WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Ran ComboFix before readng anything about it [Solved]

Started by gvera , Dec 23 2014 12:43 PM

This topic is locked

24 replies to this topic

#1 gvera

New Member

Authentic Member
11 posts

Posted 23 December 2014 - 12:43 PM

Hello, I was using my computer without any antivirus program. Later, I was involved in a job which interferes with lots of spammy sets of websites. Even if I boot my computer, it was slow and videos were not loading, freezing, etc. I decided to clean up my computer and found Combofix and ran it without any supervision.

Luckily, I did not come up with any problems (at least it seems to be). But when I got that report from ComboFix, I realized that I am not the person to be involved with such an advanced program. I found this forum and found this topic in this forum. And did what that super-forum-saver suggested to be done.

Here are my reports and I would be very happy if you could spend your time on this issue. Thank you!

btw, can you suggest me any free anti-virus program to use?

Attached Files

aswMBR.txt 1.94KB 201 downloads
attach.txt 4.92KB 212 downloads
ckfiles.txt 127bytes 208 downloads
dds.txt 18.84KB 225 downloads
ComboFix.txt 18.39KB 211 downloads

Advertisements

Register to Remove

#2 OCD

SuperHelper

Malware Team
5,574 posts

Posted 23 December 2014 - 03:41 PM

Hi gvera,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

Download Farbar Recovery Scan Tool and save to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click and select "Run as Administrator" to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply

=========================

In your next post please provide the following:

checkup.txt
FRST.txt
Addition.txt

gvera likes this

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#3 gvera

New Member

Authentic Member
11 posts

Posted 23 December 2014 - 04:06 PM

checkup.txt

Results of screen317's Security Check version 0.99.93

Windows 7 Service Pack 1 x86 (UAC is enabled)

Internet Explorer 11

``````````````Antivirus/Firewall Check:``````````````

Trend Micro Titanium Internet Security

Antivirus up to date! (On Access scanning disabled!)

`````````Anti-malware/Other Utilities Check:`````````

Trojan Remover 6.9.1

Adobe Flash Player 16.0.0.235

Mozilla Firefox (34.0.5)

Google Chrome (39.0.2171.71)

Google Chrome (39.0.2171.95)

````````Process Check: objlist.exe by Laurent````````

Trend Micro Titanium TiMiniService.exe

Trend Micro Titanium TiResumeSrv.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:

````````````````````End of Log``````````````````````

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-12-2014

Ran by Gizem (administrator) on GIZEMS on 24-12-2014 00:02:06

Running from C:\Users\Gizem\Desktop

Loaded Profile: Gizem (Available profiles: Gizem)

Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: Türkçe (Türkiye)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Atheros) C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe

(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AdminService.exe

(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiMiniService.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe

(Virage Logic Corporation / Sonic Focus) C:\Program Files\ASUS\Sonic Focus\SonicFocusTray.exe

(Atheros Communications) C:\Program Files\Bluetooth Suite\BtvStack.exe

(Atheros Commnucations) C:\Program Files\Bluetooth Suite\AthBtTray.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Google) C:\Users\Gizem\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

() C:\Users\Gizem\Desktop\SecurityCheck.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)

HKLM\...\Run: [ASUSPRP] => C:\Program Files\ASUS\APRP\APRP.EXE [2018032 2011-04-01] (ASUSTek Computer Inc.)

HKLM\...\Run: [ASUSWebStorage] => C:\Program Files\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)

HKLM\...\Run: [VizorHtmlDialog.exe] => C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe [1123664 2010-10-08] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [112632 2010-10-12] (Trend Micro Inc.)

