Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

need combofix script from frst64 log. [Closed]


  • This topic is locked This topic is locked

#1
alrn214

alrn214

    New Member

  • Member
  • Pip
  • 3 posts

I'm trying to clean my machine and trying to figure out how to make a fixlist.txt script from my FRST64 log but I'm not 100% after reading tutorial can anyone help me?  Thanks in advance.

 

heres my log:

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-11-2014 01
Ran by Daddy (administrator) on HAL on 28-11-2014 12:01:48
Running from C:\Users\Daddy\Desktop
Loaded Profile: Daddy (Available profiles: Daddy)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\32788R22FWJFW\cmd.3XE
() C:\32788R22FWJFW\pev.3XE
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Anubisel Corporatu) C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe
(Anubisel Corporatu) C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe
(Anubisel Corporatu) C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [pcreg] => C:\Program Files\pcreg\service.exe
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\oxnlwag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnlwag.dll ()
Winlogon\Notify\oxnmkag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnmkag.dll ()
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Sebuyfpipe] => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe [281135 2014-11-28] (Anubisel Corporatu)
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Yhsise] => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe [284347 2014-11-28] (Anubisel Corporatu)
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Run: [MasgAteri] => regsvr32.exe "C:\ProgramData\MasgAteri\MasgAteri.dat"
HKU\S-1-5-18\...\Run: [HonudZuwwo] => regsvr32.exe "C:\ProgramData\HonudZuwwo\HonudZuwwo.dat"
HKU\S-1-5-18\...\Run: [oxnmkag] => rundll32 "C:\Windows\system32\config\systemprofile\AppData\Local\oxnmkag.dll",oxnmkag <===== ATTENTION
HKU\S-1-5-18\...\Run: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
HKU\S-1-5-18\...\RunOnce: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Policies\Explorer: [Run] "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\.DEFAULT\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://g.msn.com/HPDSK/1
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylo...000d4856418c280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.v9.com...q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.v9.com...q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKLM -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL = http://search.yahoo....psg&type=HPDTDF
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKLM-x32 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL = http://search.yahoo....psg&type=HPDTDF
SearchScopes: HKU\.DEFAULT -> DefaultScope {EDCF6BB3-29DA-4EE9-A8C0-055D31AAB204} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> DefaultScope 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> URL http://search.condui...rchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> SuggestionsURL_JSON http://suggest.searc...x={searchTerms}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL =
BHO: Start Savin BHO -> {181F2C09-56DD-4F98-86D7-59BA2BC59B5A} -> C:\Program Files (x86)\Start Savin\FrameworkBHO64.dll No File
BHO: YoutubeAdBlocke -> {6c74318f-cf02-41c3-b044-f44006112093} -> C:\Program Files (x86)\YoutubeAdBlocke\2hnE6l2EEaexfW.x64.dll ()
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
ShellExecuteHooks-x32: ExecuteHooker Class - {569DAC0F-2791-46ab-8EFC-A54B77C04C20} - C:\Program Files (x86)\DVD Region Free\ExecuteHooker.dll No File [ ]
Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll File Not found ()
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{3D959B40-5A80-4A0B-B496-D4090BB5E9E7}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default
FF SearchEngineOrder.1: Search the web (Babylon)
FF Homepage: hxxp://www.v9.com/?type=hp&ts=1415423197&from=cor&uid=WDCXWD1001FAES
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\bing-zugo.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\google-default.xml
FF Extension: Coupons.com CouponBar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\Coupons.com [2013-12-05]
FF Extension: Babylon Toolbar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2012-12-08]
FF Extension: GoSave - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF Extension: YoutubeAdBlocke - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF Extension: Firefox Old Version Update Hotfix - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-07-17]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected] [2014-11-14]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-04-14]
FF HKLM-x32\...\Firefox\Extensions: [{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}] - C:\Program Files (x86)\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Highlight to Search) - C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\floipahigmmkfhkoapmnijnlnboniglg [2014-11-07]
CHR Extension: (GoSave) - C:\Users\Daddy\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlcbibibpeelmjeafidffcdpllodjb [2014-11-07]
CHR HKLM-x32\...\Chrome\Extension: [cnpkmcjgpcihgfnkcjapiaabbbplkcmf] - C:\Program Files (x86)\Coupons.com CouponBar\chrome\Coupons.com.crx []
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-06-12]
CHR HKLM-x32\...\Chrome\Extension: [lcnnhcneegeeojhgpfijnlnocjdmlaon] - C:\ProgramData\ValueApps\CH\ValueApps.crx [2014-01-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)
S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-06-11] (Advanced Micro Devices, Inc.) [File not signed]
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DcomLaunch; C:\Windows\system32\rpcss.dll [516096 2010-11-20] (Microsoft Corporation) [File not signed]
S4 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
