Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Registry Edit Virus [Solved]


  • This topic is locked This topic is locked

#16
dogstar21

dogstar21

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
Rebooting did the trick.

checkup.txt contents:

Results of screen317's Security Check version 0.99.80
Windows Vista Service Pack 2 x64
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Adobe Flash Player 12.0.0.77
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.4 Adobe Reader out of Date!
Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1 %
````````````````````End of Log``````````````````````
  • 0

Advertisements


#17
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

Rebooting did the trick.


Good :thumbsup: I'll be back shortly with instructions. :)
  • 0

#18
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Let's get rid of some programs that have adware in them and make sure they're gone with a FRST Fix. :thumbsup:


Please disable your antivirus for the duration of my instructions. Don't forget to re-enable them after you have completed the steps.

Step 1: Uninstall a Program


Please uninstall the following programs as they have known adware components in them.

  • Movavi Flash Converter
  • Movavi Screen Capture
  • Movavi Media Player


Step 2: FRST Fix


  • Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy.
  • Right-click in the open notepad and select Paste).
  • Save it on the desktop as fixlist.txt

Start
C:\Program Files (x86)\Movavi VideoSuite 7
C:\Users\Pete\AppData\Local\Downloaded Installations\{F84C8918-2FBA-4EDF-9248-CD95F8035E02}\Movavi VideoSuite 7.msi
End


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system.


Run FRST and press the Fix button just once and wait. The tool will make a log on the desktop (Fixlog.txt) please post it in your next reply.


Things I need to see in your next post:

FRST Fix Log

  • 0

#19
dogstar21

dogstar21

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
The Movavi software is something I had purchased, not the trial-ware software. I'd prefer not to uninstall it.

http://download.cnet...4-10391460.html

This is a link to a cnet review of Movavi.

Edited by dogstar21, 18 March 2014 - 06:27 PM.

  • 0

#20
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

The Movavi software is something I had purchased, not the trial-ware software. I'd prefer not to uninstall it.

http://download.cnet...4-10391460.html


I competely understand. :) I'll be back in a few minutes with some further instructions. :thumbsup:
  • 0

#21
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Hi, I'd like you to run a FRST scan and so I can have a last look to make sure everything is gone before I declare your machine clean.:)

Please run FRST and post the log it will produce. :thumbsup:
  • 0

#22
dogstar21

dogstar21

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
Contents of FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Pete (administrator) on PETE-PC on 18-03-2014 21:01:54
Running from C:\Users\Pete\Desktop
Windows Vista ™ Home Premium Service Pack 2 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_8aadd48d\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Corporation) C:\Windows\system32\Hpservice.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_8aadd48d\AESTSr64.exe
(Agere Systems) C:\Windows\system32\agr64svc.exe
(Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
() C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
(Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\SMINST\BLService.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
() C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
(Avira GmbH) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1560872 2008-07-24] (Synaptics, Inc.)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [914224 2008-11-18] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [441856 2008-10-26] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-11-28] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1316136 2008-12-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] - C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-12-25] (CyberLink)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [218408 2008-11-15] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2008-11-26] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [206128 2008-10-10] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-10-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] - C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Health Check Scheduler] - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-10-09] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [TVAgent] - C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe [206120 2009-02-09] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768 2010-08-02] (Avira GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKU\S-1-5-21-3889686918-3398402473-1388666377-1000\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2010-03-19] (Hewlett-Packard Company)
