43 replies to this topic

[jeffce]

C:\Classified\Cal and Me  <<  That folder does not exist??? 

[flyforever01]

Yes, that is correct. The file does not exist. I searched my computer. The only place the pictures are located are under C:\Qoobox\Quarantine\C\Classified\Cal and Me, as jpg.vir files.

[jeffce]

Hi,
 
Sorry for any confusion with this....I was lucky enough to have one of the Experts clarify something for me. 
 
We will come back to your pictures ok?
 
ComboFix

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
   
   
  

  ClearJavaCache::
  
  DDS::
  uStart Page = hxxp://search.findwide.com/?guid={CB53F4A3-220D-404C-A77A-C705DF790135}&serpv=22
  uInternet Settings,ProxyOverride = *.local;192.168.*.*
  
  File::
  c:\windows\system32\AdpeakProxy64.dll
  c:\windows\SysWow64\AdpeakProxy.dll
  
  Folder::
  c:\program files\ScorpionSaver Services

  Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
• 
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix may request an update; please allow it.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------
 
  AdwCleaner

Double click on AdwCleaner.exe to run the tool again.

• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished...
• This time, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

------------
 
 
Post the new ComboFix and AdwCleaner logs and then let me know how your system is running. 

[flyforever01]

Hey Jeff,

 

Here's the results from the ComboFix program:

 

ComboFix 13-12-20.01 - Sierra Larson 12/21/2013   1:54.6.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3894.1167 [GMT -5:00]

Running from: c:\users\Sierra Larson\Desktop\ComboFix.exe

Command switches used :: c:\users\Sierra Larson\Desktop\CFScript.txt

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\AdpeakProxy64.dll"

"c:\windows\SysWow64\AdpeakProxy.dll"

.

.

(((((((((((((((((((((((((   Files Created from 2013-11-21 to 2013-12-21  )))))))))))))))))))))))))))))))

.

.

2013-12-21 07:11 . 2013-12-21 07:11 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-12-17 05:07 . 2013-12-17 05:10 -------- d-----w- C:\AdwCleaner

2013-12-17 04:57 . 2013-12-17 04:57 -------- d-----w- c:\program files (x86)\OpenIt

2013-12-15 18:03 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe

2013-12-15 18:03 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe

2013-12-15 18:03 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL

2013-12-15 18:03 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL

2013-12-15 18:03 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll

2013-12-15 05:13 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll

2013-12-15 05:13 . 2013-10-30 02:19 301568 ----a-w- c:\windows\SysWow64\msieftp.dll

2013-12-15 05:13 . 2013-10-30 01:24 3155968 ----a-w- c:\windows\system32\win32k.sys

2013-12-15 05:11 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll

2013-12-15 05:11 . 2013-11-23 17:47 465920 ----a-w- c:\windows\system32\WMPhoto.dll

2013-12-15 05:08 . 2013-10-19 02:18 81408 ----a-w- c:\windows\system32\imagehlp.dll

2013-12-15 05:08 . 2013-10-19 01:36 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll

2013-12-15 05:03 . 2013-11-12 02:23 2048 ----a-w- c:\windows\system32\tzres.dll

2013-12-15 05:03 . 2013-11-12 02:07 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2013-12-15 05:03 . 2013-10-04 02:16 116736 ----a-w- c:\windows\system32\drivers\drmk.sys

2013-12-15 05:03 . 2013-10-04 01:36 230400 ----a-w- c:\windows\system32\drivers\portcls.sys

2013-12-15 04:57 . 2013-10-12 02:32 150016 ----a-w- c:\windows\system32\wshom.ocx

2013-12-15 04:57 . 2013-10-12 02:31 202752 ----a-w- c:\windows\system32\scrrun.dll

2013-12-15 04:57 . 2013-10-12 02:04 121856 ----a-w- c:\windows\SysWow64\wshom.ocx

2013-12-15 04:57 . 2013-10-12 01:33 156160 ----a-w- c:\windows\system32\cscript.exe

2013-12-15 04:57 . 2013-10-12 02:03 163840 ----a-w- c:\windows\SysWow64\scrrun.dll

2013-12-15 04:57 . 2013-10-12 01:33 168960 ----a-w- c:\windows\system32\wscript.exe

2013-12-15 04:57 . 2013-10-12 01:15 141824 ----a-w- c:\windows\SysWow64\wscript.exe

2013-12-15 04:57 . 2013-10-12 01:15 126976 ----a-w- c:\windows\SysWow64\cscript.exe

2013-12-14 20:30 . 2013-12-15 13:39 -------- d-----w- c:\programdata\TubeDimmer

2013-12-11 05:12 . 2009-07-14 01:14 1397248 ----a-w- c:\windows\SysWow64\win_utilman.exe

