Spyware / Malware / Virus Removal

Not sure if PC infected, but.... [Solved]

22 min read

Looking for the outcome? Ask AI

ericjschroeder Topic Starter

Post #1May 3, 2015, 4:43 AM UTC

Here is the aswMBR but when I tried to access the FRST I got an error File not found. My problem is one program that keeps crashing on exit for no apparent reason. Thanks if you can help.

Attachments:

📎aswMBR.txt

Satchfan

Post #2May 4, 2015, 1:15 PM UTC

Hello ericjschroeder and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Can you tell me what you mean by “crashing on exit” and which program it is.

===================================================

Please try downloading FRST from here and save it to your Desktop then try running it again.

If that doesn’t work, download and run it in Safe Mode:

restart your computer.
when the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with the Windows Advanced Boot Options menu
select the option for Safe Mode with Networking using the arrow keys
then press Enter on your keyboard to boot into Safe Mode.

You should then be presented with the Windows Login screen. Log in to Windows and then try downloading/running FRST.

Please insert both logs into your post.

The two logs are FRST.txt and Addition.txt

Satchfan

ericjschroeder

Post #3May 5, 2015, 1:31 AM UTC

Thanks. It does seem like it's only the one program Zoom Player (zplayer.exe) and I even updated to the latest, and tried multiple different video options. They are also investigating, but since it seems to be only me, then it is something on my PC. Here are the files you requested. Here is also the Crash error detail:

Problem signature:

Problem Event Name: APPCRASH

Application Name: zplayer.exe

Application Version: 10.0.0.100

Application Timestamp: 2a425e19

Fault Module Name: ntdll.dll

Fault Module Version: 6.1.7601.18798

Fault Module Timestamp: 5507b3e0

Exception Code: c0000005

Exception Offset: 0002defe

OS Version: 6.1.7601.2.1.0.256.48

Locale ID: 1033

Additional Information 1: e8ad

Additional Information 2: e8adce1c2b9e7be834b4063ac3c53863

Additional Information 3: e8ad

Additional Information 4: e8adce1c2b9e7be834b4063ac3c53863

Attachments:

Satchfan

Post #4May 5, 2015, 11:26 AM UTC last edited May 5, 2015, 11:32 AM UTC

There is no obvious sign of malware on your computer but there are a lot of settings that are not my area of expertise. You may be better starting a topic in our Windows forum but we’ll do a couple more checks to be sure first.

Meanwhile you could look at this topic and see if it sheds any light on your Zoom Player problem.

Did you set up this proxy?

ProxyServer: [.DEFAULT] => http=127.0.0.1:13081

Also, this:

ATTENTION: System Restore is disabled.

Do you know why System Restore should be disabled?

===================================================

Disable Windows Defender

Please disable Windows Defender for now. Apart from the fact that that old version of Windows Defender was useless, it can sometimes prevent some things from being fixed.

open Windows Defender
click on Tools, General Settings
scroll down and uncheck Turn on real-time protection (recommended)
after you uncheck this, click on the Save button and close Windows Defender.

===================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below.

C:\Users\ericjs\en_res.dll
C:\Users\ericjs\es_res.dll
C:\Users\ericjs\fr_res.dll
C:\Users\ericjs\grm_res.dll
C:\Users\ericjs\it_res.dll
C:\Users\ericjs\jp_res.dll
C:\Users\ericjs\mfc80u.dll
C:\Users\ericjs\msvcr80.dll
C:\Users\ericjs\PCPE Setup.exe
C:\Users\ericjs\pt_res.dll
C:\Users\ericjs\ResourceReader.dll
C:\Users\ericjs\ru_res.dll
C:\Users\ericjs\zh_res.dll
C:\Users\ericjs\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwdcujo.dll
C:\Users\ericjs\AppData\Local\Temp\ose00000.exe
C:\Users\ericjs\AppData\Local\Temp\ose00001.exe
C:\Users\ericjs\AppData\Local\Temp\tmpBE3F.exe
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
AlternateDataStreams: C:\Users\Public\DRM:احتضان

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
run FRST64 then click Fix just once and wait
it will create a log (Fixlog.txt); please post it to your reply.

