31 replies to this topic

[jeffce]

Ok that looks better.  Oh...please move ComboFix to the Desktop of the infected system.  

 

How is your computer running?

[Fashion Crab]

Hi Jeff

Actually a lot better... The updates are ok and evereything is rolling..

Thanks Jeff for your time and your advices...!!!

[jeffce]

Good to hear and sorry for any delay.

 

When you ran OTL the first time there was a log that you attached to a reply labeled Extras.txt.....Could you actually post that into a reply here please?  

[Fashion Crab]

Yes of course... Altough I couldn't find Extras.txt so I did a scan again according to the instructions you gave me on previous post.

Here is the new one...

 

OTL logfile created on: 21/6/2014 12:40:02 πμ - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = E:\Τα Αρχεία\Anti Malware

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17041)

Locale: 00000408 | Country: Ελλάδα | Language: ELL | Date Format: d/M/yyyy

 

7,69 Gb Total Physical Memory | 5,15 Gb Available Physical Memory | 66,96% Memory free

15,38 Gb Paging File | 12,73 Gb Available in Paging File | 82,81% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 53,49 Gb Total Space | 10,98 Gb Free Space | 20,53% Space Free | Partition Type: NTFS

Drive E: | 931,51 Gb Total Space | 586,71 Gb Free Space | 62,99% Space Free | Partition Type: NTFS

 

Computer Name: NICK-THE-GREEK | User Name: Νίκος | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - C:\Program Files\AVAST Software\Avast\avastui.exe (AVAST Software)

PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

PRC - E:\Τα Αρχεία\Anti Malware\OTL.exe (OldTimer Tools)

PRC - C:\Users\Νίκος\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)

PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

PRC - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe (TeamViewer GmbH)

PRC - C:\Users\Νίκος\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()

PRC - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()

PRC - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)

 

 

========== Modules (No Company Name) ==========

 

MOD - c:\users\3e30~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_0ohwj.dll ()

MOD - C:\Program Files\AVAST Software\Avast\libcef.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll ()

MOD - C:\Users\Νίκος\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()

MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()

MOD - C:\Users\Νίκος\AppData\Roaming\Dropbox\bin\libcef.dll ()

MOD - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\WJWF\WJWF.dll ()

MOD - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\WJWF\WJWF_WPS_WIN7.DLL ()

MOD - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()

MOD - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\DC_WFF.dll ()

MOD - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\nicLan.dll ()

MOD - C:\PROGRA~2\MICROS~3\Office14\1033\GrooveIntlResource.dll ()

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

SRV:64bit: - (NisSrv) -- C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)

SRV:64bit: - (MsMpSvc) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SRV:64bit: - (IEEtwCollectorService) -- C:\windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV - (TeamViewer9) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 

========== Driver Services (SafeList) ==========

 

DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswsnx.sys (AVAST Software)

DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswsp.sys (AVAST Software)

DRV:64bit: - (aswStm) -- C:\Windows\SysNative\drivers\aswstm.sys (AVAST Software)

DRV:64bit: - (aswVmm) -- C:\windows\SysNative\drivers\aswVmm.sys ()

DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)

DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)

DRV:64bit: - (aswRvrt) -- C:\windows\SysNative\drivers\aswRvrt.sys ()

DRV:64bit: - (aswHwid) -- C:\Windows\SysNative\drivers\aswHwid.sys ()

DRV:64bit: - (dc3d) -- C:\Windows\SysNative\drivers\dc3d.sys (Microsoft Corporation)

DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)

DRV:64bit: - (SCDEmu) -- C:\windows\SysNative\drivers\scdemu.sys (Power Software Ltd)

DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)

DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)

DRV:64bit: - (iaStorA) -- C:\Windows\SysNative\drivers\iaStorA.sys (Intel Corporation)

DRV:64bit: - (iaStorF) -- C:\Windows\SysNative\drivers\iaStorF.sys (Intel Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)

DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)

DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)

DRV:64bit: - (asahci64) -- C:\Windows\SysNative\drivers\asahci64.sys (Asmedia Technology)

DRV:64bit: - (ISCT) -- C:\Windows\SysNative\drivers\ISCTD64.sys ()

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes\{75F4C050-6DFA-41C2-AA04-ADD311301896}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE:64bit: - HKLM\..\SearchScopes\{B43E4D8D-4662-40D6-8F64-3A9C0ACE97AF}: "URL" = http://www.google.co...utputEncoding?}

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{75F4C050-6DFA-41C2-AA04-ADD311301896}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKLM\..\SearchScopes\{B43E4D8D-4662-40D6-8F64-3A9C0ACE97AF}: "URL" = http://www.google.co...utputEncoding?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.e-shop.gr [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{75F4C050-6DFA-41C2-AA04-ADD311301896}: "URL" = http://www.bing.com/...Box&FORM=IE11SR

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@wolfram.com/Mathematica: C:\Program Files (x86)\Common Files\Wolfram Research\Browser\9.0.1.4055459\npmathplugin.dll (Wolfram Research, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: http://www.google.gr/

CHR - plugin: Error reading preferences file

CHR - Extension: No name found = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.6_0\

CHR - Extension: No name found = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: No name found = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: No name found = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.34_0\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.35_0\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.35_1\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.37_0\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.1_0\

CHR - Extension: AdBlock = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.3_0\

CHR - Extension: avast! Online Security = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2018.95_0\

CHR - Extension: PDF To Word Converter = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\kijcidehmghliocaelamimgiaiogcjal\1.1.5_0\

CHR - Extension: PDF To Word Converter = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\kijcidehmghliocaelamimgiaiogcjal\1.1.5_1\

CHR - Extension: Ξ ΞΏΟτοφΟλι Google = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Ξ ΞΏΟτοφΟλι Google = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\

CHR - Extension: Ξ ΞΏΟτοφΟλι Google = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_2\

CHR - Extension: Bloxorz = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\phiaicokjaoaobiobphcfkmbeiejdang\1.0.0_0\

CHR - Extension: Bloxorz = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\phiaicokjaoaobiobphcfkmbeiejdang\1.0.0_1\

CHR - Extension: No name found = C:\Users\Νίκος\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2014/06/19 20:13:32 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)

O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [IgfxTray] C:\windows\SysNative\igfxtray.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)

O4 - HKLM..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (CANON INC.)

O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (Power Software Ltd)

O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)

O4 - HKCU..\Run: [GoogleChromeAutoLaunch_571D22E49CCFB829BACD91D4C5AB2D91] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

O4 - HKCU..\Run: [uTorrent] C:\Users\Νίκος\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)

O4 - Startup: C:\Users\Νίκος\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Νίκος\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000 File not found

O8:64bit: - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105 File not found

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{096BE5B1-A0E6-47DD-A7EE-A269EC807FA4}: DhcpNameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DA59D308-BC67-4290-9536-AEB8BDB3CB29}: DhcpNameServer = 127.0.0.1

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\ms-help - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/06/19 20:13:33 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2014/06/16 21:56:40 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe

[2014/06/16 21:56:40 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe

[2014/06/16 21:56:40 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe

[2014/06/16 21:53:09 | 000,000,000 | ---D | C] -- C:\Qoobox

[2014/06/16 21:52:59 | 000,000,000 | ---D | C] -- C:\windows\erdnt

[2014/06/16 21:51:39 | 005,207,168 | R--- | C] (Swearware) -- C:\Users\Νίκος\Desktop\ComboFix.exe

[2014/06/16 00:08:37 | 000,000,000 | ---D | C] -- C:\Users\Νίκος\AppData\Roaming\AVAST Software

[2014/06/16 00:08:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast

[2014/06/16 00:08:06 | 001,039,096 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswsnx.sys.1402866490882

[2014/06/16 00:08:06 | 001,039,096 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswsnx.sys

[2014/06/16 00:08:06 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswsp.sys.1402866490882

[2014/06/16 00:08:06 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswsp.sys

[2014/06/16 00:08:06 | 000,085,328 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswstm.sys

[2014/06/16 00:08:06 | 000,079,184 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswMonFlt.sys

[2014/06/16 00:08:05 | 000,334,648 | ---- | C] (AVAST Software) -- C:\windows\SysNative\aswBoot.exe

[2014/06/16 00:08:05 | 000,093,568 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswRdr2.sys

[2014/06/16 00:08:04 | 000,043,152 | ---- | C] (AVAST Software) -- C:\windows\avastSS.scr

[2014/06/16 00:07:47 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software

[2014/06/15 23:42:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center

[2014/06/15 23:42:38 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Mouse and Keyboard Center

[2014/06/15 23:42:03 | 000,000,000 | ---D | C] -- C:\Users\Νίκος\AppData\Local\Avg2014

[2014/06/15 23:26:16 | 000,000,000 | ---D | C] -- C:\FRST

[2014/06/15 23:12:12 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\windows\SysWow64\sqlite3.dll

[2014/06/15 23:12:02 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/06/15 23:03:17 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\drtxzqnm.sys

[2014/06/15 17:28:46 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\hsjzfvjk.sys

[2014/06/15 17:00:30 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2014/06/15 17:00:30 | 000,000,000 | ---D | C] -- C:\Users\Νίκος\AppData\Local\MFAData

[2014/06/15 17:00:30 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData

[2014/06/15 16:49:49 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\jqaiimcs.sys

[2014/06/14 21:05:52 | 000,000,000 | ---D | C] -- C:\Users\Νίκος\AppData\Roaming\QuickScan

[2014/06/14 20:59:23 | 000,423,240 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\qfphbyli.sys

[2014/06/12 19:57:28 | 000,506,368 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\aepdu.dll

[2014/06/12 19:57:28 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\aeinv.dll

[2014/05/30 23:38:06 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJMIG

[2014/05/27 21:02:26 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJMyPrinter

[2014/05/27 21:02:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Δήλωση χρήστη Canon MG2400 series

[2014/05/27 21:00:59 | 000,000,000 | ---D | C] -- C:\Program Files\Canon

[2014/05/27 21:00:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG2400 series Manual

[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2014/06/21 00:17:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2014/06/21 00:03:00 | 000,001,182 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/06/20 22:55:34 | 000,021,888 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014/06/20 22:55:34 | 000,021,888 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014/06/20 22:54:25 | 001,488,880 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI

[2014/06/20 22:54:25 | 000,653,930 | ---- | M] () -- C:\windows\SysNative\perfh009.dat

[2014/06/20 22:54:25 | 000,606,732 | ---- | M] () -- C:\windows\SysNative\perfh008.dat

[2014/06/20 22:54:25 | 000,121,802 | ---- | M] () -- C:\windows\SysNative\perfc009.dat

[2014/06/20 22:54:25 | 000,110,928 | ---- | M] () -- C:\windows\SysNative\perfc008.dat

[2014/06/20 22:48:45 | 000,001,178 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/06/20 22:48:30 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2014/06/19 20:13:32 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts

[2014/06/19 20:06:47 | 005,207,168 | R--- | M] (Swearware) -- C:\Users\Νίκος\Desktop\ComboFix.exe

[2014/06/16 00:08:18 | 000,001,973 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk

[2014/06/16 00:08:10 | 001,039,096 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswsnx.sys

[2014/06/16 00:08:10 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswsp.sys

[2014/06/16 00:08:10 | 000,085,328 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswstm.sys

[2014/06/16 00:08:04 | 001,039,096 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswsnx.sys.1402866490882

[2014/06/16 00:08:04 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswsp.sys.1402866490882

[2014/06/16 00:08:04 | 000,334,648 | ---- | M] (AVAST Software) -- C:\windows\SysNative\aswBoot.exe

[2014/06/16 00:08:04 | 000,208,416 | ---- | M] () -- C:\windows\SysNative\drivers\aswVmm.sys

[2014/06/16 00:08:04 | 000,093,568 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswRdr2.sys

[2014/06/16 00:08:04 | 000,079,184 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswMonFlt.sys

[2014/06/16 00:08:04 | 000,065,776 | ---- | M] () -- C:\windows\SysNative\drivers\aswRvrt.sys

[2014/06/16 00:08:04 | 000,043,152 | ---- | M] (AVAST Software) -- C:\windows\avastSS.scr

[2014/06/16 00:08:04 | 000,029,208 | ---- | M] () -- C:\windows\SysNative\drivers\aswHwid.sys

[2014/06/15 23:03:17 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\drtxzqnm.sys

[2014/06/15 17:28:46 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\hsjzfvjk.sys

[2014/06/15 16:49:49 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\jqaiimcs.sys

[2014/06/14 22:05:20 | 000,002,124 | ---- | M] () -- C:\Users\Νίκος\Desktop\Microsoft Security Essentials.lnk

[2014/06/14 20:59:23 | 000,423,240 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\qfphbyli.sys

[2014/06/13 01:05:06 | 000,002,196 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/06/08 12:13:05 | 000,506,368 | ---- | M] (Microsoft Corporation) -- C:\windows\SysNative\aepdu.dll

[2014/06/08 12:08:04 | 000,424,448 | ---- | M] (Microsoft Corporation) -- C:\windows\SysNative\aeinv.dll

[2014/06/06 13:32:11 | 000,001,097 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 9.lnk

[2014/05/28 01:20:27 | 000,001,063 | ---- | M] () -- C:\Users\Νίκος\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2014/05/28 01:20:24 | 000,001,031 | ---- | M] () -- C:\Users\Νίκος\Desktop\Dropbox.lnk

[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2014/06/16 21:56:40 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe

[2014/06/16 21:56:40 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe

[2014/06/16 21:56:40 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe

[2014/06/16 21:56:40 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe

[2014/06/16 21:56:40 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe

[2014/06/16 00:08:18 | 000,001,973 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk

[2014/06/16 00:08:06 | 000,208,416 | ---- | C] () -- C:\windows\SysNative\drivers\aswVmm.sys

[2014/06/16 00:08:06 | 000,065,776 | ---- | C] () -- C:\windows\SysNative\drivers\aswRvrt.sys

[2014/06/16 00:08:05 | 000,029,208 | ---- | C] () -- C:\windows\SysNative\drivers\aswHwid.sys

[2014/06/14 22:05:20 | 000,002,124 | ---- | C] () -- C:\Users\Νίκος\Desktop\Microsoft Security Essentials.lnk

[2013/11/24 19:23:44 | 000,001,025 | ---- | C] () -- C:\windows\SysWow64\sysprs7.dll

[2013/11/24 19:23:44 | 000,000,205 | ---- | C] () -- C:\windows\SysWow64\lsprst7.dll

[2013/11/21 18:43:03 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl

[2013/11/21 18:14:48 | 001,458,180 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI

[2013/09/18 10:24:24 | 000,303,104 | ---- | C] () -- C:\windows\SysWow64\igdmd32.dll

[2013/09/18 10:24:23 | 000,180,736 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll

[2013/09/18 10:24:23 | 000,142,848 | ---- | C] () -- C:\windows\SysWow64\igdail32.dll

 

========== ZeroAccess Check ==========

 

[2009/07/14 07:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/03/25 05:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/03/25 05:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 04:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 06:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 04:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 

========== LOP Check ==========

 

[2014/06/16 00:08:37 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\AVAST Software

[2013/12/24 16:27:14 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\BSplayer

[2013/11/22 20:34:44 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\BSplayer Pro

[2013/12/04 21:34:10 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\Canon

[2014/03/10 02:40:49 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\ChessBase

[2014/04/22 03:16:22 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\DAEMON Tools Ultra

[2014/06/20 22:48:54 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\Dropbox

[2014/06/20 22:48:52 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\DropboxMaster

[2014/02/01 04:46:45 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\Guitar Pro 6

[2014/01/16 13:21:35 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\LockAP

[2014/01/05 20:14:29 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\M-Player

[2013/11/25 03:57:06 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\Maple

[2013/11/23 01:31:42 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\PowerISO

[2014/06/14 21:05:55 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\QuickScan

[2014/03/04 10:18:40 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\TeamViewer

[2013/11/24 15:42:49 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\TP-LINK

[2014/06/21 00:40:41 | 000,000,000 | ---D | M] -- C:\Users\Νίκος\AppData\Roaming\uTorrent

 

========== Purity Check ==========

 

 

 

< End of report >

[Fashion Crab]

And the Extra.txt

 

OTL Extras logfile created on: 15/6/2014 5:20:23 μμ - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Νίκος\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17041)

Locale: 00000408 | Country: Ελλάδα | Language: ELL | Date Format: d/M/yyyy

 

7,69 Gb Total Physical Memory | 4,88 Gb Available Physical Memory | 63,48% Memory free

15,38 Gb Paging File | 12,52 Gb Available in Paging File | 81,45% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 53,49 Gb Total Space | 10,80 Gb Free Space | 20,20% Space Free | Partition Type: NTFS

Drive E: | 931,51 Gb Total Space | 592,91 Gb Free Space | 63,65% Space Free | Partition Type: NTFS

 

Computer Name: NICK-THE-GREEK | User Name: Νίκος | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 

========== Security Center Settings ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{7DDACD71-C05B-498C-A3B1-192AD374A0D8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 

"{8319E251-F786-438F-9FE9-C3DA6C9B7D7B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{AADBAAFC-7386-4258-BE87-183DBAFE44B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0973385E-05B9-44D3-9057-BAF87558B61A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{0B5AE48E-0CBA-4399-A4F0-F88BB8B1BCD1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe | 

"{13C03196-A2D5-4BD2-BEDD-4A07EC4F6EEF}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\mathematica.exe | 

"{1E2EC02B-2F83-4C49-ADD7-7C61AA2D02E1}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\mathkernel.exe | 

"{2445038D-17FD-43C8-82B9-A15FAEFE83A2}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\math.exe | 

"{2B3F2863-5325-4E42-B322-AB2D3B67E9C6}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe | 

"{32143D77-C099-427B-820F-ADE959889A8F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{352A6C81-5B03-475F-8C02-48F2BBEECA87}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\mathkernel.exe | 

"{3FA39609-0DBC-4EC7-A8E3-192273C5AC78}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\mathematica.exe | 

"{441881E7-99FB-4CA7-8AB1-02C713B247DF}" = protocol=17 | dir=in | app=c:\users\νίκοσ\appdata\roaming\utorrent\utorrent.exe | 

"{48615B99-F0B3-4517-AB74-BB928DA98D40}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe | 

"{4893BBD2-BC0F-4166-A850-0EF9914050F6}" = protocol=6 | dir=in | app=c:\users\νίκοσ\appdata\roaming\dropbox\bin\dropbox.exe | 

"{5A9CBC6A-D29D-44AF-9E46-639EA40BFBB8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 

"{964BD63B-D6F2-4EF1-901D-AE6903421BAE}" = protocol=6 | dir=in | app=c:\users\νίκοσ\appdata\roaming\utorrent\utorrent.exe | 