S4 IHProtect Service; C:\Program Files (x86)\STab\ProtectService.exe [158864 2014-11-05] (TODO: <Company name>)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 MSSQL$SOSHOME309; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-24] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S4 pcCMService; C:\Program Files (x86)\Common Files\Motive\pcCMService.exe [369152 2012-10-16] (Alcatel-Lucent) [File not signed]
S4 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2012-10-16] (Alcatel-Lucent) [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-14] (PDF Complete Inc)
R2 RpcSs; C:\Windows\system32\rpcss.dll [516096 2010-11-20] (Microsoft Corporation) [File not signed]
S4 fc67e7a0; [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S4 pcregservice; [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [120768 2009-04-09] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [120768 2009-04-09] (SlySoft, Inc.)
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R3 ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [14032 2007-02-15] (Elaborate Bytes AG)
R3 ElbyDelay; C:\Windows\SysWOW64\Drivers\ElbyDelay.sys [14032 2007-02-15] (Elaborate Bytes AG)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2012-10-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2012-10-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S1 yiiuobyi; \??\C:\Windows\system32\drivers\yiiuobyi.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-28 11:50 - 2014-11-28 11:50 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\Maavty
2014-11-28 11:17 - 2014-11-28 12:01 - 00000000 ___SD () C:\32788R22FWJFW
2014-11-28 11:02 - 2014-11-28 12:01 - 00020995 _____ () C:\Users\Daddy\Desktop\FRST.txt
2014-11-28 01:27 - 2014-11-28 01:57 - 00000000 ___SD () C:\ComboFix
2014-11-28 01:08 - 2014-11-28 01:08 - 00000000 ____D () C:\Qoobox
2014-11-28 01:08 - 2011-06-26 00:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-11-28 01:08 - 2010-11-07 11:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-11-28 01:08 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00098816 _____ () C:\Windows\sed.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00080412 _____ () C:\Windows\grep.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00068096 _____ () C:\Windows\zip.exe
2014-11-28 01:06 - 2014-11-28 01:06 - 00000000 ____D () C:\Windows\erdnt
2014-11-28 01:01 - 2014-11-28 01:03 - 00034144 _____ () C:\Users\Daddy\Desktop\Addition.txt
2014-11-28 00:55 - 2014-11-28 12:02 - 00000000 ____D () C:\FRST
2014-11-26 15:32 - 2014-11-28 12:00 - 00000798 _____ () C:\Windows\Tasks\Security Center Update - 1470752179.job
2014-11-26 15:32 - 2014-11-28 11:48 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\Uzucxe
2014-11-26 15:32 - 2014-11-26 15:32 - 00003806 _____ () C:\Windows\System32\Tasks\Security Center Update - 1470752179
2014-11-26 15:13 - 2014-11-26 15:13 - 00000000 ____D () C:\ProgramData\HeciBawuw
2014-11-25 01:28 - 2014-11-25 01:28 - 00000806 _____ () C:\Windows\Tasks\Security Center Update - 2042579260.job
2014-11-25 01:27 - 2014-11-28 12:00 - 00000800 _____ () C:\Windows\Tasks\Security Center Update - 3197449427.job
2014-11-25 01:27 - 2014-11-25 01:28 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\Sedoimry
2014-11-25 01:27 - 2014-11-25 01:27 - 00003808 _____ () C:\Windows\System32\Tasks\Security Center Update - 3197449427
2014-11-25 01:23 - 2014-11-26 15:13 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-11-25 01:23 - 2014-11-25 01:23 - 00000000 ____D () C:\ProgramData\HonudZuwwo
2014-11-25 01:22 - 2014-11-25 01:22 - 00000000 ____D () C:\ProgramData\MasgAteri
2014-11-25 00:23 - 2014-11-25 00:37 - 05598874 ____R (Swearware) C:\Users\Daddy\Desktop\ComboFix.exe
2014-11-25 00:20 - 2014-11-28 10:34 - 02117632 _____ (Farbar) C:\Users\Daddy\Desktop\FRST64.exe
2014-11-24 23:35 - 2014-11-24 23:35 - 00000406 _____ () C:\Windows\DCEBOOT.RST
2014-11-24 23:35 - 2014-11-24 23:35 - 00000000 _____ () C:\Windows\DCEBOOT.LOG
2014-11-24 23:32 - 2014-11-24 23:33 - 00236080 _____ (Trend Micro Inc.) C:\Windows\RegBootClean64.exe
2014-11-24 23:32 - 2014-11-24 23:32 - 00025136 _____ (Trend Micro Inc.) C:\Windows\DCEBoot64.exe
2014-11-16 23:57 - 2014-11-24 23:38 - 00000000 ____D () C:\Users\Daddy\Documents\backups
2014-11-16 23:56 - 2014-11-16 23:56 - 00388608 _____ (Trend Micro Inc.) C:\Users\Daddy\Documents\HijackThis.exe
2014-11-15 20:09 - 2014-11-15 21:08 - 17926832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-11-14 23:18 - 2014-11-14 23:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 12:31 - 2014-11-10 12:33 - 00834936 _____ (SlimWare Utilities, Inc.) C:\Users\Daddy\Downloads\DriverUpdate-setup.exe
2014-11-07 23:44 - 2014-11-07 23:45 - 00000000 ____D () C:\Users\Daddy\Minecraft mods
2014-11-07 23:42 - 2014-11-28 11:55 - 00000476 ____H () C:\Windows\Tasks\GS_Booster-S-576482620.job
2014-11-07 23:42 - 2014-11-24 23:35 - 00000000 ____D () C:\Program Files (x86)\DeltaFix
2014-11-07 23:42 - 2014-11-07 23:42 - 00000000 ____D () C:\ProgramData\Trusted Publisher
2014-11-07 23:41 - 2014-11-16 23:58 - 00000000 ____D () C:\Program Files (x86)\YoutubeAdBlocke
2014-11-07 23:41 - 2014-11-07 23:41 - 00000000 ____D () C:\ProgramData\YoutubeAdBlocke
2014-11-07 23:40 - 2014-11-16 00:23 - 00000000 ____D () C:\ProgramData\GoSave
2014-11-07 23:40 - 2014-11-16 00:17 - 00000000 ____D () C:\ProgramData\1f2ee141e8770edc
2014-11-07 23:40 - 2014-11-16 00:17 - 00000000 ____D () C:\Program Files (x86)\GoSave
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Chromatic Browser
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Chromatic Browser
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-11-07 23:06 - 2014-11-10 12:25 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-11-07 23:06 - 2014-11-07 23:09 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\v9
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\DigitalSites
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\Program Files (x86)\STab
2014-11-06 23:30 - 2014-11-07 23:38 - 00000000 ____D () C:\Users\Daddy\Documents\minecraft mods