===================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scan” tab, select Threat Scan, then click Scan.
when the scan is complete, if no malicious items are found you can close the program
if malicious items are found be sure that everything is checked and click Quarantine
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with the next post:

Fixlog.txt
Mbam.txt

Satchfan

ericjschroeder

Post #5May 6, 2015, 2:06 AM UTC

Not sure about the proxy server but I set the value to blank in the registry.

I don't know about system restore but I do daily incremental backups, but I re-enabled it anyway.

Here is the FRST fix.txt but when I try to run MBAM it runs for 1 second and gives an error that the scan failed and I can't find any detailed log. I updated the program and DB but when I try to run it, it says there are updates, and then fails again.

Attachments:

📎Fixlog.txt

Satchfan

Post #6May 6, 2015, 6:48 AM UTC

Not sure about the proxy server but I set the value to blank in the registry.

I daresay you were trying to be helpful but I asked you not to make any changes whilst we were working on this: I need to see what is happening at different stages to try and get to the bottom of the problem and making your own changes could disguise problems that may be made by malware. Please don't run anything or make any other changes unless requested. Thanks

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

close all running programs
for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
when the pre-scan is finished, click on Scan
click on Report and copy/paste the content in your next post
NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

Note: please insert it into the post, not attach it.

Satchfan

ericjschroeder

Post #7May 9, 2015, 4:02 AM UTC

Thanks, sorry about the Reg edit. Here's the scan results:

RogueKiller V10.6.2.0 [May 4 2015] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : ericjs [Administrator]

Started from : C:\Users\ericjs\Desktop\RogueKiller.exe

Mode : Scan – Date : 05/08/2015 19:33:32

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 19 ¤¤¤

[Suspicious.Path|VT.Unknown] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | DNS7reminder : "C:\Program Files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking12\Ereg.ini" [7][x][-] -> Found

[Suspicious.Path|Hidden.From.SCM] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\aswMBR (\??\C:\Users\ericjs\AppData\Local\Temp\aswMBR.sys) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\aswMBR (\??\C:\Users\ericjs\AppData\Local\Temp\aswMBR.sys) -> Found

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-933687366-1884772992-1401314039-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-933687366-1884772992-1401314039-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤

[PUM.HomePage][FIREFX:Config] rmkbddfi.default : user_pref("browser.startup.homepage", "https://www.youtube.com/");-> Found

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: Samsung SSD 840 EVO 120GB ATA Device +++++

— User —

[MBR] 35aa09490ddcc8509dce0ba6d932508c

[BSP] 82a8639ab319c3d5491e4663098f9754 : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114469 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 … OK

User = LL2 … OK

+++++ PhysicalDrive1: WDC WD10EZEX-00BN5A0 ATA Device +++++

— User —

[MBR] 8f638b72f1e4152a60e45df7ccf88ac8

[BSP] ed9ba9f9c2577444f56cc121c7df84cb : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 245762048 | Size: 400001 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1064964920 | Size: 433864 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 … OK

User = LL2 … OK

Satchfan

Post #8May 9, 2015, 7:06 AM UTC

Thanks for the log.

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

close all programs
double-click RogueKiller.exe - Windows 7: right-click the program and select Run as Administrator'
after it has completed it's prescan, click on Scan
click on the click on the “Registry” tab
make sure these entries are checked:

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found
[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found
then press the Delete button and post the log it produces.

================================================

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

when finished, it will produce a report
please post the C:\ComboFix.txt log.

Please also remember to include the RogueKiller log.

Satchfan

Satchfan

Post #9May 13, 2015, 10:49 AM UTC last edited May 13, 2015, 10:50 AM UTC

Hi ericjschroeder

It has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you are having problems and still need help.

