local\mysearchdial-speeddial.crx

2013-11-14 11:41 - 2013-11-18 14:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DigitalSite

2013-11-14 11:41 - 2013-11-14 11:41 - 00000383 _____ C:\Users\Admin\Desktop\FREE Games.url

2013-11-14 11:41 - 2013-11-14 11:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\0D0S1L2Z1P1B

2013-11-14 10:25 - 2013-11-14 10:25 - 00385848 _____ C:\Users\Dan\Downloads\Herobrines Mansion 1.6.zip

2013-11-14 01:12 - 2013-10-11 23:04 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-11-14 01:12 - 2013-10-11 23:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-11-14 01:12 - 2013-10-11 23:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-11-14 01:12 - 2013-10-11 23:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-11-14 01:12 - 2013-10-11 22:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-11-14 01:12 - 2013-10-11 21:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-11-13 14:06 - 2013-11-26 07:38 - 00001546 _____ C:\Users\Dan\Documents\NBT TAGS.txt

2013-11-13 02:33 - 2013-09-24 18:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2013-11-13 02:33 - 2013-09-24 18:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2013-11-13 02:33 - 2013-09-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll

2013-11-13 02:33 - 2013-09-24 17:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll

2013-11-13 02:33 - 2013-09-24 17:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll

2013-11-13 02:33 - 2013-09-24 17:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll

2013-11-13 02:33 - 2013-09-24 17:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2013-11-13 02:33 - 2013-09-24 16:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe

2013-11-13 02:33 - 2013-09-24 16:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll

2013-11-13 02:33 - 2013-07-04 04:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2013-11-13 02:32 - 2013-10-11 18:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll

2013-11-13 02:32 - 2013-10-11 18:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL

2013-11-13 02:32 - 2013-10-11 18:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL

2013-11-13 02:32 - 2013-10-05 11:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2013-11-13 02:32 - 2013-10-02 17:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll

2013-11-12 10:45 - 2013-11-12 10:45 - 00000000 ____D C:\Users\Admin\AppData\Local\Apple

2013-11-11 13:12 - 2013-11-11 13:12 - 00000155 _____ C:\Users\Dan\Downloads\download

2013-11-11 13:07 - 2013-11-11 13:07 - 00000155 _____ C:\Users\Dan\Downloads\ads (2)

2013-11-11 13:07 - 2013-11-11 13:07 - 00000155 _____ C:\Users\Dan\Downloads\ads (1)

2013-11-11 13:04 - 2013-11-11 13:04 - 00000155 _____ C:\Users\Dan\Downloads\ads

==================== One Month Modified Files and Folders =======

2013-12-09 22:05 - 2013-12-09 22:05 - 00000000 ____D C:\FRST

2013-12-09 20:02 - 2011-05-25 21:33 - 01525916 _____ C:\Windows\WindowsUpdate.log

2013-12-09 19:59 - 2009-07-13 20:34 - 00013440 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-09 19:59 - 2009-07-13 20:34 - 00013440 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-09 19:53 - 2011-05-26 19:59 - 00169655 _____ C:\ceProcesses.txt

2013-12-09 19:34 - 2013-12-09 19:34 - 00000000 ____D C:\Users\Administrator\AppData\Local\CrashDumps

2013-12-08 19:13 - 2013-12-08 19:04 - 00000000 ____D C:\Users\Administrator\Desktop\RK_Quarantine

2013-12-08 19:12 - 2013-12-08 19:12 - 00001303 _____ C:\Users\Administrator\Desktop\RKreport[0]_SC_12082013_211212.txt

2013-12-08 19:11 - 2013-12-08 19:11 - 00001899 _____ C:\Users\Administrator\Desktop\RKreport[0]_D_12082013_211158.txt

2013-12-08 19:08 - 2013-12-08 19:08 - 00002067 _____ C:\Users\Administrator\Desktop\RKreport[0]_S_12082013_210821.txt

2013-12-08 19:00 - 2013-12-08 19:00 - 00003248 _____ C:\Users\Administrator\Desktop\JRT.txt

2013-12-08 18:59 - 2013-12-08 19:04 - 03580416 _____ C:\Users\Administrator\Desktop\RogueKiller.exe

2013-12-08 18:57 - 2013-12-08 18:57 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-12-08 18:55 - 2013-12-08 18:55 - 00000000 ____D C:\Windows\ERUNT

2013-12-08 18:52 - 2013-12-08 18:52 - 00007173 _____ C:\Users\Administrator\Desktop\AdwCleaner[R0].txt

2013-12-08 18:21 - 2013-12-08 18:20 - 00000000 ____D C:\AdwCleaner

2013-12-08 18:20 - 2011-05-25 19:53 - 00726316 _____ C:\Windows\System32\PerfStringBackup.INI

2013-12-08 18:15 - 2013-12-08 18:15 - 00001252 _____ C:\Users\Administrator\Desktop\checkup.txt

2013-12-08 18:08 - 2013-12-08 18:53 - 01034531 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe

2013-12-08 18:07 - 2013-12-08 18:19 - 01110034 _____ C:\Users\Administrator\Desktop\AdwCleaner.exe

2013-12-08 18:05 - 2013-12-07 06:51 - 00000906 _____ C:\Windows\setupact.log

2013-12-08 18:03 - 2013-12-08 18:05 - 00891200 _____ C:\Users\Administrator\Desktop\SecurityCheck.exe

2013-12-08 17:51 - 2013-12-08 17:51 - 00332462 _____ C:\Users\Administrator\Downloads\SecurityCheck (2).exe

2013-12-08 17:50 - 2013-12-08 17:50 - 00284930 _____ C:\Users\Administrator\Downloads\SecurityCheck (1).exe

2013-12-08 17:50 - 2013-12-08 17:49 - 00199652 _____ C:\Users\Administrator\Downloads\SecurityCheck.exe

2013-12-08 17:47 - 2011-05-26 20:48 - 00000000 ____D C:\ProgramData\Panda Security URL Filtering

2013-12-08 12:56 - 2013-11-07 13:34 - 00000000 ____D C:\Users\Dan\AppData\Roaming\.minecraft

2013-12-07 06:51 - 2013-12-07 06:51 - 00000000 _____ C:\Windows\setuperr.log

2013-12-06 21:11 - 2013-12-06 21:11 - 00009651 _____ C:\Users\Administrator\Desktop\Attach.txt

2013-12-06 21:09 - 2013-12-06 21:09 - 00031348 _____ C:\Users\Administrator\Desktop\DDS.txt

2013-12-06 21:05 - 2013-12-06 21:04 - 00625664 _____ C:\Users\Administrator\Downloads\dds.scr