HKU\S-1-5-21-3889686918-3398402473-1388666377-1000\...\Run: [HPAdvisor] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [966656 2008-11-18] (Hewlett-Packard)
HKU\S-1-5-21-3889686918-3398402473-1388666377-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-3889686918-3398402473-1388666377-1000\...\Run: [WMPNSCFG] - C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
Startup: C:\Users\Pete\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoZone iSync.lnk
ShortcutTarget: GoZone iSync.lnk -> C:\Program Files (x86)\GoZone\GoZone_iSync.exe (Virgin HealthMiles Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie9
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {3B1AAF6F-BC73-4A31-9EE4-04B8C395AC0E} URL = http://search.live.c...ms}&FORM=HPNTDF
SearchScopes: HKLM - {3B1AAF6F-BC73-4A31-9EE4-04B8C395AC0E} URL = http://search.live.c...ms}&FORM=HPNTDF
SearchScopes: HKLM - {BFE5EDCC-25B3-461D-8E03-309E92AD753A} URL = http://www.ask.com/w...}&l=dis&o=ushpl
SearchScopes: HKLM-x32 - {BFE5EDCC-25B3-461D-8E03-309E92AD753A} URL = http://www.ask.com/w...}&l=dis&o=ushpl
SearchScopes: HKCU - {273B8C2F-51CB-40E1-90AA-9BB1190EEB5F} URL = http://search.yahoo....f-8&fr=chr-yie9
SearchScopes: HKCU - {3B1AAF6F-BC73-4A31-9EE4-04B8C395AC0E} URL =
SearchScopes: HKCU - {7148CB92-9375-4E9C-A5C0-166ACF27981A} URL = http://www.flickr.co...q={searchTerms}
SearchScopes: HKCU - {BFE5EDCC-25B3-461D-8E03-309E92AD753A} URL =
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab
DPF: HKLM-x32 {45A0A292-ECC6-4D8F-9EA9-A4BD411D24C1} http://www.king.com/ctl/kingcomie.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ent/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Pete\AppData\Roaming\Mozilla\Firefox\Profiles\4z05qces.default
FF Homepage: hxxp://sports.yahoo.com/fantasy;_ylt=AqcNqZCM6O37CSX81xSObsw5nYcB
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.7.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\npctrl.1.0.30716.0.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\Pete\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Pete\AppData\Roaming\Mozilla\Firefox\Profiles\4z05qces.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011-04-10]
FF Extension: NoScript - C:\Users\Pete\AppData\Roaming\Mozilla\Firefox\Profiles\4z05qces.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-13]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\
FF HKCU\...\Firefox\Extensions: [[email protected]] - C:\Users\Pete\AppData\Roaming\Move Networks
FF Extension: Move Media Player - C:\Users\Pete\AppData\Roaming\Move Networks [2009-09-25]

==================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2011-08-11] (SUPERAntiSpyware.com)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_8aadd48d\AESTSr64.exe [89088 2008-06-27] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-04-27] (Avira GmbH)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-06-28] (Avira GmbH)
R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [460144 2010-12-15] ()
R2 FlipShareServer; C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [1085440 2010-12-15] ()
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-12-17] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [241734 2008-09-15] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_8aadd48d\STacSV64.exe [279040 2008-10-26] (IDT, Inc.)
R2 TVCapSvc; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2009-02-09] ()
R2 TVSched; C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2009-02-09] ()
S3 nosGetPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll [X]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-06-28] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-06-28] (Avira GmbH)
S1 Beep; No ImagePath