2013-12-11 05:12 . 2013-12-11 05:12 -------- d-----w- c:\users\Sierra Larson\AppData\Roaming\_MDLogs

2013-11-30 01:46 . 2013-10-14 23:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE

2013-11-30 01:41 . 2013-11-30 01:41 977408 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-11-27 05:37 . 2013-11-27 05:37 -------- d-----w- c:\program files\Level Quality Watcher

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-10-12 02:30 . 2013-11-13 22:18 830464 ----a-w- c:\windows\system32\nshwfp.dll

2013-10-12 02:29 . 2013-11-13 22:18 859648 ----a-w- c:\windows\system32\IKEEXT.DLL

2013-10-12 02:29 . 2013-11-13 22:18 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL

2013-10-12 02:03 . 2013-11-13 22:18 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll

2013-10-12 02:01 . 2013-11-13 22:18 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL

2013-10-05 20:25 . 2013-11-14 01:23 1474048 ----a-w- c:\windows\system32\crypt32.dll

2013-10-05 19:57 . 2013-11-14 01:23 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll

2013-10-04 02:28 . 2013-11-14 01:13 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll

2013-10-04 02:25 . 2013-11-14 01:13 197120 ----a-w- c:\windows\system32\credui.dll

2013-10-04 02:24 . 2013-11-14 01:13 1930752 ----a-w- c:\windows\system32\authui.dll

2013-10-04 01:58 . 2013-11-14 01:13 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll

2013-10-04 01:56 . 2013-11-14 01:13 168960 ----a-w- c:\windows\SysWow64\credui.dll

2013-10-04 01:56 . 2013-11-14 01:13 1796096 ----a-w- c:\windows\SysWow64\authui.dll

2013-10-03 02:23 . 2013-11-13 22:19 404480 ----a-w- c:\windows\system32\gdi32.dll

2013-10-03 02:00 . 2013-11-13 22:19 311808 ----a-w- c:\windows\SysWow64\gdi32.dll

2013-09-28 01:09 . 2013-11-14 00:03 497152 ----a-w- c:\windows\system32\drivers\afd.sys

2013-09-25 02:26 . 2013-11-14 00:38 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2013-09-25 02:26 . 2013-11-14 00:38 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2013-09-25 02:23 . 2013-11-14 00:38 28672 ----a-w- c:\windows\system32\sspisrv.dll

2013-09-25 02:23 . 2013-11-14 00:38 135680 ----a-w- c:\windows\system32\sspicli.dll

2013-09-25 02:23 . 2013-11-14 00:38 28160 ----a-w- c:\windows\system32\secur32.dll

2013-09-25 02:22 . 2013-11-14 00:38 340992 ----a-w- c:\windows\system32\schannel.dll

2013-09-25 02:21 . 2013-11-14 00:38 307200 ----a-w- c:\windows\system32\ncrypt.dll

2013-09-25 02:21 . 2013-11-14 00:38 1447936 ----a-w- c:\windows\system32\lsasrv.dll

2013-09-25 01:58 . 2013-11-14 00:38 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2013-09-25 01:57 . 2013-11-14 00:38 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2013-09-25 01:57 . 2013-11-14 00:38 247808 ----a-w- c:\windows\SysWow64\schannel.dll

2013-09-25 01:56 . 2013-11-14 00:38 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2013-09-25 01:03 . 2013-11-14 00:38 30720 ----a-w- c:\windows\system32\lsass.exe

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}]

c:\program files (x86)\ScorpionSaver\IECore.dll [BU]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{7C8D4A29-2DC9-4970-83B8-1E51B961E00F}"= "c:\users\Sierra Larson\AppData\Local\TNT2\Profiles\10743\passport.dll" [2013-11-04 11520]

.

[HKEY_CLASSES_ROOT\clsid\{7c8d4a29-2dc9-4970-83b8-1e51b961e00f}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-15 20588704]

"Updater"="c:\programdata\Updater\updater.exe" [2013-09-25 297336]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]

"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]

"FaxCenterServer"="c:\program files (x86)\Lexmark Fax Solutions\fm3032.exe" [2007-06-11 312240]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"Updater"="c:\programdata\Updater\Updater.exe" [2013-09-25 297336]

.

c:\users\Sierra Larson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\system32\userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~3\BitGuard\271832~1.68\{C16C1~1\BitGuard.dll

"LoadAppInit_DLLs"=1 (0x1)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxddserv.exe;c:\windows\SYSNATIVE\spool\DRIVERS\x64\3\\lxddserv.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys;c:\windows\SYSNATIVE\DRIVERS\motfilt.sys [x]