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-28 12:05 - 2013-03-09 14:24 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-11-28 12:04 - 2013-10-12 10:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-28 12:04 - 2009-07-13 22:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-28 12:04 - 2009-07-13 22:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-28 11:55 - 2011-08-19 23:50 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-28 11:54 - 2011-08-19 23:50 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-28 11:54 - 2010-08-06 15:25 - 00450286 _____ () C:\Windows\PFRO.log
2014-11-28 11:54 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-28 11:54 - 2009-07-13 22:51 - 00066041 _____ () C:\Windows\setupact.log
2014-11-28 00:47 - 2012-12-08 23:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-27 13:14 - 2014-04-19 15:55 - 00000066 _____ () C:\Windows\system32\wbnfdi.eax
2014-11-26 15:12 - 2010-08-06 13:17 - 01800986 _____ () C:\Windows\WindowsUpdate.log
2014-11-24 23:32 - 2014-03-03 11:32 - 00000000 ____D () C:\Program Files\pcreg
2014-11-24 01:12 - 2014-10-14 10:06 - 00000000 ____D () C:\ProgramData\Recovery
2014-11-24 01:01 - 2012-12-08 22:53 - 01005077 _____ () C:\Users\Daddy\AppData\Local\census.cache
2014-11-24 01:01 - 2012-12-08 22:18 - 00109808 _____ () C:\Users\Daddy\AppData\Local\ars.cache
2014-11-24 00:15 - 2010-08-06 13:18 - 00000000 ____D () C:\ProgramData\PDFC
2014-11-23 23:13 - 2014-10-14 07:07 - 00000000 ____D () C:\Windows\Minidump
2014-11-23 23:13 - 2010-08-06 15:25 - 00286983 ____N () C:\Windows\Minidump\112314-30045-01.dmp
2014-11-20 00:37 - 2014-07-17 23:48 - 00000010 _____ () C:\Users\Daddy\AppData\Local\sponge.last.runtime.cache
2014-11-17 00:32 - 2009-07-13 23:13 - 00855780 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-15 21:08 - 2013-10-12 10:17 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-15 21:08 - 2012-08-13 21:40 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-15 21:08 - 2011-05-26 23:50 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-13 23:07 - 2012-10-03 13:00 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDaddy
2014-11-13 23:07 - 2012-10-03 13:00 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForDaddy.job
2014-11-07 23:44 - 2010-12-28 04:47 - 00000000 ____D () C:\Users\Daddy
2014-11-07 23:43 - 2011-05-25 14:20 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\Apple Computer
2014-11-07 23:43 - 2011-05-25 14:20 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Apple Computer
2014-11-07 23:40 - 2014-03-03 11:35 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-11-07 23:15 - 2010-12-27 22:45 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-11-07 22:59 - 2012-05-02 14:03 - 00529408 ___SH () C:\Users\Daddy\Downloads\Thumbs.db
2014-11-06 23:54 - 2013-02-19 14:02 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-06 23:38 - 2012-01-19 11:30 - 00000000 ____D () C:\Users\Public\Documents\Stardock