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2008-11-28] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-18 09:25 - 2014-03-18 09:25 - 02347384 _____ (ESET) C:\Users\Pete\Desktop\esetsmartinstaller_enu.exe
2014-03-18 09:07 - 2014-03-18 09:07 - 00987442 _____ () C:\Users\Pete\Desktop\SecurityCheck.exe
2014-03-18 09:06 - 2014-03-18 09:06 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pete\Desktop\mbam-setup-1.75.0.1300.exe
2014-03-17 23:58 - 2014-03-17 23:58 - 00000772 _____ () C:\Users\Pete\Desktop\JRT.txt
2014-03-17 23:45 - 2014-03-17 23:46 - 00000000 ____D () C:\AdwCleaner
2014-03-17 23:44 - 2014-03-17 23:44 - 01037734 _____ (Thisisu) C:\Users\Pete\Desktop\JRT.exe
2014-03-17 23:43 - 2014-03-17 23:43 - 01950720 _____ () C:\Users\Pete\Desktop\adwcleaner.exe
2014-03-17 22:21 - 2014-03-17 22:21 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Pete\Desktop\tdsskiller.exe
2014-03-17 20:23 - 2014-03-17 20:23 - 00448512 _____ (OldTimer Tools) C:\Users\Pete\Desktop\TFC.exe
2014-03-17 10:22 - 2014-03-17 10:22 - 00002112 _____ () C:\Users\Pete\Desktop\aswMBR.txt
2014-03-17 10:22 - 2014-03-17 10:22 - 00000512 _____ () C:\Users\Pete\Desktop\MBR.dat
2014-03-17 09:01 - 2014-03-17 09:12 - 04745728 _____ (AVAST Software) C:\Users\Pete\Desktop\aswmbr.exe
2014-03-16 23:49 - 2014-03-16 23:50 - 00031610 _____ () C:\Users\Pete\Desktop\Addition.txt
2014-03-16 23:48 - 2014-03-18 21:01 - 00017391 _____ () C:\Users\Pete\Desktop\FRST.txt
2014-03-16 23:48 - 2014-03-18 21:01 - 00000000 ____D () C:\FRST
2014-03-16 23:48 - 2014-03-16 23:48 - 02157056 _____ (Farbar) C:\Users\Pete\Desktop\FRST64.exe
2014-03-14 16:44 - 2014-03-14 16:44 - 00062262 _____ () C:\Users\Pete\Downloads\Extras.Txt
2014-03-14 16:44 - 2014-03-14 16:44 - 00060740 _____ () C:\Users\Pete\Downloads\OTL.Txt
2014-03-14 16:32 - 2014-03-14 16:32 - 00602112 _____ (OldTimer Tools) C:\Users\Pete\Downloads\OTL.exe
2014-03-14 14:18 - 2014-03-14 15:58 - 00000732 _____ () C:\Users\Pete\AppData\Local\d3d9caps64.dat
2014-03-11 15:26 - 2014-03-11 15:26 - 00847816 _____ (Google Inc.) C:\Users\Pete\Downloads\ChromeSetup.exe
2014-02-26 20:44 - 2014-02-26 20:44 - 00108024 _____ () C:\Users\Pete\Downloads\atlas-shrugged-header.jpeg
2014-02-21 10:20 - 2012-06-02 18:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-02-21 10:20 - 2012-06-02 18:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-02-21 10:20 - 2012-06-02 18:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-02-21 10:20 - 2012-06-02 18:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-02-21 10:19 - 2012-06-02 18:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-02-21 10:19 - 2012-06-02 18:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-02-21 10:19 - 2012-06-02 18:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-02-21 10:19 - 2012-06-02 18:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-02-21 10:19 - 2012-06-02 18:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-02-21 10:19 - 2012-06-02 18:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-02-21 10:19 - 2012-06-02 16:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-02-21 10:19 - 2012-06-02 16:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-02-21 10:19 - 2012-06-02 16:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-02-21 10:19 - 2012-06-02 16:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

2014-03-18 21:02 - 2014-03-16 23:48 - 00017391 _____ () C:\Users\Pete\Desktop\FRST.txt
2014-03-18 21:01 - 2014-03-16 23:48 - 00000000 ____D () C:\FRST
2014-03-18 20:22 - 2014-02-13 16:38 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-18 19:40 - 2009-06-15 05:58 - 02092277 _____ () C:\Windows\WindowsUpdate.log
2014-03-18 19:40 - 2009-01-13 13:47 - 00003576 _____ () C:\Windows\System32\Tasks\HP Health Check
2014-03-18 19:40 - 2006-11-02 08:46 - 00690960 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-18 19:36 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-18 19:36 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-18 19:36 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-18 19:36 - 2006-11-02 11:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-03-18 19:35 - 2006-11-02 11:42 - 00032548 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-18 19:06 - 2009-11-23 19:48 - 00170496 _____ () C:\Users\Pete\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-03-18 15:42 - 2009-08-24 19:33 - 00000000 ____D () C:\Users\Pete\Documents\Fantasy Sports
2014-03-18 09:25 - 2014-03-18 09:25 - 02347384 _____ (ESET) C:\Users\Pete\Desktop\esetsmartinstaller_enu.exe