Thanks

Satchfan

ericjschroeder

Post #10May 13, 2015, 12:34 PM UTC

Sorry, short on time. Here is the first step:

RogueKiller V10.6.2.0 [May 4 2015] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : ericjs [Administrator]

Started from : C:\Users\ericjs\Desktop\RogueKiller.exe

Mode : Delete – Date : 05/13/2015 05:32:01

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 18 ¤¤¤

[Suspicious.Path|Hidden.From.SCM] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\aswMBR (\??\C:\Users\ericjs\AppData\Local\Temp\aswMBR.sys) -> Not selected

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\aswMBR (\??\C:\Users\ericjs\AppData\Local\Temp\aswMBR.sys) -> Not selected

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Replaced (0)

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Replaced (0)

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Replaced (0)

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Replaced (0)

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Deleted

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> ERROR [2]

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> ERROR [2]

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> ERROR [2]

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Not selected

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Not selected

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-933687366-1884772992-1401314039-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-933687366-1884772992-1401314039-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤

[PUM.HomePage][FIREFX:Config] rmkbddfi.default : user_pref("browser.startup.homepage", "https://www.youtube.com/");-> Not selected

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: Samsung SSD 840 EVO 120GB ATA Device +++++

— User —

[MBR] 35aa09490ddcc8509dce0ba6d932508c

[BSP] 82a8639ab319c3d5491e4663098f9754 : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114469 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 … OK

User = LL2 … OK

+++++ PhysicalDrive1: WDC WD10EZEX-00BN5A0 ATA Device +++++

— User —

[MBR] 8f638b72f1e4152a60e45df7ccf88ac8

[BSP] ed9ba9f9c2577444f56cc121c7df84cb : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 245762048 | Size: 400001 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1064964920 | Size: 433864 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 … OK