Files to move or delete:
====================
C:\ProgramData\msahwaot.exe


Some content of TEMP:
====================
C:\Users\Daddy\AppData\Local\Temp\amd_catalyst_11.6b_hotfix_win7_vista_july04.exe
C:\Users\Daddy\AppData\Local\Temp\APNSetup.exe
C:\Users\Daddy\AppData\Local\Temp\COMAP.EXE
C:\Users\Daddy\AppData\Local\Temp\Couponscom.exe
C:\Users\Daddy\AppData\Local\Temp\DefaultPack.exe
C:\Users\Daddy\AppData\Local\Temp\dlLogic.exe
C:\Users\Daddy\AppData\Local\Temp\dltr.exe
C:\Users\Daddy\AppData\Local\Temp\embededstub.exe
C:\Users\Daddy\AppData\Local\Temp\file_to_run551024.exe
C:\Users\Daddy\AppData\Local\Temp\file_to_run55573.exe
C:\Users\Daddy\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Daddy\AppData\Local\Temp\GCVerifier.dll
C:\Users\Daddy\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Daddy\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Daddy\AppData\Local\Temp\lowproc.exe
C:\Users\Daddy\AppData\Local\Temp\MSNC653.exe
C:\Users\Daddy\AppData\Local\Temp\nscE846.exe
C:\Users\Daddy\AppData\Local\Temp\nshA5F4.exe
C:\Users\Daddy\AppData\Local\Temp\nsmA884.exe
C:\Users\Daddy\AppData\Local\Temp\nsmEAF5.exe
C:\Users\Daddy\AppData\Local\Temp\nsrED37.exe
C:\Users\Daddy\AppData\Local\Temp\nsu8EF4.exe
C:\Users\Daddy\AppData\Local\Temp\nsw9FEA.exe
C:\Users\Daddy\AppData\Local\Temp\Resource.exe
C:\Users\Daddy\AppData\Local\Temp\sp49905.exe.exe
C:\Users\Daddy\AppData\Local\Temp\sp53904.exe
C:\Users\Daddy\AppData\Local\Temp\sp54931.exe
C:\Users\Daddy\AppData\Local\Temp\sp58915.exe
C:\Users\Daddy\AppData\Local\Temp\SPSetup.exe
C:\Users\Daddy\AppData\Local\Temp\stubhelper.dll
C:\Users\Daddy\AppData\Local\Temp\tmp3D9B.exe
C:\Users\Daddy\AppData\Local\Temp\tmpD16B.exe
C:\Users\Daddy\AppData\Local\Temp\tmpF5BC.exe
C:\Users\Daddy\AppData\Local\Temp\uninst1.exe
C:\Users\Daddy\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Daddy\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_0d6bca0c.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_47a0e710.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_4cac5409.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_8ae4d2e9.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_a1669365.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_af3631f0.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_c5b65f38.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_c75a0971.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_d0c1fc90.exe
C:\Users\Daddy\AppData\Local\Temp\verifier.exe
C:\Users\Daddy\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\Daddy\AppData\Local\Temp\_is10F0.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll
[2011-06-20 18:57] - [2010-11-20 07:27] - 0516096 ____A (Microsoft Corporation) D8410D332A52533CA2E7782B233BDEA6

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-17 03:43

==================== End Of Log ============================


Edited by alrn214, 05 December 2014 - 06:07 PM.

  • 0

Advertisements


#2
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

Hi. My name is Brian, and I would be happy to look into your issue.
 
I am currently in training and my posts will need to be reviewed by an expert, so expect a slight delay between posts.



- General Instructions -

  • Please read all instructions and fixes thoroughly. Read the ENTIRE post BEFORE performing any steps so you understand all that needs to be done.
  • I would advise printing any instructions for easy reference as some of the fixes may require you to boot in Safe mode. Access to these instructions may not be available in Safe Mode.
  • Any fixes provided by myself are for this log file only and should not be used on any other systems.
  • Do not run any other removal software or perform updates other than the ones I provide, as it will complicate the cleaning process.
  • It's very likely that part of our cleanup will include emptying your recycle bin. If you use your recycle bin as an archive and do not wish this to be emptied, please let me know.
  • You have 4 days to reply to each post or the topic will be closed. You will be able to request that the topic be re-opened by sending me a PM (Personal Message) or PM a moderator.
  • Please feel free to ask any questions, especially if you are having problems with my instructions.


- Save ALL Tools to your Desktop-

 

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
 
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
IE.jpgInternet Explorer - Click the Tools menu in the upper right-corner of the browser. Tools.JPG Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

- Finally Before We Start-

 
Removing malware is a complicated multiple step process, Please stay with me until I have declared your system clean. I strongly recommend you backup your personal files and folders. Although rare, attempting to remove malware can render your machine unbootable or cause data loss. Having backups of your data is your responsibility. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

 

 

 

 

OK, let's get started. There should be an Addition.txt file on your desktop. Can you post the contents of this file as well?

 

Thank you.


  • 0

#3
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

I was going through your initial log but noticed that your logs are a week old. Would you mind following the instructions below to provide fresh logs?

 

Step#1 - FRST Scan
 
1. Right click on the FRST64.exe file and select run as administrator. When the tool opens click Yes to disclaimer if prompted.

2. When you open the program, it will check for a new version and if one is available it will automatically download and update. Please allow the update to happen before continuing.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please copy and paste log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also paste that along with the FRST.txt into your reply.


  • 0

#4
alrn214

alrn214

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts

thanks for your help. not worries about delays as it will take me a bit as well so no worries. 

 

 