2014-03-18 09:17 - 2009-08-19 12:29 - 00003182 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForPete
2014-03-18 09:17 - 2009-08-19 12:29 - 00000330 _____ () C:\Windows\Tasks\HPCeeScheduleForPete.job
2014-03-18 09:08 - 2012-02-10 16:11 - 00000948 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-18 09:08 - 2010-10-19 18:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-18 09:07 - 2014-03-18 09:07 - 00987442 _____ () C:\Users\Pete\Desktop\SecurityCheck.exe
2014-03-18 09:06 - 2014-03-18 09:06 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Pete\Desktop\mbam-setup-1.75.0.1300.exe
2014-03-17 23:58 - 2014-03-17 23:58 - 00000772 _____ () C:\Users\Pete\Desktop\JRT.txt
2014-03-17 23:46 - 2014-03-17 23:45 - 00000000 ____D () C:\AdwCleaner
2014-03-17 23:44 - 2014-03-17 23:44 - 01037734 _____ (Thisisu) C:\Users\Pete\Desktop\JRT.exe
2014-03-17 23:43 - 2014-03-17 23:43 - 01950720 _____ () C:\Users\Pete\Desktop\adwcleaner.exe
2014-03-17 22:21 - 2014-03-17 22:21 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Pete\Desktop\tdsskiller.exe
2014-03-17 20:23 - 2014-03-17 20:23 - 00448512 _____ (OldTimer Tools) C:\Users\Pete\Desktop\TFC.exe
2014-03-17 20:22 - 2009-08-19 12:30 - 00000000 ___RD () C:\Users\Pete\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-17 10:22 - 2014-03-17 10:22 - 00002112 _____ () C:\Users\Pete\Desktop\aswMBR.txt
2014-03-17 10:22 - 2014-03-17 10:22 - 00000512 _____ () C:\Users\Pete\Desktop\MBR.dat
2014-03-17 09:12 - 2014-03-17 09:01 - 04745728 _____ (AVAST Software) C:\Users\Pete\Desktop\aswmbr.exe
2014-03-16 23:50 - 2014-03-16 23:49 - 00031610 _____ () C:\Users\Pete\Desktop\Addition.txt
2014-03-16 23:48 - 2014-03-16 23:48 - 02157056 _____ (Farbar) C:\Users\Pete\Desktop\FRST64.exe
2014-03-14 16:44 - 2014-03-14 16:44 - 00062262 _____ () C:\Users\Pete\Downloads\Extras.Txt
2014-03-14 16:44 - 2014-03-14 16:44 - 00060740 _____ () C:\Users\Pete\Downloads\OTL.Txt
2014-03-14 16:32 - 2014-03-14 16:32 - 00602112 _____ (OldTimer Tools) C:\Users\Pete\Downloads\OTL.exe
2014-03-14 16:10 - 2006-11-02 09:34 - 00000000 ____D () C:\Windows\system32\spool
2014-03-14 16:08 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\registration
2014-03-14 15:58 - 2014-03-14 14:18 - 00000732 _____ () C:\Users\Pete\AppData\Local\d3d9caps64.dat
2014-03-14 11:11 - 2010-05-11 14:50 - 00000000 ____D () C:\Movavi files
2014-03-13 13:45 - 2009-08-20 14:02 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-03-12 01:22 - 2014-02-13 16:38 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 01:22 - 2013-09-22 16:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 01:22 - 2011-06-29 07:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 15:26 - 2014-03-11 15:26 - 00847816 _____ (Google Inc.) C:\Users\Pete\Downloads\ChromeSetup.exe
2014-03-01 15:09 - 2006-11-02 11:27 - 00144668 _____ () C:\Windows\setupact.log
2014-03-01 13:01 - 2009-01-13 13:23 - 00000000 ____D () C:\ProgramData\Adobe
2014-03-01 12:58 - 2009-08-19 12:44 - 00000000 ____D () C:\Users\Pete\AppData\Roaming\Adobe
2014-03-01 12:54 - 2012-04-11 18:42 - 00000000 ____D () C:\Users\Pete\Documents\Taxes
2014-02-26 20:44 - 2014-02-26 20:44 - 00108024 _____ () C:\Users\Pete\Downloads\atlas-shrugged-header.jpeg
2014-02-25 21:03 - 2011-10-28 11:56 - 00000000 ____D () C:\Docs
2014-02-24 20:01 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\rescache
2014-02-18 01:36 - 2009-08-19 12:25 - 00076240 _____ () C:\Users\Pete\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-18 01:32 - 2006-11-02 11:21 - 00315144 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-18 01:31 - 2008-01-20 23:26 - 00408664 _____ () C:\Windows\PFRO.log
2014-02-17 09:38 - 2011-11-24 10:51 - 00000000 ____D () C:\Windows\ERDNT
2014-02-16 18:54 - 2009-09-09 09:02 - 00000680 _____ () C:\Users\Pete\AppData\Local\d3d9caps.dat
2014-02-16 01:20 - 2006-11-02 08:34 - 00000215 _____ () C:\Windows\system.ini

Some content of TEMP:
====================
C:\Users\Pete\AppData\Local\Temp\630E8871-1EED-41BC-B981-EC40A732A764.exe
C:\Users\Pete\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-18 19:46

==================== End Of Log ============================
  • 0

#23
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Great news, your logs are CLEAN! :thumbsup: :) But we still have a few things we need to address namely:

  • I need to remove the tools we installed on your machine.