R3 ExpressInvoiceService;Express Invoice;c:\program files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe;c:\program files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys;c:\windows\SYSNATIVE\DRIVERS\motccgp.sys [x]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys;c:\windows\SYSNATIVE\DRIVERS\motccgpfl.sys [x]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys;c:\windows\SYSNATIVE\DRIVERS\Motousbnet.sys [x]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys;c:\windows\SYSNATIVE\DRIVERS\motusbdevice.sys [x]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\SYMDS64.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\SYMEFA64.SYS [x]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130502.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [x]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130505.002\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130505.002\IDSvia64.sys [x]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1207020.003\Ironx64.SYS [x]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1207020.003\SYMNETS.SYS [x]

S2 BitGuard;BitGuard;c:\programdata\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe;c:\programdata\BitGuard\2.7.1832.68\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [x]

S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x]

S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]

S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]

S2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe;c:\windows\SYSNATIVE\lxddcoms.exe [x]

S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [x]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [x]

S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [x]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]

S3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-11 04:32 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 01:20]

.

2013-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-25 01:20]

.

2013-12-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1565193607-854521613-1741241799-1001Core.job

- c:\users\Sierra Larson\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-03 01:20]

.

2013-12-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1565193607-854521613-1741241799-1001UA.job

- c:\users\Sierra Larson\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-03 01:20]

.

2013-12-19 c:\windows\Tasks\HPCeeScheduleForSIERRALARSON-HP$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{7C8D4A29-2DC9-4970-83B8-1E51B961E00F}"= "c:\users\Sierra Larson\AppData\Local\TNT2\Profiles\10743\passport64.dll" [2013-11-04 12032]

.

[HKEY_CLASSES_ROOT\CLSID\{7C8D4A29-2DC9-4970-83B8-1E51B961E00F}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-01-21 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-01-21 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-01-21 418328]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-02-15 1128448]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]

"lxddmon.exe"="c:\program files (x86)\Lexmark 2500 Series\lxddmon.exe" [2007-06-11 291760]

"lxddamon"="c:\program files (x86)\Lexmark 2500 Series\lxddamon.exe" [2007-04-30 20480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.254.254

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-12-21  02:17:24

ComboFix-quarantined-files.txt  2013-12-21 07:17

ComboFix2.txt  2013-12-20 03:56

ComboFix3.txt  2013-12-20 03:25

ComboFix4.txt  2013-12-19 16:07

ComboFix5.txt  2013-12-21 06:51

.

Pre-Run: 387,686,285,312 bytes free

Post-Run: 387,198,124,032 bytes free

.

- - End Of File - - 6EE82D6BFB8C542062703E4BD6FB6030

[jeffce]

Good....when you get the log from AdwCleaner please post that as well. 

[flyforever01]

Hi Jeff,

 

Here is the log report from AdwCleaner.

 

# AdwCleaner v3.015 - Report created 21/12/2013 at 12:48:31

# Updated 10/12/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Sierra Larson - SIERRALARSON-HP

# Running from : C:\Users\Sierra Larson\Desktop\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

Service Deleted : BitGuard

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\AOL Toolbar

Folder Deleted : C:\ProgramData\Babylon

[!] Folder Deleted : C:\ProgramData\BitGuard

Folder Deleted : C:\ProgramData\Free Ride Games

Folder Deleted : C:\ProgramData\NCH Software

Folder Deleted : C:\ProgramData\PCFixSpeed

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\ProgramData\TubeDimmer

Folder Deleted : C:\ProgramData\Uniblue\DriverScanner

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RebateInformer

Folder Deleted : C:\Program Files (x86)\AOL Toolbar

Folder Deleted : C:\Program Files (x86)\AppGraffiti

Folder Deleted : C:\Program Files (x86)\Free Ride Games

Folder Deleted : C:\Program Files (x86)\Inbox Toolbar

Folder Deleted : C:\Program Files (x86)\Level Quality Watcher

Folder Deleted : C:\Program Files (x86)\NCH Software

Folder Deleted : C:\Program Files (x86)\openit

Folder Deleted : C:\Program Files (x86)\PCFixSpeed

Folder Deleted : C:\Program Files (x86)\Playbryte

Folder Deleted : C:\Program Files (x86)\RebateInformer

Folder Deleted : C:\Program Files (x86)\SearchYa!

Folder Deleted : C:\Program Files (x86)\SiteRanker

Folder Deleted : C:\Program Files (x86)\Uniblue\DriverScanner

Folder Deleted : C:\Program Files (x86)\Wajam

Folder Deleted : C:\Program Files (x86)\Solid Savings

Folder Deleted : C:\Program Files\Level Quality Watcher

Folder Deleted : C:\Users\Sierra Larson\AppData\Local\GameFlakeSA

Folder Deleted : C:\Users\Sierra Larson\AppData\Local\iLivid

Folder Deleted : C:\Users\Sierra Larson\AppData\Local\Wajam

Folder Deleted : C:\Users\Sierra Larson\AppData\Local\Solid Savings

Folder Deleted : C:\Users\Sierra Larson\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Sierra Larson\AppData\LocalLow\Delta

Folder Deleted : C:\Users\Sierra Larson\AppData\LocalLow\Inbox Toolbar

Folder Deleted : C:\Users\Sierra Larson\AppData\LocalLow\Playbryte

Folder Deleted : C:\Users\Sierra Larson\AppData\Roaming\Babylon

Folder Deleted : C:\Users\Sierra Larson\AppData\Roaming\file scout

[x] Not Deleted : C:\Users\Sierra Larson\AppData\Roaming\NCH Software

Folder Deleted : C:\Users\Sierra Larson\AppData\Roaming\PCFixSpeed

Folder Deleted : C:\Users\Sierra Larson\AppData\Roaming\Uniblue\DriverScanner

Folder Deleted : C:\Users\Sierra Larson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard

[x] Not Deleted : C:\Users\Public\Desktop\eBay.lnk

File Deleted : C:\Windows\SysWOW64\AdpeakProxy.ini

File Deleted : C:\Windows\SysWOW64\AdpeakProxyOff.ini

File Deleted : C:\Windows\System32\AdpeakProxy.ini

File Deleted : C:\Windows\System32\AdpeakProxyOff.ini

File Deleted : C:\Users\Sierra Larson\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage

File Deleted : C:\Users\Sierra Larson\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage

File Deleted : C:\Users\Sierra Larson\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage-journal

[x] Not Deleted : C:\Windows\System32\Tasks\NCH Software

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

Key Deleted : HKLM\SOFTWARE\Classes\*\shell\filescout

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Key Deleted : HKCU\Software\5e6888ab06aed46

Key Deleted : HKLM\SOFTWARE\5e6888ab06aed46

[jeffce]

Good job.....How is your system running? 

[flyforever01]

It's working better, but I still have this thing called "Friends Checker" that is underlining and linking words in my web pages. It's not an extension on my browser. How do I get rid of that?

[flyforever01]

It's working better, but I still have this thing called "Friends Checker" that is underlining and linking words in my web pages. It's not an extension on my browser. How do I get rid of that?

[jeffce]

 Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

------------
 

Java
 
Please go to Start > Control Panel > Programs and Features > uninstall all the Java Programs you see, now download the latest Java from the following link and install it:
 
http://java.com/en/download/index.jsp
----------
 
See this page for instructions on how to clear java's cache.
 
Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

• Under Temporary Internet Files, click the Delete Files button.
• There are three options in the window to clear the cache - Leave ALL 3 Checked
  • Downloaded Applets
    Downloaded Applications
    Installed Applications and Applets
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Java Control Panel.

----------
 

Please download Malwarebytes Anti-Malware to your desktop.

• Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform Full scan, then click Scan as shown below.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• The log can also be found here:
   
  Windows 2000 & Windows XP:
  C:\Documents and Settings\<USERNAME>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs
   
  Windows Vista & Win7:
  C:\Users\<USERNAME>\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
  ----------
   
  
  ESET Online Scanner
   
  Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
  ----------

[flyforever01]

Here is the Junkware Removal log:

 

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Home Premium x64

Ran by Sierra Larson on Wed 12/25/2013 at 21:07:23.97

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\dynconie

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1565193607-854521613-1741241799-1001\Software\sweetim

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FEC26096-9730-4EDD-AD86-96C5C675EDC4}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{FEC26096-9730-4EDD-AD86-96C5C675EDC4}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] "C:\Users\Sierra Larson\AppData\Roaming\onlinevault"

Successfully deleted: [Folder] "C:\Users\Sierra Larson\appdata\locallow\vgrabber_v1"

Successfully deleted: [Folder] "C:\Program Files (x86)\buzzsocialpoints_dns_ie"

Successfully deleted: [Folder] "C:\Program Files (x86)\onlinevault"

Successfully deleted: [Folder] "C:\Program Files (x86)\vgrabber_v1"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pc fix speed"

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{0180E3BE-43EB-416B-95E0-B494189B73CD}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{0247C46F-7A59-4E5E-BA94-C311AEE0FF69}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{03CE89D7-B772-42CA-B8EE-45703D2A11C2}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{06D7DACA-3114-493F-A26C-9F5881EB82D5}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{07A8220F-4D1D-4770-9253-3265653391E8}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{08EC04DF-C1C9-4CC2-8588-BC4A90306382}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{0B40B89D-7FA5-4586-ABFD-119CF8B89ADE}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{160428F9-8B7E-4634-B877-DDEA4741CD74}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{18F4A62A-222C-4A16-9C72-56F4149F62FA}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{196BF91C-BB46-4B28-9749-3C11FD0E35F5}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{205C6323-10C2-4CE2-B353-4CBA23784CED}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{21419E5E-7030-4B98-B1F8-88A4A7678B68}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{2150CA4A-0AB7-456C-927E-4590439F9761}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{218C4E41-D231-48D9-8D85-6AAC473592CD}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{2260D045-4177-4CE8-B6C1-2A32E7C5C7AC}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{267ACB9E-0114-4926-AD7B-2CC9A3402D65}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{2D1CE70A-4E1D-4059-BBDC-65C5E3AA71CC}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{3169FE10-1F70-45AA-B18D-15E787B94715}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{356EACF1-D7B0-4614-8588-4476E3DCEB15}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{37849EF8-D0D5-4EDF-AB77-58CC0F18946F}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{3B85B5E6-306C-4D18-A81E-52328F48571E}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{3C4055C3-4FF2-4009-AABE-1ED5E9004FD2}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{3D251819-9EBB-41ED-8AE7-B09C6694EBF8}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{3FD2AEF7-9518-4DB6-A433-DB0D0E8236D2}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{422F3D15-B2D5-4FF2-AACB-97B099D170F8}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{439E6A40-54CF-4ED8-9C07-282D05D69771}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{47353476-3832-4800-AE03-898163C0EB90}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{47C29E4D-65D6-4F79-B1B9-8C66530851F2}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{4AABD565-9BCF-4744-B060-A0097F3BCF27}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{4E35B2DF-0BE5-4BA3-8C73-B5AE7DEA0DA6}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5126F62B-D4C2-4BF7-A6CB-53737854340A}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5392C9B7-26B1-47FD-9C9F-40EAB89A2867}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{566FB44D-0576-430B-9998-A44657229450}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{57F2AC27-1221-4095-B688-9D2CAABF3271}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5815FD61-2952-44BD-9647-5EB9AE54C512}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5930B263-1D01-4A63-BF33-AF436BD5B9F3}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{59D94DF8-28B8-4E10-AAA0-06C7578ADCBC}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5A3AF51C-47DB-46F9-AAF5-4080843C15F8}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5BF301E0-EDC1-404C-9026-86CE4CF00418}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5DD0252F-4373-41F4-A1E5-9F2CA8A3BD2E}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{5FA3A2D5-4C39-43C3-81E0-14A50E7556D4}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{633AF31B-FB84-44FC-B1D9-869E9DD81DE7}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{68808BFC-362D-4285-825B-9CD532FA3789}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{6B1CCDE2-12D8-4217-829B-1D8790AE23A9}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{6E531330-4C32-4FDC-BED4-55D199B6AF78}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{6E8F72F8-91D0-4211-8AA4-8166C5B063DD}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{70451961-D048-4746-BAB3-62EF21E0A704}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{71E2C44B-7560-4D2B-87E5-8C614EE2EA8F}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{72B00BD6-4E7A-4702-BC07-C905D576E86B}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{780FA2F6-5EFF-4658-BE77-D7EEA1F22FF3}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{784CD866-201F-48E9-BFFA-269950019379}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{7984C131-69C9-4845-A638-169628E35C7D}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{7AB0860E-35D6-47AD-A540-A0FB670F6679}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{7AEAE6D3-87EF-4A6B-92B5-5D249A513684}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{800D15E8-672B-4D2A-AB3C-803716BCB7D1}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{806B2C22-662E-4E76-A794-6C28FD256241}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{8083068B-BD5D-4D9C-A67F-45600B590241}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{80D2902A-8A3B-4076-9608-8AA6C7141537}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{83734B34-DD70-4A50-9B17-64D784E5E2CC}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{8381B740-6BF2-4281-9D84-6D7AD2D78AAE}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{83B17F4F-B567-4E21-B9DB-5FAD716BC83D}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{896DBC63-7522-473F-8C8B-172A65DC80C0}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{899A17AA-80F5-4F14-B308-7017100F7E4A}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{89F1DCED-524F-498D-8E37-6D62FC717B8C}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{8D55C866-7FD0-49A1-8513-E0145885EC29}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{903E4944-17C3-41B2-A70F-BA4050413C1B}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{936271AC-6B15-4816-B764-6EB6AC8E4DEF}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{966E639F-276A-44FD-A42B-27645829D578}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{9DD2DA45-4CDD-4833-A6BA-AE9D5AAA77CF}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{A53524E1-8C46-45FC-BE67-F36286EDBEF7}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{A5653D8F-4ACB-486B-9DCA-05BB43DCB35D}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{A8CF8E3F-2D20-44E5-822E-F836F20B3918}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{A9FF6F96-F5FB-4B25-86C9-22EFB7019D5D}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{B60AA5B1-0CE3-47B4-86BF-3CF8D5AB2920}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{B85FB548-EA71-48F0-9B7E-FD443B3CCF15}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{B95416E8-CC5B-4628-8BB9-F2C817042714}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{BB761D2E-2301-4243-A76D-2FA49F130680}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{BDD4CD1D-7142-43AE-B5CC-943DA92F9793}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{BEB8B663-8B52-4E51-9226-118D027D9199}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{BFDA5D31-26C2-479B-B1E6-7A0DACA97943}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{C00D2BD6-657E-476D-B386-23F3695997CD}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{C4F8A329-CEEF-4565-AFD8-08A5931DF4FC}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{C5FDB7A0-7086-409A-A9FD-E54F8412F7C7}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{CB315D79-65E4-46C0-97E6-BC9FF877668D}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{CCA613DA-7D02-47FF-B11F-DD5D527BAA0B}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{CDD7242E-2B19-4428-8DC1-787FABC18796}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{D487BD0D-CA1A-4817-8F65-BA8AEBF6A100}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{D819B6F8-238C-4295-98B9-88A5695AE7E2}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{D9F38852-A579-4E89-B53D-AF8EEF287826}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{DAF38492-C386-4373-98D4-CD8E371A8D40}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{DB347928-26B8-4389-9B14-76C3DFEC09AF}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{E01E0FA9-426E-453B-88AC-E0362C34D864}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{E4312BF2-8682-44FF-9933-BFB9E1FA03F7}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{E6CD73DA-C124-4F1B-86A3-260CF1264ED8}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{EBC0FBA1-417E-4611-8B35-AF3CA9BD4DD3}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{EC8BC82F-F9DD-4896-ABC3-6A307EDEAC4A}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{ED0576A8-9E50-4A5A-A451-FCEAC03BDDF1}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{F3BADCDB-57DC-445A-A3DE-770D3F186B82}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{F9023549-A0C5-4E1E-850C-975D627E8A43}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{FF5076D2-CEC6-4C3C-A690-F55CF69F5411}

Successfully deleted: [Empty Folder] C:\Users\Sierra Larson\appdata\local\{FFCC7FD5-C2AE-4BBF-A7FC-0E3C02D11D08}

 

 

 

~~~ Chrome

 

Successfully deleted: [Folder] C:\Users\Sierra Larson\appdata\local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 12/25/2013 at 21:19:44.94

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[flyforever01]

This is the Malware Scan log:

 

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

 

Database version: v2013.12.26.02

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Sierra Larson :: SIERRALARSON-HP [administrator]

 

Protection: Enabled

 

12/25/2013 10:15:58 PM

mbam-log-2013-12-25 (22-15-58).txt

 

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 419044

Time elapsed: 1 hour(s), 16 minute(s), 44 second(s)

 

Memory Processes Detected: 6

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Trojan.Sefnit) -> 1488 -> Delete on reboot.

C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe (PUP.Optional.SearchDonkey.A) -> 3288 -> Delete on reboot.

C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe (PUP.Optional.SearchDonkey.A) -> 996 -> Delete on reboot.

C:\ProgramData\RHelpers\IeHelper\IeHelper.exe (PUP.Optional.SearchDonkey.A) -> 4764 -> Delete on reboot.

C:\ProgramData\Updater\updater.exe (PUP.Optional.TubeDimmer) -> 12388 -> Delete on reboot.

C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> 12388 -> Delete on reboot.

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 7

HKLM\SYSTEM\CurrentControlSet\Services\AdobeFlashPlayerUpdateSvc (Trojan.Sefnit) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FLASHPLAYERUPDATESERVICE.EXE (Trojan.Sefnit) -> Quarantined and deleted successfully.

HKCR\AppID\AdpeakProxy.exe (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

HKCR\Wow6432Node\AppID\AdpeakProxy.exe (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE} (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Wow6432Node\Wow6432Node\Adpeak, Inc. (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\INTERNETUPDATER (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

 

Registry Values Detected: 6

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Updater (PUP.Optional.TubeDimmer) -> Data: C:\ProgramData\Updater\Updater.exe -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Updater (PUP.Optional.TubeDimmer) -> Data: C:\ProgramData\Updater\updater.exe -> Quarantined and deleted successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Updater (Trojan.Agent) -> Data: C:\ProgramData\Updater\updater.exe -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Updater (Trojan.Agent) -> Data: C:\ProgramData\Updater\Updater.exe -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}|DisplayName (PUP.Optional.Adpeak) -> Data: Level Quality Watcher -> Quarantined and deleted successfully.

HKLM\SYSTEM\CurrentControlSet\Services\InternetUpdater|ImagePath (PUP.Optional.InternetUpdater.A) -> Data: "C:\ProgramData\InternetUpdater\InternetUpdaterService.exe" -> Quarantined and deleted successfully.

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 8

C:\Program Files (x86)\Unfriend Checker\FF\chrome (PUP.Optional.UnFriendChecker) -> No action taken.

C:\ProgramData\InternetUpdater (PUP.Optional.InternetUpdater.A) -> Delete on reboot.

C:\Program Files (x86)\Unfriend Checker (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\FF (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\FF\chrome\content (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\ProgramData\RHelpers\ChromeHelper (PUP.Optional.Searchagent) -> Delete on reboot.

C:\ProgramData\RHelpers\FirefoxHelper (PUP.Optional.Searchagent) -> Delete on reboot.

C:\ProgramData\RHelpers\IeHelper (PUP.Optional.Searchagent) -> Delete on reboot.

 

Files Detected: 50

C:\Temp\ScorpionSaver.msi (PUP.Optional.Adpeak) -> No action taken.

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Trojan.Sefnit) -> Delete on reboot.

C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe (PUP.Optional.SearchDonkey.A) -> Delete on reboot.

C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe (PUP.Optional.SearchDonkey.A) -> Delete on reboot.

C:\ProgramData\RHelpers\IeHelper\IeHelper.exe (PUP.Optional.SearchDonkey.A) -> Delete on reboot.

C:\ProgramData\Updater\updater.exe (PUP.Optional.TubeDimmer) -> Delete on reboot.

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Level Quality Watcher\LevelQualityWatcher32.exe.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\AdwCleaner\Quarantine\C\Users\Sierra Larson\AppData\Roaming\file scout\filescout.exe.vir (PUP.Optional.FileScout.A) -> Quarantined and deleted successfully.

C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (PUP.Optional.InternetUpdater.A) -> Delete on reboot.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\AdpeakProxy.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\AdpeakProxy.exe.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\AdpeakProxy64.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\AdpeakRegisterLSP.exe.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\AdpeakRegisterLSP64.exe.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\Installbat.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\InstallDLL.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\InstallDLL64.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files\ScorpionSaver Services\PCProxyDLL.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program Files (x86)\ScorpionSaver\CustomActionUninstall.vir (Adware.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\System32\AdpeakProxy64.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\SysWOW64\AdpeakProxy.dll.vir (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Temp\InstallServices64.msi (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Temp\scorpionsaver.exe (PUP.Optional.ScorpionSaver) -> Quarantined and deleted successfully.

C:\Temp\ScorpionSaver.msi (Adware.Adpeak) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\FlashPlayer_V.49163382c.exe (Adware.DomaIQ) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\gimp-setup.exe (PUP.Optional.DownloadAdmin.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\IWantThis.exe (Adware.GamePlayLabs) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\movie_player_1280.exe (PUP.Optional.InstallIQ.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\movie_player_d998173.exe (PUP.Optional.InstallIQ.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\Player_Plugin (1).exe (PUP.Optional.BundleInstaller.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\Player_Plugin.exe (PUP.Optional.BundleInstaller.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\SoftonicDownloader_for_jeta-logo-designer.exe (PUP.Optional.Softonic.A) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\video-media-download_setup (1).exe (PUP.Downware) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\video-media-download_setup.exe (PUP.Downware) -> Quarantined and deleted successfully.

C:\Users\Sierra Larson\Downloads\ZNES.exe (PUP.Optional.IBryte) -> Quarantined and deleted successfully.

C:\Windows\Installer\404d7e59.msi (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Windows\Installer\5f956285.msi (PUP.Optional.Adpeak) -> Quarantined and deleted successfully.

C:\Windows\Installer\5f9a5c3e.msi (Adware.Adpeak) -> Quarantined and deleted successfully.

C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Trojan.Sefnit) -> Delete on reboot.

C:\ProgramData\InternetUpdater\InternetUpdater.ico (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

C:\ProgramData\InternetUpdater\app.dat (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

C:\ProgramData\InternetUpdater\data.dat (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

C:\ProgramData\InternetUpdater\InternetUpdaterService.exe.config (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

C:\ProgramData\InternetUpdater\Uninstall.exe (PUP.Optional.InternetUpdater.A) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\r.log (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\chrome.crx (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\FF\install.rdf (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\FF\chrome\content\icon.png (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Unfriend Checker\FF\chrome\content\overlay.xul (PUP.Optional.UnFriendChecker) -> Quarantined and deleted successfully.

C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> Delete on reboot.

 

(end)

[jeffce]

Good job!!  When you get the ESET log please post that as well and let me know how your system is running.  

[flyforever01]

Here is the ESET Scan Log:

 

C:\AdwCleaner\Quarantine\C\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher32.exe.vir Win32/AdWare.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe.vir Win64/Adware.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Inbox Toolbar\FF_Install.cab.vir multiple threats

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Level Quality Watcher\LevelQualityWatcher64.exe.vir a variant of Win64/Adware.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressInvoice\expressinvoicesetup_v3.87.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Scribe\scribe.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Scribe\scribesetup_v5.59.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application

C:\ProgramData\Updater\Uninstall.exe a variant of Win32/ExFriendAlert.B application

C:\Qoobox\Quarantine\C\Program Files (x86)\DealPly\DealPly.crx.vir Win32/DealPly.E application

C:\Qoobox\Quarantine\C\Program Files (x86)\DealPly\DealPly.xpi.vir Win32/DealPly.J application

C:\Qoobox\Quarantine\C\Program Files (x86)\ScorpionSaver\CustomActionInstall.vir a variant of Win32/AdWare.Adpeak.B application

C:\Qoobox\Quarantine\C\Program Files (x86)\ScorpionSaver\IECore.dll.vir a variant of Win32/AdWare.Adpeak.B application

C:\Users\All Users\Updater\Uninstall.exe a variant of Win32/ExFriendAlert.B application

C:\Users\Sierra Larson\Downloads\Adobe-Reader_Allmyapps.exe a variant of Win32/InstallCore.BH application

C:\Users\Sierra Larson\Downloads\Codec-C.exe Win32/InstallMate application

C:\Users\Sierra Larson\Downloads\Codec-V (1).exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\Codec-V (2).exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\Codec-V.exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\essetup (1).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (2).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (3).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (4).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup.exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\thelogocreator-setup.exe Win32/DownloadAdmin.G application

C:\Users\Sierra Larson\Downloads\ZipOpenerSetup.exe a variant of Win32/InstallCore.D application

C:\Windows\Installer\MSI66B5.tmp a variant of Win64/Adware.Adpeak.B application

[flyforever01]

Here is the ESET Scan Log:

 

C:\AdwCleaner\Quarantine\C\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher32.exe.vir Win32/AdWare.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe.vir Win64/Adware.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Inbox Toolbar\FF_Install.cab.vir multiple threats

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Level Quality Watcher\LevelQualityWatcher64.exe.vir a variant of Win64/Adware.Adpeak.B application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\ExpressInvoice\expressinvoicesetup_v3.87.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Scribe\scribe.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\NCH Software\Scribe\scribesetup_v5.59.exe.vir a variant of Win32/Bundled.Toolbar.Google.C application

C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application

C:\ProgramData\Updater\Uninstall.exe a variant of Win32/ExFriendAlert.B application

C:\Qoobox\Quarantine\C\Program Files (x86)\DealPly\DealPly.crx.vir Win32/DealPly.E application

C:\Qoobox\Quarantine\C\Program Files (x86)\DealPly\DealPly.xpi.vir Win32/DealPly.J application

C:\Qoobox\Quarantine\C\Program Files (x86)\ScorpionSaver\CustomActionInstall.vir a variant of Win32/AdWare.Adpeak.B application

C:\Qoobox\Quarantine\C\Program Files (x86)\ScorpionSaver\IECore.dll.vir a variant of Win32/AdWare.Adpeak.B application

C:\Users\All Users\Updater\Uninstall.exe a variant of Win32/ExFriendAlert.B application

C:\Users\Sierra Larson\Downloads\Adobe-Reader_Allmyapps.exe a variant of Win32/InstallCore.BH application

C:\Users\Sierra Larson\Downloads\Codec-C.exe Win32/InstallMate application

C:\Users\Sierra Larson\Downloads\Codec-V (1).exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\Codec-V (2).exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\Codec-V.exe Win32/InstallMate.A application

C:\Users\Sierra Larson\Downloads\essetup (1).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (2).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (3).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup (4).exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\essetup.exe a variant of Win32/Bundled.Toolbar.Google.C application

C:\Users\Sierra Larson\Downloads\thelogocreator-setup.exe Win32/DownloadAdmin.G application

C:\Users\Sierra Larson\Downloads\ZipOpenerSetup.exe a variant of Win32/InstallCore.D application

C:\Windows\Installer\MSI66B5.tmp a variant of Win64/Adware.Adpeak.B application