User = LL2 … OK

============================================

RKreport_SCN_05082015_193328.log - RKreport_SCN_05132015_051225.log

ericjschroeder

Post #11May 13, 2015, 12:49 PM UTC

Part 2: ComboFix 15-05-09.01 - ericjs 05/13/2015 5:39.1.4 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8190.5106 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B} SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\ericjs\Documents\~WRL0001.tmp c:\users\ericjs\Documents\~WRL0004.tmp c:\users\ericjs\Documents\~WRL0005.tmp c:\users\ericjs\Documents\~WRL0006.tmp c:\users\ericjs\Documents\~WRL0686.tmp c:\users\ericjs\Documents\~WRL1665.tmp c:\users\ericjs\Documents\~WRL2098.tmp c:\users\ericjs\Documents\~WRL2445.tmp c:\users\ericjs\Documents\~WRL3231.tmp . . ((((((((((((((((((((((((( Files Created from 2015-04-13 to 2015-05-13 ))))))))))))))))))))))))))))))) . . 2015-05-13 12:44 . 2015-05-13 12:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2015-05-09 02:20 . 2015-05-13 02:29 ——– d—–w- c:\users\ericjs\AppData\Local\CrashDumps 2015-05-09 01:27 . 2015-05-13 07:11 35064 —-a-w- c:\windows\system32\drivers\TrueSight.sys 2015-05-09 01:27 . 2015-05-09 04:02 ——– d—–w- c:\programdata\RogueKiller 2015-05-05 01:21 . 2015-05-06 01:41 ——– d—–w- C:\FRST 2015-04-27 09:38 . 2015-04-27 09:38 75888 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{017A5BB2-CDD9-494A-9716-9EC8F644FD23}\offreg.dll 2015-04-26 20:12 . 2015-04-26 20:12 ——– d—–w- c:\windows\system32\appraiser 2015-04-26 19:32 . 2015-04-04 06:25 12032440 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{017A5BB2-CDD9-494A-9716-9EC8F644FD23}\mpengine.dll 2015-04-26 19:15 . 2015-03-17 05:22 5557696 —-a-w- c:\windows\system32\ntoskrnl.exe 2015-04-26 19:14 . 2015-02-03 03:30 842240 —-a-w- c:\windows\system32\blackbox.dll 2015-04-26 18:55 . 2015-04-26 18:55 ——– d-s—w- c:\windows\system32\GWX 2015-04-26 18:55 . 2015-04-26 18:55 ——– d-s—w- c:\windows\SysWow64\GWX 2015-04-26 18:46 . 2015-04-26 18:46 ——– d—–w- c:\programdata\ATI 2015-04-26 18:45 . 2015-04-26 18:45 ——– d—–w- c:\program files (x86)\AMD AVT . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-05-06 02:02 . 2014-05-20 23:36 129752 —-a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-04-26 20:12 . 2014-06-10 20:26 65536 —-a-w- c:\windows\system32\spu_storage.bin 2015-04-26 19:21 . 2014-03-27 17:40 128913832 —-a-w- c:\windows\system32\MRT.exe 2015-04-16 04:57 . 2014-11-30 12:21 12953567 —-a-w- C:\Install 00-Level Support Files.exe 2015-04-15 03:27 . 2014-04-02 18:08 778416 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2015-04-15 03:27 . 2014-04-02 18:08 142512 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2015-03-17 04:56 . 2015-04-26 19:15 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2015-03-09 23:19 . 2014-08-14 18:42 98216 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2015-02-26 03:25 . 2015-03-12 00:43 3204096 —-a-w- c:\windows\system32\win32k.sys 2015-02-24 11:17 . 2014-03-26 22:13 295552 ——w- c:\windows\system32\MpSigStub.exe 2015-02-20 04:41 . 2015-03-12 00:44 41984 —-a-w- c:\windows\system32\lpk.dll 2015-02-20 04:40 . 2015-03-12 00:44 100864 —-a-w- c:\windows\system32\fontsub.dll 2015-02-20 04:40 . 2015-03-12 00:44 14336 —-a-w- c:\windows\system32\dciman32.dll 2015-02-20 04:40 . 2015-03-12 00:44 46080 —-a-w- c:\windows\system32\atmlib.dll 2015-02-20 04:13 . 2015-03-12 00:44 70656 —-a-w- c:\windows\SysWow64\fontsub.dll 2015-02-20 04:13 . 2015-03-12 00:44 10240 —-a-w- c:\windows\SysWow64\dciman32.dll 2015-02-20 04:13 . 2015-03-12 00:44 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2015-02-20 04:12 . 2015-03-12 00:44 25600 —-a-w- c:\windows\SysWow64\lpk.dll 2015-02-20 03:29 . 2015-03-12 00:44 372224 —-a-w- c:\windows\system32\atmfd.dll 2015-02-20 03:09 . 2015-03-12 00:44 299008 —-a-w- c:\windows\SysWow64\atmfd.dll 2015-02-17 22:26 . 2015-02-17 22:26 1217184 —-a-w- c:\windows\SysWow64\FM20.DLL 2015-02-13 05:22 . 2015-03-12 00:47 14177280 —-a-w- c:\windows\system32\shell32.dll 2009-09-27 16:39 415744 –sh–w- c:\windows\SysWOW64\avisynth.dll 2005-07-14 19:31 32256 –sh–w- c:\windows\SysWOW64\AVSredirect.dll 2004-02-22 17:11 764416 –sh–w- c:\windows\SysWOW64\devil.dll 2014-06-07 00:18 70656 –sh–w- c:\windows\SysWOW64\i420vfw.dll 2004-01-25 07:00 70656 –sh–w- c:\windows\SysWOW64\yv12vfw.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 152544 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Amazon Cloud Player"="c:\users\ericjs\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2014-03-07 3168576] "Spybot-S&D Cleaning"="c:\program files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" [2014-04-25 4566984] "EasyTether"="c:\program files\Mobile Stream\EasyTether\easytthr.exe" [2014-09-02 73728] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AcronisTibMounterMonitor"="c:\program files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe" [2013-01-22 1102184] "BackupAndRecoveryMonitor.exe"="c:\program files (x86)\Acronis\BackupAndRecovery\BackupAndRecoveryMonitor.exe" [2014-02-19 1530496] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-07-06 4086432] "Display"="c:\program files (x86)\APC\PowerChute Personal Edition\DataCollectionLauncher.exe" [2012-01-24 284024] "ISUSPM"="c:\programdata\FLEXnet\Connect\11\\isuspm.exe" [2011-10-13 2068856] "DNS7reminder"="c:\program files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe" [2010-10-27 328992] "SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2014-04-25 4101584] "EaseUS EPM tray"="c:\program files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\EpmNews.exe" [2014-03-07 2086568] "EaseUS EPM Tray Agent"="c:\program files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\TrayPopupE\TrayTipAgentE.exe" [2014-02-13 254024] "EaseUs Watch"="c:\program files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe" [2013-09-04 70728] "EaseUs Tray"="c:\program files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe" [2013-09-04 1372232] "EaseUs TB Tray Agent"="c:\program files (x86)\EaseUS\TrayPopup\TrayTipAgent.exe" [2013-09-04 253512] "Raptr"="c:\program files (x86)\Raptr\raptrstub.exe" [2015-03-25 55568] "CheckNDISPortf1ac19"="c:\program files (x86)\Hostless Modem\Mobile Hotspot Admin\CheckNDISPort_df.exe" [2014-05-04 465664] "CancelAutoPlay_df"="c:\program files (x86)\Hostless Modem\Mobile Hotspot Admin\CancelAutoPlay_df.exe" [2014-05-04 448256] "StartCCC"="c:\program files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-11-21 767176] . c:\users\ericjs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\ericjs\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-4-13 43376600] MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2014-8-3 576000] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ APC UPS Status.lnk - c:\program files (x86)\APC\PowerChute Personal Edition\Display.exe [2012-1-24 271736] Bluetooth.lnk - c:\program files\ASUS\Bluetooth Software\BTTray.exe [2012-12-6 1393528] Macro Express 3.lnk - c:\program files (x86)\Macro Express3\MacExp.exe [2014-9-21 4669592] UltraMon.lnk - c:\windows\Installer\{9069EE0A-7615-4D86-AD80-CA263E936DA6}\IcoUltraMon.ico /auto [2014-3-26 29310] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\ASUS\Bluetooth Software\BtwProximityCP.dll . R2 AcronisAgent;Acronis Remote Agent Service;c:\program files (x86)\Common Files\Acronis\Agent\agent.exe;c:\program files (x86)\Common Files\Acronis\Agent\agent.exe [x] R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x] R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x] R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x] R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;g:\bitcomet\tools\BitCometService.exe;g:\bitcomet\tools\BitCometService.exe [x] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 aswRvrt;avast! Revert; [x] S0 aswVmm;avast! VM Monitor; [x] S0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys;c:\windows\SYSNATIVE\drivers\eubakup.sys [x] S0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys;c:\windows\SYSNATIVE\drivers\EUBKMON.sys [x] S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x] S0 tib;Acronis TIB Manager;c:\windows\system32\DRIVERS\tib.sys;c:\windows\SYSNATIVE\DRIVERS\tib.sys [x] S0 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x] S1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys;c:\windows\SYSNATIVE\drivers\eudskacs.sys [x] S1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys;c:\windows\SYSNATIVE\drivers\EuFdDisk.sys [x] S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x] S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [x] S2 amdacpksd;ACP Kernel Service Driver;c:\windows\system32\drivers\amdacpksd.sys;c:\windows\SYSNATIVE\drivers\amdacpksd.sys [x] S2 amdacpusrsvc;ACP User Service;c:\program files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe;c:\program files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe [x] S2 AODDriver4.3;AODDriver4.3;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [x] S2 APC Data Service;APC Data Service;c:\program files (x86)\APC\PowerChute Personal Edition\dataserv.exe;c:\program files (x86)\APC\PowerChute Personal Edition\dataserv.exe [x] S2 ARSM;Acronis Removable Storage Management Service;c:\program files (x86)\Acronis\ARSM\arsm.exe;c:\program files (x86)\Acronis\ARSM\arsm.exe [x] S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x] S2 DragonSvc;Dragon Service;c:\program files (x86)\Common Files\Nuance\dgnsvc.exe;c:\program files (x86)\Common Files\Nuance\dgnsvc.exe [x] S2 EaseUS Agent;EaseUS Agent Service;c:\program files (x86)\EaseUS\Todo Backup\bin\Agent.exe;c:\program files (x86)\EaseUS\Todo Backup\bin\Agent.exe [x] S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x] S2 Guard Agent;Guard Agent Service;c:\program files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe;c:\program files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [x] S2 MMS;Acronis Managed Machine Service;c:\program files (x86)\Acronis\BackupAndRecovery\mms.exe;c:\program files (x86)\Acronis\BackupAndRecovery\mms.exe [x] S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x] S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [x] S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe;c:\program files\Tablet\Wacom\WTabletServicePro.exe [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x] S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x] S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] S3 easytether;easytether;c:\windows\system32\DRIVERS\easytthr.sys;c:\windows\SYSNATIVE\DRIVERS\easytthr.sys [x] S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x] S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x] S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x] S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - AMDACPKSD *NewlyCreated* - ASWMBR *Deregistered* - aswMBR . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-04-30 04:49 988488 —-a-w- c:\program files (x86)\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2015-05-13 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-02 03:27] . 2015-05-13 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-933687366-1884772992-1401314039-1001.job - c:\program files (x86)\Citrix\GoToMeeting\2553\g2mupdate.exe [2015-04-24 03:52] . 2015-05-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-26 22:06] . 2015-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-26 22:06] . 2015-05-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933687366-1884772992-1401314039-1001Core.job - c:\users\ericjs\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-01 01:53] . 2015-05-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-933687366-1884772992-1401314039-1001UA.job - c:\users\ericjs\AppData\Local\Google\Update\GoogleUpdate.exe [2015-04-01 01:53] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-02-11 01:12 185824 —-a-w- c:\users\ericjs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-07-06 19:04 634872 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2014-02-19 395496] "TrayMonitor.exe"="c:\program files (x86)\Acronis\TrayMonitor\TrayMonitor.exe" [2014-02-19 1497440] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = https://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <-loopback> IE: &D&ownload &with BitComet - g:\bitcomet\BitComet.exe/AddLink.htm IE: &D&ownload all with BitComet - g:\bitcomet\BitComet.exe/AddAllLink.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\rmkbddfi.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxps://www.youtube.com/ . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run- - (no file) Notify-SDWinLogon - SDWinLogon.dll HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start HKLM-Run-RidSpywareShield - c:\program files (x86)\Rid Spyware\RidSpywareShield.exe HKLM-Run-RidSpywareUpdater - c:\program files (x86)\Rid Spyware\RidSpywareUpdate.exe AddRemove-MetaTrader 4 FinFX SignalTrader - c:\program files (x86)\MetaTrader 4 FinFX SignalTrader\uninstall.exe AddRemove-{AEFF9E60-3E93-41EE-9895-311F7D1C5FFD} - c:\windows\system32\SupportAppPBHostless Modem\Setup.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.17" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2015-05-13 05:46:19 ComboFix-quarantined-files.txt 2015-05-13 12:46 . Pre-Run: 8,510,672,896 bytes free Post-Run: 8,091,459,584 bytes free . - - End Of File - - DBCE706929BD1EE1E4A5004797E7C370 A36C5E4F47E84449FF07ED3517B43A31

Satchfan

Post #12May 13, 2015, 2:20 PM UTC

Thanks for replying. I'll check this and get back later.

Satchfan

Post #13May 14, 2015, 9:29 AM UTC last edited May 14, 2015, 9:30 AM UTC

Spybot Search & Destroy

We no longer recommend this product because of its poor results in testing, therefore I suggest that you uninstall it.

If you don't want to uninstall it then please at least disable Tea Timer while you carry out the rest of my instructions: you can re-enable it when we are finished. Instructions for disabling TeaTimer are here.

If you do decide to uninstall the program, first “Undo” your immunization before uninstalling. You can do that under “Immunization”, by clicking the Undo Immunization button.

===================================================

Run Zoek

Download zoek.exe to your Desktop:

Important : Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.

on Windows Vista, 7, and 8, right-click Zoek.exe and select: Run as Administrator
give it a few seconds to appear
copy/paste the entire script inside the codebox below into the input field of Zoek:
```
resetIEproxy;
iedefaults;
autoclean;
```
close any open programs.
click the Run script button, and wait. It takes a few minutes to run.
when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
if a reboot is needed, the log will be opened after the reboot.

===================================================

Please try to update and run Malwarebytes again and send that log also.

Satchfan

ericjschroeder

Post #14May 14, 2015, 11:26 PM UTC

I don't see a link to disable TeaTimer so I tried Exiting S&D. Here is Zoek:

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by ericjs on Thu 05/14/2015 at 12:52:57.47.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\ericjs\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

5/14/2015 12:53:44 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\eRightSoft deleted successfully

C:\PROGRA~2\MSXML 4.0 deleted successfully

C:\PROGRA~2\OpenDownloaderManager deleted successfully

C:\Program Files\Android deleted successfully

C:\Program Files\ATI Technologies deleted successfully

C:\Users\ericjs\AppData\Local\Android deleted successfully

C:\Users\ericjs\AppData\Local\LogMeIn Rescue Applet deleted successfully

C:\Users\ericjs\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-933687366-1884772992-1401314039-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\rmkbddfi.default

user.js not found

—- Lines browser.startup.page removed from prefs.js —-

user_pref("browser.startup.page", 3);

—- FireFox user.js and prefs.js backups —-

prefs_20150514_1303_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\eRightSoft not found

C:\PROGRA~2\OpenDownloaderManager not found

C:\Users\ericjs\.android deleted

C:\Install 00-Level Support Files.exe deleted

C:\Setup200EMA_Distance.exe deleted

C:\found.000 deleted

C:\Users\ericjs\AppData\Roaming\Open Download Manager deleted

C:\Users\ericjs\AppData\Roaming\splitterdirectorys.txt deleted

C:\PROGRA~3\DriverGenius deleted

C:\PROGRA~3\Package Cache deleted

C:\windows\SysNative\GroupPolicy\Machine deleted

C:\windows\SysNative\GroupPolicy\User deleted

C:\windows\SysNative\GroupPolicy\gpt.ini deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\rmkbddfi.default

user_pref("browser.startup.homepage", "https://www.youtube.com/");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.defaultenginename.US", "Google");

user_pref("browser.search.selectedEngine", "Google");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack"="C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi" [10/15/2013 10:58]

==== Firefox Extensions ======================

ProfilePath: C:\Users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\rmkbddfi.default

- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

- Flash Video Downloader - YouTube HD Download [4K] - %ProfilePath%\extensions\[removed]

- BitComet - %ProfilePath%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\ericjs\AppData\Roaming\Mozilla\Firefox\Profiles\rmkbddfi.default

DCB0BCEF594E2C410793C4A823C318F3 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll - Shockwave for Director / Shockwave for Director

9AE02005247DA91AB1743F5208DBEF76 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll - Shockwave Flash

98137411B9C632095F919E2CE70B288A - C:\Users\ericjs\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll - Google Update

E3B4EA121F7BDEB0F6366E2BA9608CB5 - C:\Users\ericjs\AppData\Local\Citrix\Plugins\104\npappdetector.dll - Citrix Online Web Deployment Plugin 1.0.0.104

49D429EBF5305FC9ADD7545B7C914333 - C:\Users\ericjs\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

6BEAD7859E8A087BE04556AB5A78855C - C:\Users\ericjs\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer

178F30EB6105041AE4FA3943DBF40C75 - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll - WacomTabletPlugin

==== Chromium Look ======================

Google Chrome Version: 42.0.2311.135

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[07/06/2014 12:04]

mikhcaiakabeeokmenglcdebplfdjicn - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\chromeShim.crx[10/15/2013 10:58]

Bookmark Manager - ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik

Avast Online Security - ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki

Chrome Hotword Shared Module - ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Dragon NaturallySpeaking Rich Internet Application Support - ericjs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mikhcaiakabeeokmenglcdebplfdjicn

==== Chromium Startpages ======================

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Preferences

"startup_urls": [ "https://www.google.com/" ]

==== Chromium Fix ======================

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_t-mobilemoneyservices.com_0.localstorage deleted successfully

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_t-mobilemoneyservices.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="https://www.google.com/"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="https://www.google.com/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Reset IE Proxy ======================

Value(s) before fix:

"ProxyOverride"="<-loopback>"

"ProxyEnable"=dword:00000000

Value(s) after fix:

"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\ericjs\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\ericjs\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\ericjs\AppData\Local\Mozilla\Firefox\Profiles\rmkbddfi.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\ericjs\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=110 folders=47 839257390 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully

C:\Users\Default User\AppData\Local\temp emptied successfully

C:\Users\ericjs\AppData\Local\Temp will be emptied at reboot

C:\Users\Public\AppData\Local\temp emptied successfully

C:\Users\s\AppData\Local\temp emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\ericjs\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Thu 05/14/2015 at 16:24:08.47 ======================

ericjschroeder

Post #15May 14, 2015, 11:42 PM UTC

MalwareBytes ran this time and found 1 bad proxy, quarantined. Also the Zoom Player isn't crashing anymore on exit (fingers crossed). Anything else you recommend? Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Not sure if PC infected, but.... [Solved]

✨ Ask AI

Ask AI