  • I have some information for you and protection against a new ransomware program called CryptoLocker.


Step 1: Tool Removal with DelFix


  • Download Delfix from here
  • Ensure Remove disinfection tools is ticked
    Also tick:
    • Create registry backup
    • Purge system restore
    Posted Image
  • Click Run
The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply

  • You can uinstall ESET Online Scanner at this time.
  • I'd recommend keeping Malwarebytes Anti-Malware installed. Make sure to update it and run it at least once a week.


Step 2: Uninstall Adobe 9 and FileHippo Installation


You have 2 versions of Adobe Reader on your machine and version 9 is out of date. Please uninstall Adobe Reader 9. Version 10.1.4 is the most current and you have that one. :thumbsup:


  • Malware will exploit any vulnerabilities it can find in outdated software. If you are using Adobe Reader for reading pdf files, try using FoxIt Reader. It is a very capable alternative to Adobe.
  • Please click here to download FoxIt Reader.


Keeping your software updated

Another weapon against malicious programs and viruses is to keeping other programs updated. There are several programs out there that can check for out of date programs on your computer. One is Filehippo. You can run this on a weekly or monthly basis to check your programs for updates and then it will provide a link for you to download them.

Download Filehippo Updatechecker


Step 3: Tips, Information, and Protection against CryptoLocker


Watch what you open in your emails. If you get an email from an unknown source with any attached files, do not open it.

Be careful of the websites you visit.

When installing new programs, don't be "click happy" and click through the screens. Many programs come with adware in them and are set to install them by default. Several programs require that you uncheck or select no to prevent the installation. Take you time and read each screen as you go. :)

To help protect yourself while on the web, I recommend you read How did I get infected in the first place?

A warning about CryptoLocker

CryptoLocker is a ransomware program that was released around the beginning of September 2013 that targets all versions of Windows including Windows XP, Windows Vista, Windows 7, and Windows 8. This ransomware will encrypt certain files using a mixture of RSA & AES encryption. When it has finished encrypting your files, it will display a CryptoLocker payment program that prompts you to send a ransom of either $100 or $300 in order to decrypt the files. This screen will also display a timer stating that you have 72 hours, or 4 days, to pay the ransom or it will delete your encryption key and you will not have any way to decrypt your files. This ransom must be paid using MoneyPak vouchers or Bitcoins. Once you send the payment and it is verified, the program will decrypt the files that it encrypted.

Please download and install CryptoPrevent to lock your machine down from this infection.

Posted Image

Are there any further issues I can assist you with?
  • 1

#24
dogstar21

dogstar21

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 103 posts
I ran delfix cleaned up the tools we used.

In my programs list to uninstall, the only Adobe Version showing is 10.1.4. I don't have Filehippo on my machine either.

I downloaded CryptoPrevent. Thanks for the tip!

More importantly, thanks for all your help. Good to have my machine back. I reviewed the information, and will definitely try to be more careful in the future.
  • 0

#25
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts

I ran delfix cleaned up the tools we used.

In my programs list to uninstall, the only Adobe Version showing is 10.1.4. I don't have Filehippo on my machine either.


Ok, good. I recommend you to install Filehippo and run it about once a month. That program saves a ton of time when it comes to updating your programs.

I downloaded CryptoPrevent. Thanks for the tip!

More importantly, thanks for all your help. Good to have my machine back. I reviewed the information, and will definitely try to be more careful in the future.


You're very much welcome! :) Don't hesitate to call on us again if you need us in the future. :thumbsup:
  • 0

Advertisements


#26
pystryker

pystryker

    Trusted Helper

  • Malware Removal
  • 3,886 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP