28 replies to this topic

[jeff matthews]

Hi,

 

This machine is super slow, i can barely manage to file browse or even open up documents. Programs are crashing. Specifically some of the software i use such as Sony Vegas and my capture card is not capturing video files correctly, because when i load them into sony vegas, they are corrupted and the program crashes. I try previous video files i did prio to the machine being infected, and they work fine. So the only solution i can think of is during these infections well i was using my capture card to capture video content off of my tv, it was corrupting all the files. On top of that the computer is obviously very slow. Can barely manage to operate it in normal mode. I will definitely have to reboot this machine in safe mode to work on it. It seems like it is getting worse. I scanned with Malewarebytes yesterday, it picked up quite a few files i deleted. I scanned today and it didn't pick up anything but its obvious symptoms remain on my pc due to the all the freezes, crashes and slow downs my computer is getting.

 

Here is my DDS log:

 

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 11.0.9600.16428  BrowserJavaVersion: 10.45.2

Run by Jeff at 11:57:06 on 2014-01-18

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.3063.1219 [GMT -8:00]

.

AV: avast! Internet Security *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: avast! Internet Security *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

FW: avast! Internet Security *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\AVAST Software\Avast\afwServ.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\loggingserver.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files (x86)\Mal Updater 2\MalUpdater.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Users\Jeff\AppData\Roaming\mjusbsp\magicJack.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\splwow64.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\DVDFab 9\DVDFab.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uWindow Title = Internet Explorer, optimized for Bing and MSN

mWinlogon: Userinit = userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: {1036AD63-AEAC-460B-9060-C96005D4DC86} - <orphaned>

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.0.49\AVG SafeGuard toolbar_toolbar.dll

BHO: Privacy Safeguard BHO: {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.0.49\AVG SafeGuard toolbar_toolbar.dll

TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>

EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>

uRun: [cdloader] "C:\Users\Jeff\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK

uRun: [Mal Updater 2] C:\Program Files (x86)\Mal Updater 2\MalUpdater.exe

uRun: [PlayNC Launcher] <no file>

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload

mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [vProt] "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui

mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon

mRun: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

.

INFO: HKLM has more than 50 listed domains.

   If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 192.168.0.1 205.171.2.65

TCP: Interfaces\{0856B52D-EEF6-4D51-B093-6BBDC1B2D636} : DHCPNameServer = 192.168.0.1 205.171.2.65

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: Privacy Safeguard BHO: {1036AD63-AEAC-460B-9060-C96005D4DC86} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard-x64.dll

x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

x64-Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe

x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

.

INFO: x64-HKLM has more than 50 listed domains.

   If you wish to scan all of them, select the 'Force scan all domains' option.

.

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

.

============= SERVICES / DRIVERS ===============

.

R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2013-4-16 65776]

R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2013-4-16 207904]

R0 mv61xx;mv61xx;C:\Windows\System32\drivers\mv61xx.sys [2009-5-11 178728]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2013-6-27 54480]

R1 aswKbd;aswKbd;C:\Windows\System32\drivers\aswKbd.sys [2012-10-29 28184]

R1 aswNdisFlt;Avast! Firewall Driver;C:\Windows\System32\drivers\aswndisflt.sys [2013-4-16 439648]

R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-10-29 1034464]

R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-10-29 422216]

R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-11-3 46368]

R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-10-29 78648]

R3 ElgatoGC658Y;Elgato Game Capture;C:\Windows\System32\drivers\ElgatoGC658.sys [2012-11-12 50288]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2012-5-10 97792]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2012-5-10 217600]

R3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-15 393216]

S3 aswStm;aswStm;C:\Windows\System32\drivers\aswstm.sys [2013-12-18 79672]

S3 H5xUSB;Roxio GameCAP HD PRO;C:\Windows\System32\drivers\uth5x64.sys [2012-8-2 101632]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-1-27 19456]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-1-27 57856]

.

=============== Created Last 30 ================

.

2014-01-18 08:34:40 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6F332AE1-BF5C-4C6F-9C1F-9250A7979C2D}\offreg.dll

2014-01-17 22:37:03 -------- d-----w- C:\Program Files\Sony

2014-01-17 22:37:03 -------- d-----w- C:\Program Files (x86)\Sony

2014-01-17 21:32:24 -------- d-----w- C:\E655_A74

2014-01-17 21:21:02 -------- d-----w- C:\Users\Jeff\AppData\Local\ElevatedDiagnostics

2014-01-17 11:47:12 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6F332AE1-BF5C-4C6F-9C1F-9250A7979C2D}\mpengine.dll

2014-01-15 06:18:29 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2014-01-15 06:18:29 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-15 06:18:29 53248 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-15 06:18:29 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-15 06:18:29 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-15 06:18:29 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-15 06:18:29 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-15 06:18:28 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-01-15 06:18:27 376768 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-08 23:59:13 -------- d-----w- C:\Program Files\Canon

2013-12-21 06:04:22 225656 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll

.

==================== Find3M  ====================

.

2014-01-08 22:39:02 439648 ----a-w- C:\Windows\System32\drivers\aswndisflt.sys

2013-12-20 22:39:02 79672 ----a-w- C:\Windows\System32\drivers\aswstm.sys

2013-12-18 22:38:21 92544 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys

2013-12-18 22:38:21 78648 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

2013-12-18 22:38:21 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys

2013-12-18 22:38:21 207904 ----a-w- C:\Windows\System32\drivers\aswVmm.sys

2013-12-18 22:38:21 1034464 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

2013-12-18 22:38:20 43152 ----a-w- C:\Windows\avastSS.scr

2013-12-18 22:38:14 28184 ----a-w- C:\Windows\System32\drivers\aswKbd.sys

2013-12-11 01:27:18 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-12-11 01:27:18 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-12-11 01:27:11 9293192 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

2013-11-26 10:19:07 2724864 ----a-w- C:\Windows\System32\mshtml.tlb

2013-11-26 10:18:23 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll

2013-11-26 09:48:07 66048 ----a-w- C:\Windows\System32\iesetup.dll

2013-11-26 09:46:25 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll

2013-11-26 09:23:02 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-11-26 09:18:39 139264 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-11-26 09:18:09 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe

2013-11-26 09:16:57 708608 ----a-w- C:\Windows\System32\jscript9diag.dll

2013-11-26 08:35:02 5769216 ----a-w- C:\Windows\System32\jscript9.dll

2013-11-26 08:28:16 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll

2013-11-26 08:16:12 4243968 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-11-26 08:02:16 1995264 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-11-26 07:32:06 1928192 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-11-26 07:07:57 2334208 ----a-w- C:\Windows\System32\wininet.dll

2013-11-26 06:33:33 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-11-23 18:26:20 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-11-23 17:47:34 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-11-19 11:33:38 267936 ------w- C:\Windows\System32\MpSigStub.exe

2013-11-12 02:23:09 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-11-12 02:07:29 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2013-11-11 19:59:12 46368 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

2013-10-31 07:46:13 270824 ----a-w- C:\Windows\System32\drivers\aswNdis2.sys

2013-10-31 07:46:12 131232 ----a-w- C:\Windows\System32\drivers\aswFW.sys

2013-10-30 02:32:01 335360 ----a-w- C:\Windows\System32\msieftp.dll

2013-10-30 02:19:52 301568 ----a-w- C:\Windows\SysWow64\msieftp.dll

2009-02-13 18:02:52 80896 ----a-w- C:\Program Files\devcon_amd64.exe

.

============= FINISH: 11:59:21.50 ===============

Attached Files

•  New WinRAR ZIP archive.zip   2.95KB   271 downloads

Edited by jeff matthews, 18 January 2014 - 02:08 PM.

[Tomk]

Hi jeff matthews,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7/8, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

[jeff matthews]

Thank you!

 

Here is the JRT log:

 

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.0 (01.07.2014:1)

OS: Windows 7 Ultimate x64

Ran by Jeff on Mon 01/20/2014 at 13:51:06.00

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\s

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\webcakedesktop_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\webcakedesktop_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3289664

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{196B035A-53D9-4CBB-B0BA-B8A097F445EF}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CF22BD5F-28CC-4475-91D9-539922719E83}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FA96E747-D22B-4DA0-8A55-88B117D78436}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1036AD63-AEAC-460B-9060-C96005D4DC86}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE}

 

 

 

~~~ Files

 

Successfully deleted: [File] "C:\Users\Jeff\appdata\local\google\chrome\user data\default\local storage\http_app.mam.conduit.com_0.localstorage"

Successfully deleted: [File] "C:\Users\Jeff\appdata\local\google\chrome\user data\default\local storage\http_app.mam.conduit.com_0.localstorage-journal"

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Folder] "C:\ProgramData\tarma installer"

Successfully deleted: [Folder] "C:\Users\Jeff\appdata\local\apn"

Successfully deleted: [Folder] "C:\Users\Jeff\appdata\local\cre"

Successfully deleted: [Folder] "C:\Users\Jeff\appdata\locallow\boost_interprocess"

Successfully deleted: [Folder] "C:\Users\Jeff\appdata\locallow\conduit"

Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\privacy safeguard"

 

 

 

~~~ Chrome

 

Successfully deleted: [Folder] C:\Users\Jeff\appdata\local\Google\Chrome\User Data\Default\Extensions\geggofhlfbcmanadhknllmlajiafopoh

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\geggofhlfbcmanadhknllmlajiafopoh

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 01/20/2014 at 13:56:59.87

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

I have looked over the log files. None of this information i want to keep, it just slows down my computer like all the toolbars, specifically from my antivirus.The ADR found something called "Conduit" under files. This has been a problem recently for multiple machines. I am not sure where it is coming from but after a google search, i found out its a virus that infects your browsers and adds an extension with out your authorization which installs a search engine to your browser that reroutes your home page and also keeps you from restoring your browser links. I am not sure how harmful this really is or if it slows your machine down, but in any-case its really annoying. I need to find out how i am getting this. Most likely due to a false advertisement to third party program.

 

Here is the ADW log file upon clean up:

 

# AdwCleaner v3.017 - Report created 20/01/2014 at 14:16:45

# Updated 12/01/2014 by Xplode

# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)

# Username : Jeff - JEFF-PC

# Running from : C:\Users\Jeff\Desktop\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

Service Deleted : vToolbarUpdater17.3.0

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar

Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar

Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

[!] Folder Deleted : C:\Users\Jeff\AppData\Local\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Jeff\AppData\Local\Temp\AskSearch

Folder Deleted : C:\Users\Jeff\AppData\LocalLow\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Jeff\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

File Deleted : C:\Users\Jeff\AppData\Local\Temp\Uninstall.exe

File Deleted : C:\Users\Jeff\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage

File Deleted : C:\Users\Jeff\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_fastcontent.conduit.com_0.localstorage-journal

File Deleted : C:\Users\Jeff\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

File Deleted : C:\Users\Jeff\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Mal Updater 2]

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\AVG SafeGuard toolbar

Key Deleted : HKCU\Software\FLEXnet

Key Deleted : HKLM\Software\AVG SafeGuard toolbar

Key Deleted : HKLM\Software\AVG Security Toolbar

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar

Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v11.0.9600.16428

 

 

*************************

 

AdwCleaner[R0].txt - [4111 octets] - [20/01/2014 14:03:01]

AdwCleaner[S0].txt - [3883 octets] - [20/01/2014 14:16:45]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3943 octets] ##########

 

Something else i wanted to note that is important, and this has never happened before on this machine. it only happend after re installed my USB drivers and flashed my bios because i was having some real trouble with USB ports not working correctly. But i get this message upon start up that says "CMOS Checksum Bad" i am promted to press F2 to continue normally. But its still something worth noting.

[Tomk]

Every one of those pieces of garbage programs will slow down your system as they each take a small piece of bandwidth.  Conduit is a notorious one.
 
Let's get some more information with this tool:
 
Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed

[jeff matthews]

MiniToolBox by Farbar  Version: 18-12-2013

Ran by Jeff (administrator) on 20-01-2014 at 16:29:49

Running from "C:\Users\Jeff\Desktop"

Microsoft Windows 7 Ultimate  Service Pack 1 (X64)

Boot Mode: Normal

***************************************************************************

 

========================= Flush DNS: ===================================

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========================= IE Proxy Settings: ============================== 

 

Proxy is not enabled.

No Proxy Server is set.

 

"Reset IE Proxy Settings": IE Proxy Settings were reset.

Hosts file not detected in the default directory

========================= IP Configuration: ================================

 

Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller = Local Area Connection 2 (Connected)

Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller = Local Area Connection (Media disconnected)

 

 

# ----------------------------------

# IPv4 Configuration

# ----------------------------------

pushd interface ipv4

 

reset

set global icmpredirects=enabled

add route prefix=169.254.0.0/16 interface="iftype0_0" nexthop=192.168.0.4 metric=1 publish=Yes

add route prefix=169.254.0.0/16 interface="iftype0_0" nexthop=192.168.0.3 metric=1 publish=Yes

 

 

popd

# End of IPv4 configuration

 

 

 

Windows IP Configuration

 

   Host Name . . . . . . . . . . . . : Jeff-PC

   Primary Dns Suffix  . . . . . . . : 

   Node Type . . . . . . . . . . . . : Hybrid

   IP Routing Enabled. . . . . . . . : No

   WINS Proxy Enabled. . . . . . . . : No

 

Ethernet adapter Local Area Connection 2:

 

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller #2

   Physical Address. . . . . . . . . : 00-1F-BC-08-A6-B5

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

   Link-local IPv6 Address . . . . . : fe80::ac03:939e:579f:eeef%10(Preferred) 

   IPv4 Address. . . . . . . . . . . : 192.168.0.3(Preferred) 

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Lease Obtained. . . . . . . . . . : Monday, January 20, 2014 2:21:05 PM

   Lease Expires . . . . . . . . . . : Tuesday, January 21, 2014 2:21:05 PM

   Default Gateway . . . . . . . . . : 192.168.0.1

   DHCP Server . . . . . . . . . . . : 192.168.0.1

   DHCPv6 IAID . . . . . . . . . . . : 301998012

   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-20-A1-34-00-1F-BC-08-A6-B6

   DNS Servers . . . . . . . . . . . : 192.168.0.1

                                       205.171.2.65

   NetBIOS over Tcpip. . . . . . . . : Enabled

 

Ethernet adapter Local Area Connection:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller

   Physical Address. . . . . . . . . : 00-1F-BC-08-A6-B6

   DHCP Enabled. . . . . . . . . . . : Yes

   Autoconfiguration Enabled . . . . : Yes

 

Tunnel adapter isatap.{0856B52D-EEF6-4D51-B093-6BBDC1B2D636}:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : Microsoft ISATAP Adapter

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

 

Tunnel adapter isatap.{C1EF7029-9604-4B85-AB92-2885865340EB}:

 

   Media State . . . . . . . . . . . : Media disconnected

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

 

Tunnel adapter Teredo Tunneling Pseudo-Interface:

 

   Connection-specific DNS Suffix  . : 

   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface

   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0

   DHCP Enabled. . . . . . . . . . . : No

   Autoconfiguration Enabled . . . . : Yes

   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:44b:92e:c064:607f(Preferred) 

   Link-local IPv6 Address . . . . . : fe80::44b:92e:c064:607f%15(Preferred) 

   Default Gateway . . . . . . . . . : ::

   NetBIOS over Tcpip. . . . . . . . : Disabled

Server:  UnKnown

Address:  192.168.0.1

 

Name:    google.com

Addresses:  2607:f8b0:400a:802::1009

 173.194.33.73

 173.194.33.65

 173.194.33.78

 173.194.33.72

 173.194.33.70

 173.194.33.71

 173.194.33.66

 173.194.33.64

 173.194.33.69

 173.194.33.67

 173.194.33.68

 

 

Pinging google.com [173.194.33.72] with 32 bytes of data:

Reply from 173.194.33.72: bytes=32 time=32ms TTL=57

Reply from 173.194.33.72: bytes=32 time=32ms TTL=57

 

Ping statistics for 173.194.33.72:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 32ms, Maximum = 32ms, Average = 32ms

Server:  UnKnown

Address:  192.168.0.1

 

Name:    yahoo.com

Addresses:  98.139.183.24

 98.138.253.109

 206.190.36.45

 

 

Pinging yahoo.com [206.190.36.45] with 32 bytes of data:

Reply from 206.190.36.45: bytes=32 time=82ms TTL=51

Reply from 206.190.36.45: bytes=32 time=38ms TTL=51

 

Ping statistics for 206.190.36.45:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 38ms, Maximum = 82ms, Average = 60ms

 

Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

 

Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================

Interface List

 10...00 1f bc 08 a6 b5 ......Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller #2

  9...00 1f bc 08 a6 b6 ......Generic Marvell Yukon 88E8057 PCI-E Gigabit Ethernet Controller

  1...........................Software Loopback Interface 1

 11...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter

 14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2

 15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

===========================================================================

 

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0      192.168.0.1      192.168.0.3     10

        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306

  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306

      169.254.0.0      255.255.0.0      192.168.0.4      192.168.0.3     11

      192.168.0.0    255.255.255.0         On-link       192.168.0.3    266

      192.168.0.3  255.255.255.255         On-link       192.168.0.3    266

    192.168.0.255  255.255.255.255         On-link       192.168.0.3    266

        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306

        224.0.0.0        240.0.0.0         On-link       192.168.0.3    266

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

  255.255.255.255  255.255.255.255         On-link       192.168.0.3    266

===========================================================================

Persistent Routes:

  Network Address          Netmask  Gateway Address  Metric

      169.254.0.0      255.255.0.0      192.168.0.4       1

      169.254.0.0      255.255.0.0      192.168.0.3       1

===========================================================================

 

IPv6 Route Table

===========================================================================

Active Routes:

 If Metric Network Destination      Gateway

 15     58 ::/0                     On-link

  1    306 ::1/128                  On-link

 15     58 2001::/32                On-link

 15    306 2001:0:9d38:6ab8:44b:92e:c064:607f/128

                                    On-link

 10    266 fe80::/64                On-link

 15    306 fe80::/64                On-link

 15    306 fe80::44b:92e:c064:607f/128

                                    On-link

 10    266 fe80::ac03:939e:579f:eeef/128

                                    On-link

  1    306 ff00::/8                 On-link

 15    306 ff00::/8                 On-link

 10    266 ff00::/8                 On-link

===========================================================================

Persistent Routes:

  None

========================= Winsock entries =====================================

 

Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)

Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)

Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)

Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)

Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)

Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)

x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)

x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)

x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)

x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)

x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)

x64-Catalog9 01 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 02 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 03 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 04 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

 

========================= Event log errors: ===============================

 

Application errors:

==================

 

System errors:

=============

Error: (01/20/2014 02:23:18 PM) (Source: Service Control Manager) (User: )

Description: The NVIDIA Update Service Daemon service failed to start due to the following error: 

%%1069

 

Error: (01/20/2014 02:23:18 PM) (Source: Service Control Manager) (User: )

Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: 

%%1330

 

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

 

Error: (01/20/2014 02:22:35 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)

Description: There was an error while attempting to read the local hosts file.

 

Error: (01/20/2014 02:22:35 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)

Description: There was an error while attempting to read the local hosts file.

 

Error: (01/20/2014 02:21:18 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)

Description: There was an error while attempting to read the local hosts file.

 

Error: (01/20/2014 02:21:18 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)

Description: There was an error while attempting to read the local hosts file.

 

Error: (01/20/2014 02:21:10 PM) (Source: Microsoft-Windows-DNS-Client) (User: NT AUTHORITY)

Description: There was an error while attempting to read the local hosts file.

 

Error: (01/20/2014 02:20:56 PM) (Source: EventLog) (User: )

Description: The previous system shutdown at 2:18:08 PM on ?1/?20/?2014 was unexpected.

 

 

Microsoft Office Sessions:

=========================

 

=========================== Installed Programs ============================

 

64 Bit HP CIO Components Installer (Version: 6.2.1)

ABBYY FineReader 9.0 Sprint (Version: 9.01.513.58212)

Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.1.2)

Adobe After Effects CS5.5 (Version: 10.5)

Adobe AIR (Version: 2.5.1.17730)

Adobe Anchor Service CS4 (Version: 2.0)

Adobe Bridge CS4 (Version: 3)

Adobe CMaps CS4 (Version: 2.0)

Adobe Community Help (Version: 3.4.980)

Adobe CS4 American English Speech Analysis Models (Version: 1)

Adobe Default Language CS4 (Version: 2.0)

Adobe Device Central CS4 (Version: 2)

Adobe Dynamiclink Support (Version: 1)

Adobe Encore CS4 (Version: 4)

Adobe Encore CS4 Codecs (Version: 4)

Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)

Adobe Extension Manager CS4 (Version: 2.0)

Adobe Flash Player 11 ActiveX (Version: 11.9.900.170)

Adobe Flash Player 11 Plugin (Version: 11.9.900.170)

Adobe Fonts All (Version: 2.0)

Adobe Media Encoder CS4 (Version: 1.0)

Adobe Media Encoder CS4 Additional Exporter (Version: 1.0)

Adobe Media Encoder CS4 Dolby (Version: 1.0)

Adobe Media Encoder CS4 Exporter (Version: 1.0)

Adobe Media Encoder CS4 Importer (Version: 1.0)

Adobe Media Player (Version: 0.0.0)

Adobe Media Player (Version: 1.1)

Adobe OnLocation CS4 (Version: 4)

Adobe Output Module (Version: 2.0)

Adobe PDF Library Files CS4 (Version: 9.0)

Adobe Premiere Pro CS4 (Version: 4)

Adobe Premiere Pro CS4 Functional Content (Version: 4)

Adobe Premiere Pro CS4 Third Party Content (Version: 4)

Adobe Reader XI (11.0.06) (Version: 11.0.06)

Adobe Setup (Version: 2.0)

Adobe Story (Version: 1.0.571)

Adobe Type Support CS4 (Version: 9.0)

Adobe Update Manager CS4 (Version: 6.0.0)

Adobe XMP Panels CS4 (Version: 2.0)

Advertising Center (Version: 0.0.0.1)

Aion

Aiseesoft Total Media Converter

Apple Software Update (Version: 2.1.1.116)

Audacity 2.0.3 (Version: 2.0.3)

Auslogics Disk Defrag (Version: 3.5)

avast! Internet Security (Version: 9.0.2011)

Avidemux 2.5 (Version: 2.5.4.6714)

Camtasia Studio 8 (Version: 8.0.4.1060)

Canon Easy-PhotoPrint EX

Canon Easy-WebPrint EX

Canon IJ Network Scanner Selector EX

Canon IJ Network Tool

Canon MP Navigator EX 5.1

Canon MX510 series MP Drivers

Canon MX510 series On-screen Manual

Canon MX510 series User Registration

Canon My Printer

Canon Solution Menu EX

Canon Speed Dial Utility

CPUID CPU-Z 1.65.0

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

DivX Setup (Version: 2.6.1.9)

DolbyFiles (Version: 0.1)

DVD Decrypter (Remove Only)

DVD Shrink 3.2

DVDFab 9.0.4.2 (27/05/2013)

Elgato Game Capture HD (Version: 1.42.9.524)

ESET Online Scanner v3

EVGA E-LEET TUNING UTILITY 1.06.0

FormatFactory 2.96 (Version: 2.96)

Fraps (remove only)

Google Chrome (Version: 32.0.1700.76)

Google Drive (Version: 1.13.5782.599)

Google Update Helper (Version: 1.3.22.3)

honestech VHS to DVD 5.0 Deluxe (Version: 5.0)

HP Update (Version: 5.002.002.002)

ImagXpress (Version: 7.0.74.0)

Java 7 Update 45 (Version: 7.0.450)

Java Auto Updater (Version: 2.1.9.8)

KCP-0.5.3.3 (Version: 0.5.3.3)

KeePass Password Safe 2.12

magicJack (Version: 2.0.6073.4413)

Mal Updater 2.95

Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)

marvell 61xx (Version: 1.2.0.69)

Marvell Miniport Driver (Version: 10.70.3.3)

Menu Templates - Starter Kit (Version: 9.4.2.0)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Mouse and Keyboard Center (Version: 2.2.173.0)

Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)

Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)

Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)

Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000)

Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000)

Microsoft Silverlight (Version: 5.1.20913.0)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (Version: 10.0.30319)

Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)

Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)

Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)

Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)

Microsoft_VC90_ATL_x86 (Version: 1.00.0000)

Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)

Microsoft_VC90_CRT_x86 (Version: 1.00.0000)

Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)

Microsoft_VC90_MFC_x86 (Version: 1.00.0000)

Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)

Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)

Movie Templates - Starter Kit (Version: 9.4.2.0)

MpcStar 5.3 (Version: 5.3)

MSI Afterburner 2.1.0 (Version: 2.1.0)

MSVCRT Redists (Version: 1.0)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)

NCsoft Launcher (Version: 1.5.19002)

Nero 9 Essentials

Nero BurnRights (Version: 3.4.11.100)

Nero BurnRights Help (Version: 3.4.4.100)

Nero ControlCenter (Version: 9.0.0.1)

Nero CoverDesigner (Version: 4.4.9.100)

Nero CoverDesigner Help (Version: 4.4.9.100)

Nero DiscSpeed (Version: 5.4.11.100)

Nero DiscSpeed Help (Version: 5.4.4.100)

Nero DriveSpeed (Version: 4.4.11.100)

Nero DriveSpeed Help (Version: 4.4.4.100)

Nero Express Help (Version: 9.6.2.101)

Nero InfoTool (Version: 6.4.11.100)

Nero InfoTool Help (Version: 6.4.4.100)

Nero Installer (Version: 4.4.9.0)

Nero Online Upgrade (Version: 1.3.0.0)

Nero ShowTime (Version: 5.4.0.100)

Nero ShowTime (Version: 5.4.13.100)

Nero StartSmart (Version: 9.4.12.100)

Nero StartSmart Help (Version: 9.4.12.100)

Nero Vision (Version: 6.4.12.100)

Nero Vision Help (Version: 6.4.8.100)

NeroExpress (Version: 9.4.17.100)

neroxml (Version: 1.0.0)

NVIDIA 3D Vision Driver 311.06 (Version: 311.06)

NVIDIA Control Panel 311.06 (Version: 311.06)

NVIDIA Graphics Driver 311.06 (Version: 311.06)

NVIDIA HD Audio Driver 1.1.13.1 (Version: 1.1.13.1)

NVIDIA Install Application (Version: 2.1002.108.688)

NVIDIA PhysX (Version: 9.10.0514)

NVIDIA PhysX System Software 9.10.0514 (Version: 9.10.0514)

NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106)

NVIDIA Update 1.11.3 (Version: 1.11.3)

NVIDIA Update Components (Version: 1.11.3)

Orb Runtime libraries (Version: 1.0.0)

Photoshop Camera Raw (Version: 5.0)

PowerISO (Version: 4.7)

Privacy SafeGuard version 1.1 (Version: 1.1)

QuickTime (Version: 7.60.92.0)

Realtek High Definition Audio Driver (Version: 6.0.1.5888)

Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.1.36.0)

SeaTools for Windows (Version: 1.2.0.7)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition

SES Driver (Version: 1.0.0)

Skype™ 6.9 (Version: 6.9.106)

SpeedFan (remove only)

Spybot - Search & Destroy (Version: 1.6.2)

Suite Shared Configuration CS4 (Version: 1.0)

TERA (Version: 1.41)

Total Video Converter 3.71 100812

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition

Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition

Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition

Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition

Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition

USB2.0 VIDBOX NW03, NW06 (Version: 3.0.6)

VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)

Vegas Pro 12.0 (64-bit) (Version: 12.0.367)

Video4YouTube 1.3

VLC media player 2.1.2 (Version: 2.1.2)

Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (03/06/2009 1.0.0008.0) (Version: 03/06/2009 1.0.0008.0)

WinRAR 4.00 (64-bit) (Version: 4.00.0)

x264vfw - H.264/MPEG-4 AVC codec for x64 (remove only)

 

========================= Devices: ================================

 

 

========================= Memory info: ===================================

 

Percentage of memory in use: 15%

Total physical RAM: 16375.12 MB

Available physical RAM: 13842.15 MB

Total Pagefile: 32748.41 MB

Available Pagefile: 30042.81 MB

Total Virtual: 4095.88 MB

Available Virtual: 3967.01 MB

 

========================= Partitions: =====================================

 

1 Drive c: () (Fixed) (Total:931.41 GB) (Free:104.8 GB) NTFS

2 Drive d: (C drive 2) (Fixed) (Total:74.51 GB) (Free:72.79 GB) NTFS

5 Drive g: (WD SmartWare) (CDROM) (Total:0.43 GB) (Free:0 GB) UDF

6 Drive h: (Anime Drive 6) (Fixed) (Total:2794.51 GB) (Free:153.3 GB) NTFS

7 Drive i: (Anime Drive 7) (Fixed) (Total:2794.51 GB) (Free:402.88 GB) NTFS

8 Drive j: (Anime Drive 2) (Fixed) (Total:1862.36 GB) (Free:89.65 GB) NTFS

9 Drive k: (Anime Drive 1) (Fixed) (Total:931.51 GB) (Free:101.18 GB) NTFS

11 Drive m: (Anime Drive 5) (Fixed) (Total:1863.02 GB) (Free:167.48 GB) NTFS

12 Drive n: (Anime Drive 4) (Fixed) (Total:1863.01 GB) (Free:80.63 GB) NTFS

 

========================= Users: ========================================

 

User accounts for \\JEFF-PC

 

Administrator            Guest                    Jeff                     

UpdatusUser              

 

========================= Minidump Files ==================================

 

No minidump file found

 

 

**** End of log ****

 

 

BTW this has very personal information about my machine, i do hope this page is monitored or encrypted or something so no unauthorized users can extract this information from this page.

Edited by jeff matthews, 20 January 2014 - 06:34 PM.

[Tomk]

Yes... this is very specific information about your machine... but I don't know of anything shown that can be beneficial to anyone trying to do you harm. Nothing is encrypted but if you tell me what you are concerned about... I'll edit it out.

Meanwhile... I don't know that it is your main problem.. but your Nvidia driver has been some issue. You might want to have a look at this thread and see if changing drivers helps with your problem.

 

Also, your hardrive is becoming choked.  You should consider deleting anything on it that you don't want or need.

 

Please let me know how you do on the Nvidia driver and also let me know about information in the log you are concerned about.

[jeff matthews]

Mostly my IP configuration and DNS specific settings. If any hacker were to get a hold of that information, they could hijack my computer or even my network right?

 

Are you taking about my C drive being chocked? Or my externals, i do know i have alot of data on my externals and they have been having issues, but i kind of thought that the main was a USB controller, because when i plug them into my laptop they work just fine.

 

I get alot of errors like "you must format your drive" or "this device or driver is not performing correctly" But i kind of rulled out everything, flashed bios, re installed a new chipset and re installed new device drivers for my USB ports. They work fine on my laptop with no issues what so ever, so my conclusion to that is its most likely a hardware issue with the USB controller.

 

Now getting back to the relevant subject at hand. My hard drive, are you saying it has just to much data on it, like i need to delete some stuff? My C drive has around 100 or so gb of free space and its a 1 TB drive. Generally the only way a system OS drive can cause slow downs is when its down to like 100 mb of data left or so i heard. I never ever left it run that low, i always try and keep it above the red zone.

 

Regarding my graphics driver, i don't receive any BSOD crashes but upon bootup it does say "CMOS checksum failed". That refers to the CMOS battery in the motherboard but it happened only after i did the flashing of my bios to correct other issues.

 

So about my infections, does this machine look clean to you then? It was obvious that my machine was staggering and very slow, not just online but opening programs, launching applications, file browsing, etc. Do you think that the Conduit may of caused all this and that my computer is clean now? That is generally what i am trying to repair here is the virus related issues. I want to make sure my drive is clean. I don't think my other problems are related to my computer being really slow but it definitely something i have to look into some time.

Edited by jeff matthews, 20 January 2014 - 09:28 PM.

[Tomk]

I'm talking about your C: drive.  The rule of thumb that I've always worked with is 15% free space is minimum.  While it is true that because of the large size of your drive... you may not need a whole 15% (you've basically got 10%) it's still the right "goal" to strive for.

 

The ip addresses shown are internal.  The only thing I can think of that they could be used by a hacker for is that once he gained access to your network... he would know which computer is yours - though that can be determined very easily without knowing beforehand once he is on the network.  You may have noticed that at many sites (specifically various forums) that there are applets that will "announce" your external IP address (this is your address on the world wide web).  The fact is that any website you visit has access to that information.  For example.  I have a website for my construction company.  www.keetonking.com.  If you went to that site... I would be able to look at the logs and see what IP address accessed my site.  I could use that information to see where you were located... but that doesn't allow me to access your network.

 

It's not just conduit.  You also had Tarma, AVG safeguard, privacy safeguard, ask toolbar, boost, and others.  Each one creates a bit of drag on the system.  However, I'm not finding any viruses or trojans... at least not at this point.  I'd like to try running a couple more scans.

 

Download ComboFix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* IMPORTANT !!! Save ComboFix.exe to your Desktop

 

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.  If you have difficulty properly disabling your protective programs, refer to this link --> http://forums.whatth...ams_t96260.html 
   
• Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix.  If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. CF disconnects your machine from the internet.  The connection is automatically restored before CF completes its run.  If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

 

[jeff matthews]

Sisters, OR huh? Your not that far away from me. I live in GP, OR and we also have a construction company called Chucks Roof Service. It is kind of a local roofing construction business but you'll definitely find it in the yellow pages, been a contractor for around 40 years. Unfortunately our web add is just absolutely terrible, google designed it and i wish i had more experience with web development, if i did i would definitely create a better site.

 

Currently trying to look for some one that doesn't charge that much money to help us create a business website.

 

This is the one we got and as you can see its pretty basic and the information is way outdated. http://chucksroofservice.com/

 

Ok sorry if that was not relevant to the topic at hand, just thought i would point it out since i saw your site.

 

Speaking of the topic at hand. Yeah i was aware of alot of those, some of those tool bars i can't get rid of because its part of avast, and also AVG safeguard, i have no idea where im getting that at, i don't even use AVG. I never have seen "Tarma" before so i am not sure of the potential threat of that.

 

A quick google search shows this http://malwaretips.c...-tarma-a-virus/

This is kind of basically the steps of what we just went through.

 

Well here is the Combofix log:

 

 

ComboFix 14-01-16.03 - Jeff 01/20/2014  22:12:46.1.4 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.16375.13737 [GMT -8:00]

Running from: c:\users\Jeff\Desktop\ComboFix.exe

AV: avast! Internet Security *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

FW: avast! Internet Security *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

SP: avast! Internet Security *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\PrivacySafeGuard\PrIVacysafeguard.dll

c:\users\Jeff\AppData\Local\assembly\tmp

c:\users\Jeff\videos\Video4YouTube_Setup_1.3.exe

c:\windows\wininit.ini

M:\Autorun.inf

.

.

(((((((((((((((((((((((((   Files Created from 2013-12-21 to 2014-01-21  )))))))))))))))))))))))))))))))

.

.

2014-01-21 06:46 . 2014-01-21 06:46 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2014-01-21 06:46 . 2014-01-21 06:46 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-01-20 22:02 . 2014-01-20 22:17 -------- d-----w- C:\AdwCleaner

2014-01-20 21:50 . 2014-01-20 21:50 -------- d-----w- c:\windows\ERUNT

2014-01-17 22:37 . 2014-01-17 22:37 -------- d-----w- c:\program files\Sony

2014-01-17 22:37 . 2014-01-17 22:37 -------- d-----w- c:\program files (x86)\Sony

2014-01-17 21:32 . 2014-01-17 21:32 -------- d-----w- C:\E655_A74

2014-01-17 21:21 . 2014-01-17 21:21 -------- d-----w- c:\users\Jeff\AppData\Local\ElevatedDiagnostics

2014-01-17 11:47 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6F332AE1-BF5C-4C6F-9C1F-9250A7979C2D}\mpengine.dll

2014-01-15 06:18 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys

2014-01-15 06:18 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2014-01-15 06:18 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys

2014-01-15 06:18 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys

2014-01-15 06:18 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys

2014-01-15 06:18 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys

2014-01-15 06:18 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys

2014-01-15 06:18 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys

2014-01-15 06:18 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys

2014-01-08 23:59 . 2014-01-08 23:59 -------- d-----w- c:\program files\Canon

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-01-15 11:01 . 2012-10-30 16:47 86054176 ----a-w- c:\windows\system32\MRT.exe

2014-01-08 22:39 . 2013-04-16 18:53 439648 ----a-w- c:\windows\system32\drivers\aswndisflt.sys

2013-12-20 22:39 . 2013-12-18 22:38 79672 ----a-w- c:\windows\system32\drivers\aswstm.sys

2013-12-18 22:38 . 2013-04-16 18:53 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2013-12-18 22:38 . 2013-04-16 18:53 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-12-18 22:38 . 2012-10-29 23:48 422216 ----a-w- c:\windows\system32\drivers\aswSP.sys

2013-12-18 22:38 . 2012-10-29 23:47 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2013-12-18 22:38 . 2012-10-29 23:47 1034464 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-12-18 22:38 . 2012-10-29 23:47 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-12-18 22:38 . 2012-10-29 23:47 334136 ----a-w- c:\windows\system32\aswBoot.exe

2013-12-18 22:38 . 2012-10-29 23:46 43152 ----a-w- c:\windows\avastSS.scr

2013-12-18 22:38 . 2012-10-29 23:47 28184 ----a-w- c:\windows\system32\drivers\aswKbd.sys

2013-12-11 01:27 . 2012-12-18 19:43 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-12-11 01:27 . 2012-12-18 19:43 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-12-11 01:27 . 2013-12-11 01:27 9293192 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

2013-11-26 11:54 . 2013-12-12 11:02 23183360 ----a-w- c:\windows\system32\mshtml.dll

2013-11-26 10:19 . 2013-12-12 11:02 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2013-11-26 10:18 . 2013-12-12 11:02 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll

2013-11-26 09:48 . 2013-12-12 11:02 66048 ----a-w- c:\windows\system32\iesetup.dll

2013-11-26 09:46 . 2013-12-12 11:02 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll

2013-11-26 09:41 . 2013-12-12 11:02 2764288 ----a-w- c:\windows\system32\iertutil.dll

2013-11-26 09:29 . 2013-12-12 11:02 53760 ----a-w- c:\windows\system32\jsproxy.dll

2013-11-26 09:27 . 2013-12-12 11:02 33792 ----a-w- c:\windows\system32\iernonce.dll

2013-11-26 09:23 . 2013-12-12 11:02 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb

2013-11-26 09:21 . 2013-12-12 11:02 574976 ----a-w- c:\windows\system32\ieui.dll

2013-11-26 09:18 . 2013-12-12 11:02 139264 ----a-w- c:\windows\system32\ieUnatt.exe

2013-11-26 09:18 . 2013-12-12 11:02 111616 ----a-w- c:\windows\system32\ieetwcollector.exe

2013-11-26 09:16 . 2013-12-12 11:02 708608 ----a-w- c:\windows\system32\jscript9diag.dll

2013-11-26 08:57 . 2013-12-12 11:02 218624 ----a-w- c:\windows\system32\ie4uinit.exe

2013-11-26 08:35 . 2013-12-12 11:02 5769216 ----a-w- c:\windows\system32\jscript9.dll

2013-11-26 08:28 . 2013-12-12 11:02 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll

2013-11-26 08:16 . 2013-12-12 11:02 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll

2013-11-26 08:02 . 2013-12-12 11:02 1995264 ----a-w- c:\windows\system32\inetcpl.cpl

2013-11-26 07:48 . 2013-12-12 11:02 12996608 ----a-w- c:\windows\system32\ieframe.dll

2013-11-26 07:32 . 2013-12-12 11:02 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2013-11-26 07:07 . 2013-12-12 11:02 2334208 ----a-w- c:\windows\system32\wininet.dll

2013-11-26 06:40 . 2013-12-12 11:02 1395200 ----a-w- c:\windows\system32\urlmon.dll

2013-11-26 06:34 . 2013-12-12 11:02 817664 ----a-w- c:\windows\system32\ieapfltr.dll

2013-11-26 06:33 . 2013-12-12 11:02 1820160 ----a-w- c:\windows\SysWow64\wininet.dll

2013-11-23 18:26 . 2013-12-12 07:36 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll

2013-11-23 17:47 . 2013-12-12 07:36 465920 ----a-w- c:\windows\system32\WMPhoto.dll

2013-11-20 11:04 . 2013-11-20 11:04 194048 ----a-w- c:\windows\SysWow64\elshyph.dll

2013-11-20 11:04 . 2013-11-20 11:04 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-11-20 11:04 . 2013-11-20 11:04 942592 ----a-w- c:\windows\system32\jsIntl.dll

2013-11-20 11:04 . 2013-11-20 11:04 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-11-20 11:04 . 2013-11-20 11:04 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll

2013-11-20 11:04 . 2013-11-20 11:04 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2013-11-20 11:04 . 2013-11-20 11:04 84992 ----a-w- c:\windows\system32\mshtmled.dll

2013-11-20 11:04 . 2013-11-20 11:04 83968 ----a-w- c:\windows\system32\MshtmlDac.dll

2013-11-20 11:04 . 2013-11-20 11:04 81408 ----a-w- c:\windows\system32\icardie.dll

2013-11-20 11:04 . 2013-11-20 11:04 774144 ----a-w- c:\windows\system32\jscript.dll

2013-11-20 11:04 . 2013-11-20 11:04 77312 ----a-w- c:\windows\system32\tdc.ocx

2013-11-20 11:04 . 2013-11-20 11:04 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2013-11-20 11:04 . 2013-11-20 11:04 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2013-11-20 11:04 . 2013-11-20 11:04 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll

2013-11-20 11:04 . 2013-11-20 11:04 626176 ----a-w- c:\windows\system32\msfeeds.dll

2013-11-20 11:04 . 2013-11-20 11:04 62464 ----a-w- c:\windows\SysWow64\tdc.ocx

2013-11-20 11:04 . 2013-11-20 11:04 62464 ----a-w- c:\windows\system32\pngfilt.dll

2013-11-20 11:04 . 2013-11-20 11:04 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll

2013-11-20 11:04 . 2013-11-20 11:04 61952 ----a-w- c:\windows\SysWow64\iesetup.dll

2013-11-20 11:04 . 2013-11-20 11:04 616104 ----a-w- c:\windows\system32\ieapfltr.dat

2013-11-20 11:04 . 2013-11-20 11:04 548352 ----a-w- c:\windows\system32\vbscript.dll

2013-11-20 11:04 . 2013-11-20 11:04 52224 ----a-w- c:\windows\system32\msfeedsbs.dll

2013-11-20 11:04 . 2013-11-20 11:04 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll

2013-11-20 11:04 . 2013-11-20 11:04 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2013-11-20 11:04 . 2013-11-20 11:04 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-11-20 11:04 . 2013-11-20 11:04 48128 ----a-w- c:\windows\system32\imgutil.dll

2013-11-20 11:04 . 2013-11-20 11:04 454656 ----a-w- c:\windows\SysWow64\vbscript.dll

2013-11-20 11:04 . 2013-11-20 11:04 453120 ----a-w- c:\windows\system32\dxtmsft.dll

2013-11-20 11:04 . 2013-11-20 11:04 413696 ----a-w- c:\windows\system32\html.iec

2013-11-20 11:04 . 2013-11-20 11:04 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll

2013-11-20 11:04 . 2013-11-20 11:04 36352 ----a-w- c:\windows\SysWow64\imgutil.dll

2013-11-20 11:04 . 2013-11-20 11:04 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2013-11-20 11:04 . 2013-11-20 11:04 337408 ----a-w- c:\windows\SysWow64\html.iec

2013-11-20 11:04 . 2013-11-20 11:04 30208 ----a-w- c:\windows\system32\licmgr10.dll

2013-11-20 11:04 . 2013-11-20 11:04 296960 ----a-w- c:\windows\system32\dxtrans.dll

2013-11-20 11:04 . 2013-11-20 11:04 263376 ----a-w- c:\windows\system32\iedkcs32.dll

2013-11-20 11:04 . 2013-11-20 11:04 247808 ----a-w- c:\windows\system32\msls31.dll

2013-11-20 11:04 . 2013-11-20 11:04 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll

2013-11-20 11:04 . 2013-11-20 11:04 243200 ----a-w- c:\windows\system32\webcheck.dll

2013-11-20 11:04 . 2013-11-20 11:04 235520 ----a-w- c:\windows\system32\url.dll

2013-11-20 11:04 . 2013-11-20 11:04 235008 ----a-w- c:\windows\system32\elshyph.dll

2013-11-20 11:04 . 2013-11-20 11:04 195584 ----a-w- c:\windows\system32\msrating.dll

2013-11-20 11:04 . 2013-11-20 11:04 182272 ----a-w- c:\windows\SysWow64\msls31.dll

2013-11-20 11:04 . 2013-11-20 11:04 167424 ----a-w- c:\windows\system32\iexpress.exe

2013-11-20 11:04 . 2013-11-20 11:04 151552 ----a-w- c:\windows\SysWow64\iexpress.exe

2013-11-20 11:04 . 2013-11-20 11:04 147968 ----a-w- c:\windows\system32\occache.dll

2013-11-20 11:04 . 2013-11-20 11:04 143872 ----a-w- c:\windows\system32\wextract.exe

2013-11-20 11:04 . 2013-11-20 11:04 139264 ----a-w- c:\windows\SysWow64\wextract.exe

2013-11-20 11:04 . 2013-11-20 11:04 13824 ----a-w- c:\windows\system32\mshta.exe

2013-11-20 11:04 . 2013-11-20 11:04 135680 ----a-w- c:\windows\system32\iepeers.dll

2013-11-20 11:04 . 2013-11-20 11:04 13312 ----a-w- c:\windows\SysWow64\mshta.exe

2013-11-20 11:04 . 2013-11-20 11:04 13312 ----a-w- c:\windows\system32\msfeedssync.exe

2013-11-20 11:04 . 2013-11-20 11:04 131072 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-11-20 11:04 . 2013-11-20 11:04 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-11-20 11:04 . 2013-11-20 11:04 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2013-11-20 11:04 . 2013-11-20 11:04 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2013-11-20 11:04 . 2013-11-20 11:04 105984 ----a-w- c:\windows\system32\iesysprep.dll

2013-11-20 11:04 . 2013-11-20 11:04 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll

2013-11-20 11:04 . 2013-11-20 11:04 101376 ----a-w- c:\windows\system32\inseng.dll

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"cdloader"="c:\users\Jeff\AppData\Roaming\mjusbsp\cdloader2.exe" [2012-02-01 50592]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-10-02 20472992]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2010-07-09 1548288]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-01-05 413696]

"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-01-03 36760]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-01-03 815512]

"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-18 3764024]

"IJNetworkScannerSelectorEX"="c:\program files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-09-27 439440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

R3 H5xUSB;Roxio GameCAP HD PRO;c:\windows\system32\Drivers\uth5x64.sys;c:\windows\SYSNATIVE\Drivers\uth5x64.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 MSICDSetup;MSICDSetup;e:\cdriver64.sys;e:\CDriver64.sys [x]

R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys;c:\windows\SYSNATIVE\DRIVERS\mv61xx.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]

S1 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys;c:\windows\SYSNATIVE\DRIVERS\aswNdisFlt.sys [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]

S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe;c:\program files\AVAST Software\Avast\afwServ.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S3 ElgatoGC658Y;Elgato Game Capture;c:\windows\system32\Drivers\ElgatoGC658.sys;c:\windows\SYSNATIVE\Drivers\ElgatoGC658.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-01-16 05:25 1211672 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2014-01-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-18 01:27]

.

2014-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-29 22:24]

.

2014-01-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-29 22:24]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1036AD63-AEAC-460B-9060-C96005D4DC86}]

2012-08-08 06:08 105472 ----a-w- c:\program files\PrivacySafeGuard\PrivacySafeGuard-x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-12-18 22:38 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2013-12-06 23:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-07 7940128]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-07 1833504]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-16 499608]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-07-19 2780776]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.0.1 205.171.2.65

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Wow6432Node-HKLM-Run-CanonSolutionMenuEx - c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2014-01-20  22:49:48

ComboFix-quarantined-files.txt  2014-01-21 06:49

.

Pre-Run: 112,471,609,344 bytes free

Post-Run: 112,615,993,344 bytes free

.

- - End Of File - - D4A9599A40C15326C3E5A9CE022937C6

BC50EE3CDA45BDC16DCA3DC7C3AAAB81

 

 

 

 

 

"Video4YouTube_Setup_1.3.exe" is an infection? That was supposed to be a software add on for Sony Vegas. Well i guess that was fake software i downloaded by accident. Is this machine heavily infected?, could this possibly be the reason why alot of my programs particular ones that are CPU intensive crash and could this also be the cause of my capturing devices not working and the streams end up with lag. Just a few things to note that has been going on with my machine.

 

Edited by jeff matthews, 21 January 2014 - 01:01 AM.

[Tomk]

I'm aware of where Grants Pass is.  We actually used to play them in football back when I was in school.  Also, my grandparents lived in Agness.  The quickest way there is to take forest service roads from Grants Pass.

 

Only "web developement" that I've ever done is our site.  It's not really that hard.  Took me a couple weekends to make it.  It's not very fancy but at least it gives us a web presence.

 

the Video4YouTube_Setup_1.3.exe file you had was unsigned and according to Trend Micro contains TROJ_GEN.F47V0811 (whatever that is).  The best I can tell is it can mess with your hosts file.  Trend is the only scanner that picks it up as an infection.  CF wouldn't have targeted it if it had been signed.  It most commonly comes with a hacked version of a program called Vegasaur.

 

You asked about Tarma earlier.  It is adware.  It will sometimes bring popups and can "reroute" you to sites that are not the one you intended to go to.

 

I would not say you are "heavily" infected.  You have a lot of little garbage on there.  From what I'm seeing I'd say that you do a fair amount of downloading from less than pristine sources.  In fact I would say that with that in mind, I'm surprised that we aren't seeing something really nasty in there.

 

I do not believe that all of your problems are malware related.  I'd like you to run one more scan (and it's a long one) and then we'll deal with anything it should find.  After that I think I'll send you over to the windows forum for some tweaking.

 

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
 

• Please go here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option   YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is  checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
 

 

[jeff matthews]

Alright thanks, im glad your taking care of me.

 

Well ESET online scanner i am running right now, its going to be a while because its scanning all of my archives. Its about 2% and it already found 6 infections, all of which is a a variant of "win32downloader.gen" which does not surprise me. Some of these back ups that I have in my directory on my C drive were back ups from previous machines i was working on that was badly infected and i mean really bad, so bad i had to take out the HD of that machine and plug it into my computer in order to back up the users data. I just was not aware that those files has spread through my machine, i guess i should copied the information to one of my externals instead of the C drive.

 

 

Oh i wanted to mention that my IE was corrupted just now after running Combofix, like you said, it changes alot of files and i did notice that, my firewall was not even launching or anything. So i basically had to reboot my machine and everything fixed it self, then i turned off all my firewalls and proceeded to run the ESET online scanner. I used to remember a software that was used before that was similar called "Hyjackthis" that could cause potential damage to your machine if you did not know what you were doing and I used it a long time ago, before this site started switching over to combofix.

 

Yeah i knew something was fishy bout "Video4YouTube_Setup_1.3.exe". Its kind of strange how my avast firewall did not pick it up.  I have a payed version of that as well I need to seriously get my self a better firewall i guess, one that i used to use before was called comodo security, that firewall was not that user friendly but it literally blocked all incoming/outgoing traffic and let you know if any type of malicious software was being transferred to your machine. How ever it was high on CPU resources so my machine was the only one capable of really handling it. But i think its the best firewall i ever used.

 

Apparently i need to some how keep the datafiles from some of these back ups from previous machines and delete the infections as you will probably see on my ESET online scanner. My sister owned a machine and they did alot of illegal downloading activity and used software like kazza, ares, torrents, etc. Her BF actually used alot of that software to download music and what not along time ago. How ever that is not an issue any more since she lives by her self and she only uses the computer for school work and like facebook. But anyways thats why their machine turned out to be so heavily infected and now my machine apparently still has remnants of those infections and i think that might possibly be why i got more infected because of the win32 agents which opens up vulnerabilities in my machine for further adaware, viruses, worms to enter my computer.

 

I also wanted to mention one more thing and i have two machines, and like i said before at the start of this topic, that machine has some of the same similar infections like the Conduit and is showing sighs of similar symptoms so once i am done removing all the infections on this machine, i would like to do the same to our family computer as well. Its probably more infected then this one because of their limited knowledge in computers. How ever not to jump the gun, one thing at a time of course.

 

Well ill post the ESET online scanner log in my next reply and we will work from their. 

Edited by jeff matthews, 21 January 2014 - 02:04 PM.

[Tomk]

Virtually all of the tools we use can be used for good and evil.  While they are invaluable for helping clean up a system... used incorrectly they will turn your computer into an expensive door stop.

 

We will have to wait to see the results of your scans but the type of files that we have been finding on your system are not virus's and do not spread on their own.  They were probably downloaded and then saved.

 

A firewall will not protect you from something you download.  When you tell your system to download a file... it will download it.  This is a major issue with torrent programs.  When you use them you bypass not only the firewall... but your anti-virus and anti-malware programs as well.  The firewall only protects you from non authorized intrusion.  When you download... you authorized it.

[jeff matthews]

Oh i see, btw i was just wanted to mention that this scan has been running for 3 hrs and 56 min and is only at 12% Is that normal? I do have the screen saver activated and i moved the mouse just lightly to see the results of the scan. But that is incredibly slow, at this rate it might take all day and over night to finish.

 

I just wanted to mention of that 12%, 34 infected files were found. Just to name a few:

 

"A varient of WIn32?installercore.D Application"

"Win32/Adware.RK.AP Application"

"A Varient of Win32/Toolbar.Conduit.B Application

"Mutliple Threats"

 

That is kind of all can see right now on the screen because i can't see the results screen obviously until the scan is finished.

 

This must be the go to scanner to really find everything on your machine huh? Not to eradicate the threats but to at least find the malicious infections. It seems like this is a very deep scanner with especially how long it takes.

Edited by jeff matthews, 21 January 2014 - 05:32 PM.

[Tomk]

With the amount of drives you have... that is possible.  We used to use Kaspersky's online scanner and I believe the longest I saw was 27 hours.  Eset is usually 5 to 6 but 12 isn't unusual.  With the amount of files you have to go through I'm thinking it will run until tomorrow morning. 

 

Screensaver should not effect anything.

[jeff matthews]

Oh so this is scanning all my drives? Oh well heck i could of removed some of my externals if i had known that.l Most of those are media drives and i highly doubt they have viruses on them. Anything with software, system files or back ups will have viruses, or even game files. But media is kind of hard for viruses to attach to from what i heard. Anyways i guess its better to be more thorough. It jumped to 31% rather quickly, i think in like 30 min or so its going a bit faster. Its hard to tell i guess but i'll wait till it finishes.

Edited by jeff matthews, 21 January 2014 - 06:37 PM.