HKLM\...\Run: [Trend Micro Titanium] => C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe [214352 2010-09-17] (Trend Micro Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10783336 2011-07-28] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1563240 2011-07-28] (Realtek Semiconductor)

HKLM\...\Run: [SonicMasterTray] => C:\Program Files\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files\Bluetooth Suite\BtvStack.exe [490656 2011-03-13] (Atheros Communications)

HKLM\...\Run: [AthBtTray] => C:\Program Files\Bluetooth Suite\AthBtTray.exe [302240 2011-03-13] (Atheros Commnucations)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-12-06] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)

HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM\...\Run: [AdobeCS6ServiceManager] => C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)

HKLM\...\Run: [TrojanScanner] => C:\Program Files\Trojan Remover\Trjscan.exe [1791856 2014-10-16] (Simply Super Software)

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\...\Run: [Spotify Web Helper] => C:\Users\Gizem\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-09] (Spotify Ltd)

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\...\Run: [GoogleChromeAutoLaunch_28D3439E4EDEDB79BAE7601786B9BB4F] => C:\Program Files\Google\Chrome\Application\chrome.exe [856904 2014-12-06] (Google Inc.)

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\...\Run: [Spotify] => C:\Users\Gizem\AppData\Roaming\Spotify\spotify.exe [6737976 2014-12-09] (Spotify Ltd)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk

ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files\ASUS\AsusVibe\AsusVibeLauncher.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {CC5FC992-B0AA-47CD-9DC2-83445083CBB8} => C:\Program Files\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt.dll ()

ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {618A47A2-528B-4D9A-AFC8-97D3233511E2} => C:\Program Files\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt.dll ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...d=ie&ar=msnhome

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus.msn.com

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/...rc=IE-SearchBox

SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.co...ng}&rlz=1I7ASUT

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)

Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Tcpip\Parameters: [DhcpNameServer] 5.175.225.188 8.8.8.8

FireFox:

========

FF ProfilePath: C:\Users\Gizem\AppData\Roaming\Mozilla\Firefox\Profiles\uovv3skr.default

FF DefaultSearchEngine: Yandex

FF SelectedSearchEngine: Yandex

FF Homepage: https://ang2.yandex-team.ru/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: ZEON/PDF,version=2.0 -> C:\Program Files\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

FF Plugin HKU\S-1-5-21-2343822359-679096785-2166731952-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Gizem\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKU\S-1-5-21-2343822359-679096785-2166731952-1000: @talk.google.com/O1DPlugin -> C:\Users\Gizem\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKU\S-1-5-21-2343822359-679096785-2166731952-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Gizem\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKU\S-1-5-21-2343822359-679096785-2166731952-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Gizem\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\Gizem\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Gizem\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yandex-tr.xml

FF Extension: mOTP - C:\Users\Gizem\AppData\Roaming\Mozilla\Firefox\Profiles\uovv3skr.default\Extensions\jid1-bx0kNvfJip1nXw@jetpack.xpi [2014-09-28]

FF Extension: Assessor-NG Browser Plugin - C:\Users\Gizem\AppData\Roaming\Mozilla\Firefox\Profiles\uovv3skr.default\Extensions\{76dc4130-0da3-11de-8c30-0800200c9a66}.xpi [2014-09-28]

FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension [2011-04-01]

FF HKU\S-1-5-21-2343822359-679096785-2166731952-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi

FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome:

=======

CHR HomePage: Default -> hxxp://www.google.com/

CHR StartupUrls: Default -> "hxxp://metu.edu.tr/", "hxxp://www.google.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Last.fm free music player) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbncpldmanoknoahidbgmkgobgmhnafh [2014-09-28]

CHR Extension: (Logo Maker) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciojdpgahhgdpmlhnocojjfhkfdmemdh [2014-09-28]

CHR Extension: (ZenMate) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-09-28]

CHR Extension: (AdBlock) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-02]

CHR Extension: (Last.fm Scrobbler) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhinaapppaileiechjoiifaancjggfjm [2014-09-28]

CHR Extension: (Facebook Invite All) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\inmmhkeajgflmokoaaoadgkhhmibjbpj [2014-12-08]

CHR Extension: (Google Cüzdan) - C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-28]

CHR HKLM\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2013-12-06] (Advanced Micro Devices, Inc.) [File not signed]

R2 Atheros Bt&Wlan Coex Agent; C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros) [File not signed]

R2 AtherosSvc; C:\Program Files\Bluetooth Suite\adminservice.exe [68768 2011-03-13] (Atheros Commnucations) [File not signed]

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)

S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

R2 TiMiniService; C:\Program Files\Trend Micro\Titanium\TiMiniService.exe [161104 2010-09-17] (Trend Micro Inc.)