"{98955C7B-54F6-4EA5-B68F-C814976D9261}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe | 

"{A3404222-34B2-42FF-885B-208DF749966C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"{BB1C1580-A9D2-40F4-BA0E-B7BC5220113D}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe | 

"{BF9763FD-8AF6-4126-8653-8810F5B0343D}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\8.0\math.exe | 

"{D1190D46-C7B0-4531-89EE-1FD5357F08FF}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer_service.exe | 

"{DC66F79E-7D3B-41AC-BC51-897984224DB6}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe | 

"{E20463AB-697C-4E3E-9841-5C5DD74A3C20}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version9\teamviewer.exe | 

"{EB9F291C-CA82-4293-9C53-3C0097728D29}" = protocol=17 | dir=in | app=c:\users\νίκοσ\appdata\roaming\dropbox\bin\dropbox.exe | 

"{F2FFE558-22B4-4300-822D-CEA7410E4C73}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 

"TCP Query User{30ADB810-E6E3-4D3D-B17B-36D6C799000B}C:\users\νίκος\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\νίκοσ\appdata\roaming\dropbox\bin\dropbox.exe | 

"TCP Query User{7F443298-AF9C-4449-8777-4EB47FCE98B6}C:\program files\maple 16\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 16\jre\bin\maple.exe | 

"TCP Query User{CD3129C3-2D7D-46AF-8726-2BC5F42AD93C}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe | 

"TCP Query User{DB16D2C8-2D08-4793-B484-D4DBDA3AC296}C:\program files\ibm\spss\statistics\20\stats.exe" = protocol=6 | dir=in | app=c:\program files\ibm\spss\statistics\20\stats.exe | 

"TCP Query User{E7A2FFB5-AD66-4729-8B35-1C65A0FE00A8}C:\program files\maple 16\jre\bin\maple.exe" = protocol=6 | dir=in | app=c:\program files\maple 16\jre\bin\maple.exe | 

"TCP Query User{EA885271-AE9A-4D3E-BFCB-A0ED35BF905A}C:\users\νίκος\appdata\roaming\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\users\νίκοσ\appdata\roaming\utorrent\utorrent.exe | 

"UDP Query User{22CBF40F-CE80-49DC-9160-3999E0431CA5}C:\program files\ibm\spss\statistics\20\stats.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\stats.exe | 

"UDP Query User{42129490-C83A-4352-A008-BC4BB54ED3B9}C:\program files\maple 16\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 16\jre\bin\maple.exe | 

"UDP Query User{57E89754-53C7-4E37-8730-A66C9126E065}C:\program files\maple 16\jre\bin\maple.exe" = protocol=17 | dir=in | app=c:\program files\maple 16\jre\bin\maple.exe | 

"UDP Query User{68F45A3C-053A-4FF7-A3CE-22E5986D7BAA}C:\users\νίκος\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\νίκοσ\appdata\roaming\dropbox\bin\dropbox.exe | 

"UDP Query User{CC9FC8B8-1394-46A1-88D3-C1F9F6F2FE80}C:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ibm\spss\statistics\20\jre\bin\javaw.exe | 

"UDP Query User{E5856555-D8A2-46DB-868C-C754D189BCB4}C:\users\νίκος\appdata\roaming\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\users\νίκοσ\appdata\roaming\utorrent\utorrent.exe | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{083808D6-6235-37A8-82C1-98D226EB681F}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60830

"{087B6521-1326-340D-830C-E8CEA1AE55D3}" = Microsoft .NET Framework 4.5.1 (ELL)

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2400_series" = Canon MG2400 series MP Drivers

"{122B909F-9DCF-360E-91E7-0679E033FBE1}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60830

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{409CB30E-E457-4008-9B1A-ED1B9EA21140}" = Intel® Rapid Storage Technology

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523

"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1

"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C775E70-A791-4DA8-BCC3-6AB7136F4484}" = Visual Studio 2012 x64 Redistributables

"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010

"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010

"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010

"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010

"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010

"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010

"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010

"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010

"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010

"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010

"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010

"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010

"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010

"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010

"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010

"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010

"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010

"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010

"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010

"{929FBD26-9020-399B-9A7A-751D61F0B942}" = Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1032" = Microsoft .NET Framework 4.5.1 (Ελληνικά)

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1

"{96714280-14E6-4DF7-BACD-F797C0F17C3D}" = Intel® Rapid Storage Technology

"{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}" = Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{BFAE8D5B-F918-486F-B74E-90762DF11C5C}" = Microsoft Security Client

"{E3047FA0-2D6B-4BD6-8CD4-599955F1CE9D}" = Microsoft Mouse and Keyboard Center

"A-WIN-Extras 9.0.1 4055459_is1" = Mathematica Extras 9.0 (4055459)

"Maple 16" = Maple 16

"Microsoft Mouse and Keyboard Center" = Microsoft Mouse and Keyboard Center

"Microsoft Security Client" = Microsoft Security Essentials

"M-WIN-L 8.0.1 2063990_is1" = Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)

"Office14.PROPLUS" = Microsoft Office Professional Plus 2010

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}" = Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005

"{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel® USB 3.0 eXtensible Host Controller Driver

"{319D91C6-3D44-436C-9F79-36C0D22372DC}" = TP-LINK Wireless Configuration Utility

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11

"{50AF8559-F490-381F-A6E7-06A07DE227DC}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60830

"{5C784162-B9B2-4A32-AF18-3517D602AF33}" = ChessBase 11

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{85467CBC-7A39-33C9-8940-D72D9269B84F}" = Microsoft Visual F# 2.0 Runtime

"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.7523

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1032-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Greek

"{AC76BA86-7AD7-5760-0000-A00000000003}" = Japanese Fonts Support For Adobe Reader X

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F68B404C-0E04-337F-A132-796508EE337A}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60830

"{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}" = Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005

"{FDA7E907-6539-42C1-9721-0239C281B336}" = TP-LINK TL-WN881ND Driver

"Adobe Flash Player ActiveX" = Adobe Flash Player 13 ActiveX

"BSPlayerf" = BS.Player FREE

"Canon MG2400 series On-screen Manual" = Canon MG2400 series On-screen Manual

"Canon My Image Garden" = Canon My Image Garden

"Canon My Image Garden Design Files" = Canon My Image Garden Design Files

"Canon_IJ_Scan_Utility" = Canon IJ Scan Utility

"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program

"CanonMyPrinter" = Canon My Printer

"CanonQuickMenu" = Canon Quick Menu

"Easy-WebPrint EX" = Canon Easy-WebPrint EX

"Google Chrome" = Google Chrome

"Maple 16" = Maple 16

"PowerISO" = PowerISO

"SearchProtect" = Search Protect

"Settings Manager" = Settings Manager

"TeamViewer 9" = TeamViewer 9

"WinRAR archiver" = WinRAR 5.00 (32-bit)

"Δήλωση χρήστη Canon MG2400 series" = Δήλωση χρήστη Canon MG2400 series

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"uTorrent" = µTorrent

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 14/6/2014 6:32:53 πμ | Computer Name = Nick-The-Greek | Source = System Restore | ID = 8193

Description = 

 

Error - 14/6/2014 6:42:56 πμ | Computer Name = Nick-The-Greek | Source = VSS | ID = 12289

Description = 

 

Error - 14/6/2014 6:45:39 πμ | Computer Name = Nick-The-Greek | Source = System Restore | ID = 8193

Description = 

 

Error - 14/6/2014 7:02:59 πμ | Computer Name = Nick-The-Greek | Source = VSS | ID = 12289

Description = 

 

Error - 14/6/2014 7:02:59 πμ | Computer Name = Nick-The-Greek | Source = System Restore | ID = 8193

Description = 

 

Error - 14/6/2014 7:53:48 πμ | Computer Name = Nick-The-Greek | Source = .NET Runtime Optimization Service | ID = 1111

Description = 

 

Error - 14/6/2014 7:53:49 πμ | Computer Name = Nick-The-Greek | Source = .NET Runtime Optimization Service | ID = 1111

Description = 

 

Error - 14/6/2014 9:10:10 πμ | Computer Name = Nick-The-Greek | Source = System Restore | ID = 8193

Description = 

 

Error - 14/6/2014 9:18:20 πμ | Computer Name = Nick-The-Greek | Source = .NET Runtime Optimization Service | ID = 1111

Description = 

 

Error - 14/6/2014 9:18:21 πμ | Computer Name = Nick-The-Greek | Source = .NET Runtime Optimization Service | ID = 1111

Description = 

 

[ System Events ]

Error - 14/6/2014 1:51:56 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070103: Intel Corporation - Graphics Adapter WDDM1.1, Graphics

 Adapter WDDM1.2, Graphics Adapter WDDM1.3 - Intel® HD Graphics 4000.

 

Error - 14/6/2014 1:51:56 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Keyboard - Microsoft Hardware USB Keyboard.

 

Error - 14/6/2014 1:51:56 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Pointing Drawing - Microsoft Hardware

 USB Mouse.

 

Error - 14/6/2014 1:52:16 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070103: Intel Corporation - Graphics Adapter WDDM1.1, Graphics

 Adapter WDDM1.2, Graphics Adapter WDDM1.3 - Intel® HD Graphics 4000.

 

Error - 14/6/2014 1:52:16 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Keyboard - Microsoft Hardware USB Keyboard.

 

Error - 14/6/2014 1:52:16 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Pointing Drawing - Microsoft Hardware

 USB Mouse.

 

Error - 14/6/2014 1:52:46 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Keyboard - Microsoft Hardware USB Keyboard.

 

Error - 14/6/2014 1:54:14 μμ | Computer Name = Nick-The-Greek | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description = Αποτυχία εγκατάστασης: Τα Windows απέτυχαν να εγκαταστήσουν την παρακάτω

 ενημέρωση με σφάλμα 0x80070005: Microsoft - Keyboard - Microsoft Hardware USB Keyboard.

 

Error - 15/6/2014 5:39:00 πμ | Computer Name = Nick-The-Greek | Source = volsnap | ID = 393252

Description = Τα σκιώδη αντίγραφα του τόμου C: ματαιώθηκαν επειδή ο χώρος αποθήκευσης

 σκιωδών αντιγράφων δεν ήταν δυνατό να αυξηθεί εξαιτίας ενός επιβεβλημένου ορίου

 από το χρήστη.

 

Error - 15/6/2014 9:56:40 πμ | Computer Name = Nick-The-Greek | Source = Microsoft Antimalware | ID = 2001

Description = Το %%860 αντιμετώπισε σφάλμα κατά την ενημέρωση υπογραφών.     Νέα έκδοση

 υπογραφής:      Προηγούμενη έκδοση υπογραφής: 1.175.2232.0     Προέλευση ενημέρωσης: %%859

 

Στάδιο

 ενημέρωσης: %%852     Διαδρομή προέλευσης: http://www.microsoft.com     Τύπος υπογραφής: 

%%800     Τύπος ενημέρωσης: %%803     Χρήστης: NT AUTHORITY\SYSTEM     Τρέχουσα έκδοση μηχανισμού:

      Προηγούμενη έκδοση μηχανισμού: 1.1.10600.0     Κωδικός σφάλματος: 0x8024402c     Περιγραφή

 σφάλματος: Παρουσιάστηκε μη αναμενόμενο πρόβλημα κατά τον έλεγχο για ενημερώσεις.

 Για πληροφορίες σχετικά με την εγκατάσταση ή την αντιμετώπιση προβλημάτων ενημερώσεων,

 ανατρέξτε στη Βοήθεια και Υποστήριξη. 

 

 

< End of report >

[jeffce]

Please download Malwarebytes Anti-Malware to your desktop.

• Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
• Once installed, Malwarebytes will ask if you want to Launch Now.  Please select to do so and then Malwarebytes will open and update on its own.  Please allow this to complete.
• If an update is found, it will download and install the latest version.
• Let's be sure to run a Hyper Scan.  Press the Scan tab and then select Hyper Scan.
• Press Scan Now then Skip Update (since we just updated it).
   
       
     
• When the scan is complete, click View Detailed Log, then Export to save the log to your Desktop (name the log MBAM Scan).
• Copy and Paste all of the information in that file to your next reply.

---------------------------
 
ESET Online Scanner
 
Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.
• ----------

[Fashion Crab]

This the MBAM Scan text:

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 22/6/2014

Scan Time: 2:13:02 πμ

Logfile: MBAM Scan.txt

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.06.21.10

Rootkit Database: v2014.06.20.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: II?I?I?I?

 

Scan Type: Hyper Scan

Result: Completed

Objects Scanned: 265189

Time Elapsed: 1 min, 4 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Disabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 1

PUP.Optional.SystemK.A, HKU\S-1-5-21-1672371835-1477520047-1789977004-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SystemK, Quarantined, [f02e17643744b77f87cd6d3cb54d9b65], 

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 3

PUP.Optional.Conduit.A, C:\Users\II?I?I?I?\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_app.mam.vaccint.com_0.localstorage, Quarantined, [ac72bebdaccffc3a2a222c85dd257b85], 

PUP.Optional.Conduit.A, C:\Users\II?I?I?I?\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_app.mam.vaccint.com_0.localstorage-journal, Quarantined, [fc22b1ca0b70aa8cee5ea40d000215eb], 

PUP.Optional.DefaultSearch.A, C:\Users\II?I?I?I?\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (      "startup_urls": [ "http://www.google.gr/", "http://www.default-search.net?sid=476&aid=147&itype=n&ver=12302&tm=324&src=hmp", "http://www.default-search.net?sid=476&aid=147&itype=a&ver=12692&tm=324&src=hmp" ],), Replaced,[c05e8cef4b3031051c44ebc427dd21df]

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

 

 

 

 

This is the ESET Scan:

 

 

 

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe.vir Win32/Conduit.SearchProtect.Q potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.I potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll.vir a variant of Win64/Conduit.SearchProtect.A potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe.vir a variant of Win32/Conduit.SearchProtect.I potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\3E30~1\AppData\Local\Temp\NativeMessaging\CT1750559.crx.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\3E30~1\AppData\Local\Temp\NativeMessaging\CT1750559\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.30.1.2_0\APISupport\APISupport.dll.vir a variant of Win32/Conduit.SearchProtect.P potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.30.1.2_0\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.30.1.2_0\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_0\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_0\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_0\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_1\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_1\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_1\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_2\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_2\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_2\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_3\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_3\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_3\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_4\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_4\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_4\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_5\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_5\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_5\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_6\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_6\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_6\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_7\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_7\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_7\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_8\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_8\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_8\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_9\APISupport\APISupport.dll.vir Win32/Conduit.SearchProtect potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_9\nativeMessaging\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfohacdfdemjkeejihknkmjkabndgkg\10.31.0.526_9\plugins\ChromeApiPlugin.dll.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\NativeMessaging\CT1750559\1_0_2_0\TBMessagingHost.exe.vir a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\?????\AppData\Local\Tbccint\Chrome\CT1750559\CHUninstaller.exe.vir a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\Users\?????\AppData\Local\CRE\edfohacdfdemjkeejihknkmjkabndgkg.crx a variant of Win32/Conduit.SearchProtect.N potentially unwanted application

C:\Users\?????\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IL193WPO\MiniSP[1].dll a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\Users\?????\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QB6AKBHN\SPSetup[1].exe Win32/Conduit.SearchProtect.Q potentially unwanted application

C:\Users\?????\AppData\Local\TB\APISupport\APISupport.dll a variant of Win32/Conduit.SearchProtect.P potentially unwanted application

C:\Users\?????\AppData\Local\TB\APISupport\MiniSP_1.0.2.107\MiniSP.dll a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\Users\?????\AppData\Roaming\PowerISO\Upgrade\PowerISO5-x64.exe Win32/Toolbar.Conduit.R potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-03-30 220012\Backup Files 2014-04-13 190000\Backup files 1.zip Win32/Toolbar.Conduit.R potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-04-20 190000\Backup Files 2014-04-20 190000\Backup files 1.zip Win32/Toolbar.Conduit.R potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-05-16 192358\Backup Files 2014-05-16 192358\Backup files 1.zip Win32/Toolbar.Conduit.R potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-05-16 192358\Backup Files 2014-05-16 192358\Backup files 3.zip a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-05-16 192358\Backup Files 2014-05-26 003903\Backup files 2.zip Win32/Conduit.SearchProtect potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-06-14 211409\Backup Files 2014-06-14 211409\Backup files 1.zip Win32/Toolbar.Conduit.R potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-06-14 211409\Backup Files 2014-06-14 211409\Backup files 2.zip a variant of Win32/Conduit.SearchProtect.P potentially unwanted application

E:\NICK-THE-GREEK\Backup Set 2014-06-14 211409\Backup Files 2014-06-14 211409\Backup files 3.zip a variant of Win32/Toolbar.Conduit.AH potentially unwanted application

E:\?? ??????\???????????\bsplayer266.1075.exe Win32/Toolbar.Conduit.M potentially unwanted application

E:\?? ??????\???????????\PowerISO5-x64.exe Win32/OpenCandy potentially unsafe application

 

 

My computer is running just fine but the ESET results discouraged me a little bit...

Thanks for the help

[jeffce]

The ESET log was not nearly as bad as it looks....however, it seems that ESET was having a bit of difficulty with the words in your file names.  You also have Potentially Unwanted Programs in your backup files that need to be removed.  Are you ok with removing these and then making a whole new set of backups??

[Fashion Crab]

yes these programms I think was installed by a game that I downloaded... ok

If I remove them everything is fine?

[jeffce]

Let's see if we can remove them this way first.....
 
 Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

[Fashion Crab]

The JRT.txt

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by 塦 on ƒ¬ 23/06/2014 at 12:48:29,42

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on ƒ¬ 23/06/2014 at 12:54:32,53

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[jeffce]

ComboFix

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

  ClearJavaCache::
   
  File::
  C:\Users\Νίκος\AppData\Local\CRE\edfohacdfdemjkeejihknkmjkabndgkg.crx 
  C:\Users\Νίκος\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IL193WPO\MiniSP[1].dll 
  C:\Users\Νίκος\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QB6AKBHN\SPSetup[1].exe 
  C:\Users\Νίκος\AppData\Local\TB\APISupport\APISupport.dll 
  C:\Users\Νίκος\AppData\Local\TB\APISupport\MiniSP_1.0.2.107\MiniSP.dll 
  C:\Users\Νίκος\AppData\Roaming\PowerISO\Upgrade\PowerISO5-x64.exe 

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
   
  
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix may request an update; please allow it.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

 

Post the new ComboFix log and let me know what remaining issues you are having with your system.  

[Fashion Crab]

This the report from ComboFix , and about my computer is rolling fine...!!! Thanks

 

ComboFix 14-06-23.01 - Νίκος 23/06/2014  19:25:17.3.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1253.30.1032.18.7874.5444 [GMT 3:00]

Running from: c:\users\Νίκος\Downloads\ComboFix.exe

Command switches used :: c:\users\Νίκος\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\Νίκος\AppData\Local\CRE\edfohacdfdemjkeejihknkmjkabndgkg.crx"

"c:\users\Νίκος\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IL193WPO\MiniSP[1].dll"

"c:\users\Νίκος\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QB6AKBHN\SPSetup[1].exe"

"c:\users\Νίκος\AppData\Local\TB\APISupport\APISupport.dll"

"c:\users\Νίκος\AppData\Local\TB\APISupport\MiniSP_1.0.2.107\MiniSP.dll"

"c:\users\Νίκος\AppData\Roaming\PowerISO\Upgrade\PowerISO5-x64.exe"

.

.

(((((((((((((((((((((((((   Files Created from 2014-05-23 to 2014-06-23  )))))))))))))))))))))))))))))))

.

.

2014-06-23 16:28 . 2014-06-23 16:28 -------- d-----w- c:\users\Guest\AppData\Local\temp

2014-06-23 16:28 . 2014-06-23 16:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-06-23 16:19 . 2014-06-23 16:22 -------- d-----w- c:\users\Νίκος\AppData\Roaming\GetRightToGo

2014-06-23 10:10 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5E7B384-BA7F-4BE1-929E-2FB3687ABC8E}\mpengine.dll

2014-06-23 10:09 . 2014-06-23 10:09 -------- d-----w- c:\program files\Canon

2014-06-23 09:48 . 2014-06-23 09:48 -------- d-----w- c:\windows\ERUNT

2014-06-21 23:26 . 2014-06-21 23:26 -------- d-----w- c:\program files (x86)\ESET

2014-06-21 23:12 . 2014-06-23 16:15 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2014-06-21 23:12 . 2014-06-21 23:12 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware

2014-06-21 23:12 . 2014-06-21 23:12 -------- d-----w- c:\programdata\Malwarebytes

2014-06-21 23:12 . 2014-05-12 04:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys

2014-06-21 23:12 . 2014-05-12 04:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2014-06-21 23:12 . 2014-05-12 04:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys

2014-06-21 22:41 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-06-20 06:01 . 2014-06-20 06:01 -------- d-----w- c:\users\Guest\AppData\Roaming\AVAST Software

2014-06-15 21:08 . 2014-06-15 21:08 -------- d-----w- c:\users\Νίκος\AppData\Roaming\AVAST Software

2014-06-15 21:08 . 2014-06-15 21:08 85328 ----a-w- c:\windows\system32\drivers\aswstm.sys

2014-06-15 21:08 . 2014-06-15 21:08 423240 ----a-w- c:\windows\system32\drivers\aswsp.sys

2014-06-15 21:08 . 2014-06-15 21:08 1039096 ----a-w- c:\windows\system32\drivers\aswsnx.sys

2014-06-15 21:08 . 2014-06-15 21:08 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2014-06-15 21:08 . 2014-06-15 21:08 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2014-06-15 21:08 . 2014-06-15 21:08 208416 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2014-06-15 21:08 . 2014-06-15 21:08 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2014-06-15 21:08 . 2014-06-15 21:08 334648 ----a-w- c:\windows\system32\aswBoot.exe

2014-06-15 21:08 . 2014-06-15 21:08 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys

2014-06-15 21:08 . 2014-06-15 21:08 43152 ----a-w- c:\windows\avastSS.scr

2014-06-15 21:07 . 2014-06-15 21:07 -------- d-----w- c:\program files\AVAST Software

2014-06-15 20:42 . 2014-06-15 20:42 -------- d-----w- c:\program files\Microsoft Mouse and Keyboard Center

2014-06-15 20:42 . 2014-06-15 20:42 -------- d-----w- c:\users\Νίκος\AppData\Local\Avg2014

2014-06-15 20:26 . 2014-06-15 20:48 -------- d-----w- C:\FRST

2014-06-15 20:12 . 2010-08-30 05:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll

2014-06-15 20:12 . 2014-06-16 21:58 -------- d-----w- C:\AdwCleaner

2014-06-15 20:03 . 2014-06-15 20:03 423240 ----a-w- c:\windows\system32\drivers\drtxzqnm.sys

2014-06-15 14:28 . 2014-06-15 14:28 423240 ----a-w- c:\windows\system32\drivers\hsjzfvjk.sys

2014-06-15 14:00 . 2014-06-15 20:42 -------- d-----w- c:\programdata\MFAData

2014-06-15 14:00 . 2014-06-15 14:00 -------- d--h--w- c:\programdata\Common Files

2014-06-15 14:00 . 2014-06-15 14:00 -------- d-----w- c:\users\Νίκος\AppData\Local\MFAData

2014-06-15 13:49 . 2014-06-15 13:49 423240 ----a-w- c:\windows\system32\drivers\jqaiimcs.sys

2014-06-14 18:05 . 2014-06-14 18:05 -------- d-----w- c:\users\Νίκος\AppData\Roaming\QuickScan

2014-06-14 17:59 . 2014-06-14 17:59 423240 ----a-w- c:\windows\system32\drivers\qfphbyli.sys

2014-06-13 19:58 . 2014-05-02 16:09 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CD36F63A-8119-4778-91D1-2106986C2638}\gapaengine.dll

2014-06-12 16:57 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll

2014-06-12 16:57 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll

2014-06-11 15:11 . 2014-06-11 15:11 -------- d-----w- c:\users\Guest\AppData\Local\Adobe

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-06-12 23:16 . 2013-11-23 18:44 95414520 ----a-w- c:\windows\system32\MRT.exe

2014-05-14 18:17 . 2013-11-21 15:47 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-05-14 18:17 . 2013-11-21 15:47 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2014-05-06 04:40 . 2014-05-15 00:01 23544320 ----a-w- c:\windows\system32\mshtml.dll

2014-05-06 04:17 . 2014-05-15 00:01 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2014-05-06 03:07 . 2014-05-15 00:01 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb

2014-05-06 03:00 . 2014-05-15 00:01 84992 ----a-w- c:\windows\system32\mshtmled.dll

2014-05-02 16:09 . 2013-12-19 17:51 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2014-04-12 02:22 . 2014-05-14 19:53 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2014-04-12 02:22 . 2014-05-14 19:53 155072 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2014-04-12 02:19 . 2014-05-14 19:53 29184 ----a-w- c:\windows\system32\sspisrv.dll

2014-04-12 02:19 . 2014-05-14 19:53 136192 ----a-w- c:\windows\system32\sspicli.dll

2014-04-12 02:19 . 2014-05-14 19:53 28160 ----a-w- c:\windows\system32\secur32.dll

2014-04-12 02:19 . 2014-05-14 19:53 1460736 ----a-w- c:\windows\system32\lsasrv.dll

2014-04-12 02:19 . 2014-05-14 19:53 31232 ----a-w- c:\windows\system32\lsass.exe

2014-04-12 02:12 . 2014-05-14 19:53 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2014-04-12 02:10 . 2014-05-14 19:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2013-11-22 15:30 . 2013-11-22 15:27 4188160 ----a-w- c:\program files (x86)\GUT55DE.tmp

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 131248 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 131248 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 131248 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\users\Νίκος\AppData\Roaming\uTorrent\uTorrent.exe" [2014-06-12 1267536]

"GoogleChromeAutoLaunch_571D22E49CCFB829BACD91D4C5AB2D91"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-06-05 860488]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-12-04 291648]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-28 958576]

"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2014-03-11 377368]

"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-06-15 3890208]

"CanonQuickMenu"="c:\program files (x86)\Canon\Quick Menu\CNQMMAIN.EXE" [2013-07-23 1282632]

.

c:\users\Νίκος\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Νίκος\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

TP-LINK Wireless Configuration Utility.lnk - c:\program files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2013-11-24 846848]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R1 MpKslebb8eb5e;MpKslebb8eb5e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{80921F45-E94E-4862-9D4D-383285032197}\MpKslebb8eb5e.sys;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{80921F45-E94E-4862-9D4D-383285032197}\MpKslebb8eb5e.sys [x]

R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys;c:\windows\SYSNATIVE\drivers\asahci64.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Επιθεώρηση δικτύου της Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Υπηρεσία Τεχνολογιών ενεργοποίησης των Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]

S0 iusb3hcs;Πρόγραμμα οδήγησης διακόπτη κεντρικού ελεγκτή Intel® USB 3.0;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]

S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]

S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]

S3 IntcDAud;Ήχος οθόνης Intel®;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 ISCT;Intel® Smart Connect Technology Device Driver;c:\windows\system32\drivers\ISCTD64.sys;c:\windows\SYSNATIVE\drivers\ISCTD64.sys [x]

S3 iusb3hub;Πρόγραμμα οδήγησης διανομέα Intel® USB 3.0;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]

S3 iusb3xhc;Πρόγραμμα οδήγησης επεκτάσιμου κεντρικού ελεγκτή Intel® USB 3.0;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]

S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]

S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMSWISSARMY

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-06-12 22:04 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2014-06-23 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-21 18:17]

.

2014-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-07 17:50]

.

2014-06-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-07 17:50]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2014-06-15 21:08 290888 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 164016 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 164016 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 164016 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-11 02:09 164016 ----a-w- c:\users\Νίκος\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-09-12 391152]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-09-12 768328]

"Persistence"="c:\windows\system32\igfxpers.exe" [2013-09-12 769520]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-10-24 13662936]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1672371835-1477520047-1789977004-1000\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{54739D49-AC03-4C57-9264-C5195596B3A1}"=hex:51,66,7a,6c,4c,1d,38,12,27,9e,60,

   50,31,e2,39,09,ed,72,86,59,50,c8,f7,b5

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.13"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2014-06-23  19:29:56

ComboFix-quarantined-files.txt  2014-06-23 16:29

ComboFix2.txt  2014-06-19 17:14

ComboFix3.txt  2014-06-16 19:04

.

Pre-Run: 9 Κατάλογοι 10.643.382.272 διαθέσιμα byte

Post-Run: 11 Κατάλογοι 10.408.689.664 διαθέσιμα byte

.

- - End Of File - - 3311F4A3D704068D60DBD2D3B972624B

5FB38429D5D77768867C76DCBDB35194

[jeffce]

Providing there are no other malware related problems...
 
IT APPEARS THAT THE LOGS WE HAVE NOW ARE NOW CLEAN!  GREAT JOB!!  
 
This infection appears to have been cleared, but I can not give you any absolute guarantees.  As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
----------
 
The following will implement some cleanup procedures as well as reset System Restore points:
 
Press the Windows key + R and this will open the Run text box.  Copy/paste the following text into the Run box as shown and click OK.
  Combofix /Uninstall
  (Note: There is a space between the ..X and the /U that needs to be there.)
 

----------
 

 AdwCleaner
 
Double click on AdwCleaner.exe to run the tool again.

• Click on the Uninstall button.
• Click Yes when asked are you sure you want to uninstall.
• Both AdwCleaner.exe, its folder and all logs will be removed.
• --------------
  
  
  • Download Delfix from here to remove many of the tools we've used during the cleaning process.
  • Ensure Remove disinfection tools is checked.
    Also place a checkmark next to:
    • Create registry backup
    • Purge system restore
    
  • Click the Run button.
  ----------
   
  Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop. If you did not have Malwarebytes Antimalware before, I would keep it and run it weekly.
  ----------
   
  Here are some tips to reduce the potential for spyware infection in the future:
   
  1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
  2. FireFox  If you use Firefox, I recommend installing the following add-ons to help make your Firefox browser more secure:
  NoScript
  AdBlock Plus 
   
  3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis.  With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.
   
  4. Firewall
  Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly.   **There are firewalls that could be downloaded and used but I would personally only recommend using one of the following below:
  Online Armor Free
  Agnitum Outpost Firewall Free
  Comodo Firewall Free
   
  5. Make sure you keep your Windows OS current.  Windows XP users can visit Windows update  regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems.  Without these you are leaving the back door open.
   
  6. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites.  WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.
   
  7. Finally, I strongly recommend that you read Miekiemoes' great advice How to prevent malware.
   
  Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
  ----------

[Fashion Crab]

Thanks Jeff I believe problem is solved...!!!