S3 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [64128 2010-11-04] (Advanced Micro Devices)

R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-11-04] (Advanced Micro Devices)

R3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [34976 2011-03-13] (Atheros)

R3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [259232 2011-03-13] (Atheros)

R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2011-03-13] (Atheros)

R3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [175776 2011-03-13] (Atheros)

R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [49312 2011-03-13] (Atheros)

R3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [141088 2011-03-13] (Atheros)

R3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [242336 2011-03-13] (Atheros)

R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [80464 2010-09-17] (Trend Micro Inc.)

R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [189520 2010-09-17] (Trend Micro Inc.)

R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [64080 2010-09-17] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92112 2010-09-17] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

U3 catchme; \??\C:\Users\Gizem\AppData\Local\Temp\catchme.sys [X]

U3 aswMBR; \??\C:\Users\Gizem\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\Gizem\AppData\Local\Temp\aswVmm.sys [X]

U3 mbr; \??\C:\Users\Gizem\AppData\Local\Temp\mbr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 23:58 - 2014-12-24 00:00 - 00021993 _____ () C:\Users\Gizem\Desktop\Addition.txt

2014-12-23 23:56 - 2014-12-24 00:02 - 00019193 _____ () C:\Users\Gizem\Desktop\FRST.txt

2014-12-23 23:56 - 2014-12-24 00:02 - 00000000 ____D () C:\FRST

2014-12-23 23:54 - 2014-12-23 23:54 - 01114112 _____ (Farbar) C:\Users\Gizem\Desktop\FRST.exe

2014-12-23 23:44 - 2014-12-23 23:44 - 00852505 _____ () C:\Users\Gizem\Desktop\SecurityCheck.exe

2014-12-23 20:29 - 2014-12-23 20:29 - 00001985 _____ () C:\Users\Gizem\Desktop\aswMBR.txt

2014-12-23 20:29 - 2014-12-23 20:29 - 00000512 _____ () C:\Users\Gizem\Desktop\MBR.dat

2014-12-23 20:26 - 2014-12-23 20:26 - 05198336 _____ (AVAST Software) C:\Users\Gizem\Desktop\aswMBR.exe

2014-12-23 20:22 - 2014-12-23 20:22 - 00019289 _____ () C:\Users\Gizem\Desktop\dds.txt

2014-12-23 20:22 - 2014-12-23 20:22 - 00005038 _____ () C:\Users\Gizem\Desktop\attach.txt

2014-12-23 20:19 - 2014-12-23 20:19 - 00688992 ____R (Swearware) C:\Users\Gizem\Desktop\dds.com

2014-12-23 20:18 - 2014-12-23 20:18 - 00000127 _____ () C:\Users\Gizem\Desktop\ckfiles.txt

2014-12-23 20:15 - 2014-12-23 20:15 - 00468480 _____ () C:\Users\Gizem\Desktop\CKScanner.exe

2014-12-23 01:34 - 2014-12-23 01:34 - 00018832 _____ () C:\ComboFix.txt

2014-12-23 01:07 - 2014-12-23 01:34 - 00000000 ____D () C:\Qoobox

2014-12-23 01:07 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-12-23 01:07 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-12-23 01:07 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-12-23 01:07 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-12-23 01:07 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-12-23 01:07 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-12-23 01:07 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-12-23 01:07 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-12-23 01:06 - 2014-12-23 01:31 - 00000000 ____D () C:\Windows\erdnt

2014-12-23 00:34 - 2014-12-23 01:05 - 05601641 ____R (Swearware) C:\Users\Gizem\Desktop\ComboFix-14.6.16.1-tamindir.exe

2014-12-23 00:19 - 2014-12-23 00:19 - 00000000 ____D () C:\Users\Gizem\Documents\Simply Super Software

2014-12-23 00:18 - 2014-12-23 00:18 - 00000000 ____D () C:\ProgramData\Simply Super Software

2014-12-23 00:18 - 2014-12-23 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover

2014-12-23 00:18 - 2014-12-23 00:18 - 00000000 ____D () C:\Program Files\Trojan Remover

2014-12-23 00:15 - 2014-12-23 00:16 - 31390952 _____ (Simply Super Software ) C:\Users\Gizem\Downloads\trjsetup691.exe

2014-12-21 22:34 - 2014-12-21 22:47 - 00000000 ____D () C:\Users\Gizem\Downloads\phage display

2014-12-21 21:16 - 2014-12-21 21:16 - 00000000 ___RD () C:\Users\Gizem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices

2014-12-18 16:19 - 2014-12-18 17:52 - 15670644 _____ () C:\Users\Gizem\Downloads\Hyo RX125 dokuman.rar

2014-12-18 15:37 - 2014-12-18 15:48 - 00000000 ____D () C:\Users\Gizem\Desktop\ktm

2014-12-18 14:33 - 2014-12-18 14:49 - 237059106 _____ () C:\Users\Gizem\Downloads\AirDroid_tarafından_indirilen_fotoğraflar (1).zip

2014-12-18 14:11 - 2014-12-13 05:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-12-16 23:45 - 2014-12-23 23:50 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2343822359-679096785-2166731952-1000UA.job

2014-12-16 23:45 - 2014-12-23 23:50 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2343822359-679096785-2166731952-1000Core.job

2014-12-16 23:44 - 2014-12-16 23:44 - 00880784 _____ (Google Inc.) C:\Users\Gizem\Downloads\GoogleVoiceAndVideoSetup.exe

2014-12-13 15:18 - 2014-12-13 15:19 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-12 19:51 - 2014-12-12 20:27 - 00000000 ____D () C:\Users\Gizem\Downloads\rmgo

2014-12-12 19:15 - 2014-12-12 19:15 - 00000000 ____D () C:\Windows\system32\appraiser

2014-12-12 18:57 - 2014-10-18 03:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-12-12 18:57 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2014-12-12 18:57 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe

2014-12-12 18:57 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe

2014-12-12 18:57 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll

2014-12-10 20:54 - 2014-12-10 20:54 - 03981488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe

2014-12-10 19:49 - 2014-12-04 06:38 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2014-12-10 19:49 - 2014-12-04 06:38 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2014-12-10 19:49 - 2014-12-04 06:38 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-12-10 19:49 - 2014-12-04 06:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2014-12-10 19:49 - 2014-12-04 06:38 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-12-10 19:49 - 2014-12-04 06:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2014-12-10 19:49 - 2014-12-04 06:34 - 00873984 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-12-10 19:49 - 2014-12-02 01:28 - 01160872 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2014-12-10 19:49 - 2014-11-22 04:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-12-10 19:49 - 2014-11-22 04:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-12-10 19:49 - 2014-11-22 04:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-12-10 19:49 - 2014-11-22 04:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-12-10 19:49 - 2014-11-22 03:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-12-10 19:49 - 2014-11-22 03:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-12-10 19:49 - 2014-11-22 03:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-12-10 19:49 - 2014-11-22 03:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-12-10 19:49 - 2014-11-22 03:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-12-10 19:49 - 2014-11-22 03:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-12-10 19:49 - 2014-11-22 03:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-12-10 19:49 - 2014-11-22 03:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-12-10 19:49 - 2014-11-22 03:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-12-10 19:49 - 2014-11-22 03:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-12-10 19:49 - 2014-11-22 03:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-12-10 19:49 - 2014-11-11 04:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-12-10 19:49 - 2014-11-11 03:32 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys

2014-12-10 19:48 - 2014-11-27 03:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-12-10 19:48 - 2014-11-22 04:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-12-10 19:48 - 2014-11-22 04:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-12-10 19:48 - 2014-11-22 04:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-12-10 19:48 - 2014-11-22 04:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-12-10 19:48 - 2014-11-22 03:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-12-10 19:48 - 2014-11-22 03:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-12-10 19:48 - 2014-11-22 03:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-12-10 19:48 - 2014-11-22 03:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-12-10 19:48 - 2014-11-22 03:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-12-10 19:48 - 2014-11-22 03:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-12-10 19:48 - 2014-11-22 03:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-12-10 19:48 - 2014-11-22 02:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-12-10 19:48 - 2014-11-22 02:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-12-10 19:47 - 2014-11-08 04:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-12-10 19:47 - 2014-10-30 03:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe

2014-12-10 19:47 - 2014-10-03 03:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll

2014-12-10 19:47 - 2014-10-03 03:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll

2014-12-10 19:47 - 2014-10-03 03:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll

2014-12-10 19:47 - 2014-10-03 03:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll

2014-12-10 19:47 - 2014-10-03 03:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe

2014-12-08 21:26 - 2014-12-08 21:26 - 00407400 _____ () C:\Users\Gizem\Downloads\roger-white_milford.zip

2014-12-08 21:18 - 2014-12-08 22:19 - 161527359 _____ () C:\Users\Gizem\Downloads\rmgo psoter.psd

2014-12-08 21:10 - 2014-12-08 21:10 - 00001167 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk

2014-12-08 21:08 - 2014-12-08 21:08 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk

2014-12-08 21:05 - 2014-12-08 21:08 - 00000000 ____D () C:\Program Files\Adobe

2014-12-08 21:05 - 2014-12-08 21:05 - 00001479 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk

2014-12-08 21:05 - 2014-12-08 21:05 - 00001313 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk

2014-12-08 21:03 - 2014-12-08 21:03 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_btath_hcrp_01009.Wdf

2014-12-08 20:58 - 2014-12-09 08:27 - 00000000 ____D () C:\Users\Gizem\Documents\Bluetooth Folder

2014-12-08 20:58 - 2014-12-08 20:58 - 00000000 ____D () C:\Users\Gizem\AppData\Local\BMExplorer

2014-12-08 20:57 - 2014-12-08 21:07 - 00000000 ____D () C:\Program Files\Common Files\Adobe

2014-12-08 20:56 - 2014-12-08 21:10 - 00000000 ____D () C:\ProgramData\Adobe

2014-12-06 21:42 - 2014-12-08 21:43 - 00000000 ____D () C:\Users\Gizem\Downloads\logolar

2014-12-06 20:17 - 2014-12-17 00:31 - 00000000 ____D () C:\Users\Gizem\AppData\Roaming\Skype

2014-12-06 20:17 - 2014-12-06 20:17 - 00000000 ____D () C:\Users\Gizem\AppData\Local\Skype

2014-12-06 20:16 - 2014-12-06 20:16 - 00002507 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-12-06 20:16 - 2014-12-06 20:16 - 00000000 ___RD () C:\Program Files\Skype

2014-12-06 20:16 - 2014-12-06 20:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-12-06 20:16 - 2014-12-06 20:16 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-12-06 20:15 - 2014-12-06 20:16 - 00000000 ____D () C:\ProgramData\Skype

2014-12-06 20:13 - 2014-12-06 20:13 - 01548384 _____ (Skype Technologies S.A.) C:\Users\Gizem\Downloads\SkypeSetup.exe

2014-12-04 11:56 - 2014-12-04 11:56 - 01788653 _____ () C:\Users\Gizem\Downloads\developmental presentation_figurelabeled.pptx

2014-12-04 10:56 - 2014-12-04 11:55 - 01788529 _____ () C:\Users\Gizem\Downloads\developmental presentation.pptx

2014-11-30 21:24 - 2014-11-30 22:41 - 00011576 _____ () C:\Users\Gizem\Downloads\primer for g prot.xlsx

2014-11-30 15:37 - 2014-11-30 15:37 - 00018944 _____ () C:\Users\Gizem\Downloads\bilgi_formu.xls

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-23 23:54 - 2014-09-28 20:22 - 00000814 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-23 23:34 - 2014-09-28 17:11 - 00001008 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-23 21:12 - 2014-09-29 01:22 - 01935015 _____ () C:\Windows\WindowsUpdate.log

2014-12-23 20:12 - 2014-09-28 17:11 - 00001004 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-23 01:34 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default

2014-12-23 01:34 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public

2014-12-23 01:29 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini

2014-12-23 01:06 - 2014-09-30 19:19 - 00000000 ____D () C:\Users\Gizem\AppData\Roaming\Spotify

2014-12-22 19:41 - 2009-07-14 06:39 - 00061651 _____ () C:\Windows\setupact.log

2014-12-21 21:30 - 2014-10-19 14:29 - 00000000 ____D () C:\Users\Gizem\AppData\Local\CrashDumps

2014-12-21 21:23 - 2009-07-14 06:34 - 00016160 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-21 21:23 - 2009-07-14 06:34 - 00016160 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-21 21:09 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-18 23:35 - 2014-09-30 19:21 - 00000000 ____D () C:\Users\Gizem\AppData\Local\Spotify

2014-12-17 22:00 - 2009-09-10 06:55 - 00667612 _____ () C:\Windows\system32\perfh01F.dat

2014-12-17 22:00 - 2009-09-10 06:55 - 00143348 _____ () C:\Windows\system32\perfc01F.dat

2014-12-17 22:00 - 2009-09-10 02:07 - 01599642 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-16 23:46 - 2014-09-28 19:37 - 00000000 ____D () C:\Users\Gizem\AppData\Roaming\Mozilla

2014-12-16 23:46 - 2014-09-28 17:11 - 00000000 ____D () C:\Users\Gizem\AppData\Local\Google

2014-12-15 20:42 - 2014-09-28 19:36 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-15 10:56 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-12-13 21:17 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache

2014-12-13 13:28 - 2014-09-28 20:18 - 00000000 ____D () C:\Users\Gizem\AppData\Local\Adobe

2014-12-13 13:16 - 2014-11-12 22:14 - 00000000 ____D () C:\Users\Gizem\Documents\sonlab

2014-12-13 12:37 - 2014-09-28 20:22 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-12-13 12:37 - 2014-09-28 20:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-12-13 11:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\tr-TR

2014-12-12 19:15 - 2014-10-06 04:06 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-12-12 19:15 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat

2014-12-12 19:08 - 2014-09-28 17:13 - 00002127 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-12-09 08:29 - 2009-07-14 06:33 - 03813792 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-12-08 22:17 - 2014-09-28 16:48 - 00111672 _____ () C:\Users\Gizem\AppData\Local\GDIPFONTCACHEV1.DAT

2014-12-08 21:24 - 2014-09-28 16:50 - 00000000 ____D () C:\Users\Gizem\AppData\Roaming\Adobe

2014-12-08 20:59 - 2014-09-29 01:36 - 00000000 ____D () C:\ProgramData\Atheros

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-12-15 11:14

==================== End Of Log ============================

Addition.txt is attached.

Attached Files

Addition.txt 21.48KB 243 downloads

#4 OCD

SuperHelper

Malware Team
5,574 posts

Posted 23 December 2014 - 04:31 PM

Hi gvera,

FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

Start
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 
SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
EmptyTemp:
CMD: ipconfig /flushdns
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

AdwCleaner v3: Scan & Clean

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...
Click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a log file report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that log file in your next reply.
A copy of that log file will also be saved in the C:\AdwCleaner folder.

=========================

Junkware Removal Tool

Download Junkware Removal Tool to your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Shut down your protection software now to avoid potential conflicts.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

=========================

In your next post please provide the following:

Fixlog.txt
AdwCleaner[S0].txt
JRT.txt
What symptoms are you experiencing?

gvera likes this

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#5 gvera

New Member

Authentic Member
11 posts

Posted 23 December 2014 - 05:38 PM

Fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2014

Ran by Gizem at 2014-12-24 00:36:41 Run:1

Running from C:\Users\Gizem\Desktop

Loaded Profile: Gizem (Available profiles: Gizem)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =

SearchScopes: HKU\S-1-5-21-2343822359-679096785-2166731952-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

EmptyTemp:

CMD: ipconfig /flushdns

End

*****************

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

"HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.

HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.

"HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

"HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}" => Key deleted successfully.

HKCR\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} => Key not found.

"HKU\S-1-5-21-2343822359-679096785-2166731952-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => Key deleted successfully.

HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.

========= ipconfig /flushdns =========

Windows IP Yap�land�rmas�

DNS ��z�c� �nbelle�i ba�ar�yla temizlendi.

========= End of CMD: =========

EmptyTemp: => Removed 777.1 MB temporary data.

The system needed a reboot.

==== End of Fixlog 00:40:42 ====

AdwCleaner[S0].txt

# AdwCleaner v4.106 - Rapor olusturuldu 24/12/2014 tarihinde 01:04:13

# Guncellendi 21/12/2014 tarafindan Xplode

# Database : 2014-12-21.4 [Live]

# Isletim sistemi : Windows 7 Starter Service Pack 1 (32 bits)

# Kullanici adi : Gizem - GIZEMS

# Adwcleaner konumu : C:\Users\Gizem\Desktop\AdwCleaner.exe

# Tarama turu : Temizle

***** [ Servisler ] *****

***** [ Dosyalar / Klasorler ] *****

Klasor Silindi : C:\ProgramData\Partner

Dosya Silindi : C:\Users\Gizem\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage

***** [ Görevler ] *****

***** [ Kisayollar ] *****

***** [ Registry ] *****

Registry Key Silindi : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh

Registry Key Silindi : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}

Registry Key Silindi : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}

Registry Key Silindi : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}

Registry Key Silindi : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}

Registry Key Silindi : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}

Registry Key Silindi : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}

Registry Key Silindi : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}

Deger Silindi : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]

***** [ Tarayicilar ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v34.0.5 (x86 tr)

-\\ Google Chrome v39.0.2171.95

*************************

AdwCleaner[R0].txt - [2004 octets] - [24/12/2014 00:57:32]

AdwCleaner[S0].txt - [1927 octets] - [24/12/2014 01:04:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1987 octets] ##########

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.0 (11.29.2014:1)

OS: Windows 7 Starter x86

Ran by Gizem on 24.12.2014 at 1:12:22,02

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ FireFox

Emptied folder: C:\Users\Gizem\AppData\Roaming\mozilla\firefox\profiles\uovv3skr.default\minidumps [26 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 24.12.2014 at 1:17:46,58

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE: there are some turkish log reports. in the fixlog it means: "Windos IP configuration. DNS solver memory cahce is succesfully removed"

"Silindi" means "removed."

I may say that the restarting procedure of the computer got faster

But opening programs and videos are slow. Videos are still getting frozen at HD&fulscreen even if the loading bar is full.

#6 OCD

SuperHelper

Malware Team
5,574 posts

Posted 23 December 2014 - 06:10 PM

Hi gvera,

Thank you for the translations. :notworthy:

But opening programs and videos are slow. Videos are still getting frozen at HD&fulscreen even if the loading bar is full.

Can you provide a bit more detail about these issues?
Which programs?
Is it always the same programs having problems?
What browser/s are you viewing the videos in?

Any other information you feel might be relevant.

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#7 gvera

New Member

Authentic Member
11 posts

Posted 25 December 2014 - 03:24 PM

Hello again,

Well, I generally use Chrome to view videos. When they are in HD mode, and fullscreen, the videos are kinda lagging. Everything is frozen at a time including the sound and then it continues. and frozen. it is a torture to watch videos. Still. (Maybe there is a problem about my video card driver :weee: )

Firefox is opening slowly. And sometimes porn pop-ups appear upon clicking on anywhere at a normal webpage. (e.g. fotomaç is a football newspaper in turkey and its official webpage is popping up porn pages in firefox :wall:

And, if I'm done with the "combofixing" of my computer, how and what should I remove from my pc?

By the way, thank you for all your support, really. You were so fast and helpful.

#8 OCD

SuperHelper

Malware Team
5,574 posts

Posted 25 December 2014 - 09:42 PM

Hi gvera,

Please be patient with regards to the tools I ask you to download, we may need to use them again. At the completion, we will remove all the tools and logs.

Do you set these in Firefox?

Firefox Default Search Engine: Yandex
Firefox Selected Search Engine: Yandex
Firefox Homepage: hxxps://ang2.yandex-team.ru/

=========================

Delete cache and other browser data in Chrome

Click the Chrome menu on the browser toolbar.
Select Tools.
Select Clear browsing data.
In the dialogue that appears, select the highlighted check-boxes for the types of information that you want to remove.
- Clear browsing history
- Clear download history
- Empty the cache
- Delete cookies and other site and plug-in data
- Clear saved passwords
- Clear saved Autofill form data
- Clear data from hosted apps
- Deauthorize content licenses
Use the menu at the top to select the amount of data that you want to delete. Select beginning of time to delete everything.
Click Clear browsing data.

=========================

Flush the FireFox Cache
(these directions are specific to Firefox 19, if you have a different version the exact steps might be slightly different)

In Firefox, Options
Select Options
Select Privacy tab
Find the section that reads: You might want to clear your recent history or remove individual cookies
Select clear your recent history
Click the Details drop-down arrow
Make sure a check mark is placed in the following boxes:
- Cookies
- Cache
Next select the Time Range to Clear drop-down menu
Select Everything (this will only delete all the cookies and cache, and will save the other items not selected)
Click Clear Now

=========================

Reboot & Test

Answers about Firefox settings.

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#9 OCD

SuperHelper

Malware Team
5,574 posts

Posted 29 December 2014 - 09:27 AM

Hi gvera,

Just checking in to see if you still need help?

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#10 gvera

New Member

Authentic Member
11 posts

Posted 29 December 2014 - 09:56 AM

Well I did not get an e-mail about the previous reply of yours. I'm going to check and answer in a few hours.

Advertisements

Register to Remove

#11 gvera

New Member

Authentic Member
11 posts

Posted 29 December 2014 - 05:23 PM

Hi again OCD,

It seems like my browsers are clean now. And yes, I have intentionally set those settings in firefox.

#12 OCD

SuperHelper

Malware Team
5,574 posts

Posted 29 December 2014 - 09:44 PM

Hi gvera,

How is the computer running?

Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

FRST.txt

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#13 gvera

New Member

Authentic Member
11 posts

Posted 30 December 2014 - 03:58 AM

Computer seems to be nicely working, no serious problems

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-12-2014

Ran by Gizem (administrator) on GIZEMS on 30-12-2014 11:55:40

Running from C:\Users\Gizem\Desktop

Loaded Profile: Gizem (Available profiles: Gizem)

Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: Türkçe (Türkiye)

Internet Explorer Version 11 (Default browser: IE)