FRST

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-11-2014 01
Ran by Daddy (administrator) on HAL on 06-12-2014 23:40:34
Running from C:\Users\Daddy\Desktop
Loaded Profile: Daddy (Available profiles: Daddy)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Safe Mode (minimal)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\userinit.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [pcreg] => C:\Program Files\pcreg\service.exe
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\oxnlwag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnlwag.dll ()
Winlogon\Notify\oxnmkag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnmkag.dll ()
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Sebuyfpipe] => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Yhsise] => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Run: [MasgAteri] => regsvr32.exe "C:\ProgramData\MasgAteri\MasgAteri.dat"
HKU\S-1-5-18\...\Run: [HonudZuwwo] => regsvr32.exe "C:\ProgramData\HonudZuwwo\HonudZuwwo.dat"
HKU\S-1-5-18\...\Run: [oxnmkag] => rundll32 "C:\Windows\system32\config\systemprofile\AppData\Local\oxnmkag.dll",oxnmkag <===== ATTENTION
HKU\S-1-5-18\...\Run: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
HKU\S-1-5-18\...\RunOnce: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Policies\Explorer: [Run] "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\.DEFAULT\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://g.msn.com/HPDSK/1
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylo...000d4856418c280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.v9.com...q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.v9.com...q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKLM -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL = http://search.yahoo....psg&type=HPDTDF
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKLM-x32 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL = http://search.yahoo....psg&type=HPDTDF
SearchScopes: HKU\.DEFAULT -> DefaultScope {EDCF6BB3-29DA-4EE9-A8C0-055D31AAB204} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> DefaultScope 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> URL http://search.condui...rchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> SuggestionsURL_JSON http://suggest.searc...x={searchTerms}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {2D21A907-C1FE-4CBE-A9F4-CD8441B29B1E} URL = http://en.wikipedia....h={searchTerms}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL =
BHO: Start Savin BHO -> {181F2C09-56DD-4F98-86D7-59BA2BC59B5A} -> C:\Program Files (x86)\Start Savin\FrameworkBHO64.dll No File
BHO: YoutubeAdBlocke -> {6c74318f-cf02-41c3-b044-f44006112093} -> C:\Program Files (x86)\YoutubeAdBlocke\2hnE6l2EEaexfW.x64.dll ()
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
ShellExecuteHooks-x32: ExecuteHooker Class - {569DAC0F-2791-46ab-8EFC-A54B77C04C20} - C:\Program Files (x86)\DVD Region Free\ExecuteHooker.dll No File [ ]
Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll File Not found ()
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{3D959B40-5A80-4A0B-B496-D4090BB5E9E7}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default
FF SearchEngineOrder.1: Search the web (Babylon)
FF Homepage: hxxp://www.v9.com/?type=hp&ts=1415423197&from=cor&uid=WDCXWD1001FAES
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\bing-zugo.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\google-default.xml
FF Extension: Coupons.com CouponBar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\Coupons.com [2013-12-05]
FF Extension: Babylon Toolbar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2012-12-08]
FF Extension: GoSave - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF Extension: YoutubeAdBlocke - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF Extension: Firefox Old Version Update Hotfix - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-07-17]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected] [2014-11-14]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-04-14]
FF HKLM-x32\...\Firefox\Extensions: [{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}] - C:\Program Files (x86)\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [cnpkmcjgpcihgfnkcjapiaabbbplkcmf] - C:\Program Files (x86)\Coupons.com CouponBar\chrome\Coupons.com.crx []
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-06-12]
CHR HKLM-x32\...\Chrome\Extension: [lcnnhcneegeeojhgpfijnlnocjdmlaon] - C:\ProgramData\ValueApps\CH\ValueApps.crx [2014-01-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)
S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-06-11] (Advanced Micro Devices, Inc.) [File not signed]
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DcomLaunch; C:\Windows\system32\rpcss.dll [516096 2010-11-20] (Microsoft Corporation) [File not signed]
S4 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
S4 IHProtect Service; C:\Program Files (x86)\STab\ProtectService.exe [158864 2014-11-05] (TODO: <Company name>)
S2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
S2 MSSQL$SOSHOME309; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-24] (Microsoft Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S4 pcCMService; C:\Program Files (x86)\Common Files\Motive\pcCMService.exe [369152 2012-10-16] (Alcatel-Lucent) [File not signed]
S4 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2012-10-16] (Alcatel-Lucent) [File not signed]
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-14] (PDF Complete Inc)
R2 RpcSs; C:\Windows\system32\rpcss.dll [516096 2010-11-20] (Microsoft Corporation) [File not signed]
S4 fc67e7a0; [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S4 pcregservice; [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [120768 2009-04-09] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [120768 2009-04-09] (SlySoft, Inc.)
S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R3 ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [14032 2007-02-15] (Elaborate Bytes AG)
R3 ElbyDelay; C:\Windows\SysWOW64\Drivers\ElbyDelay.sys [14032 2007-02-15] (Elaborate Bytes AG)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2012-10-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2012-10-16] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
S1 yiiuobyi; \??\C:\Windows\system32\drivers\yiiuobyi.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-06 23:40 - 2014-12-06 23:41 - 00018942 _____ () C:\Users\Daddy\Desktop\FRST.txt
2014-12-05 22:24 - 2014-12-05 22:27 - 00602112 _____ (OldTimer Tools) C:\Users\Daddy\Desktop\OTL.exe
2014-11-30 05:56 - 2014-12-06 23:40 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
2014-11-28 11:17 - 2014-11-28 12:01 - 00000000 ___SD () C:\32788R22FWJFW
2014-11-28 01:27 - 2014-11-28 01:57 - 00000000 ___SD () C:\ComboFix
2014-11-28 01:08 - 2014-11-28 01:08 - 00000000 ____D () C:\Qoobox
2014-11-28 01:08 - 2011-06-26 00:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-11-28 01:08 - 2010-11-07 11:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-11-28 01:08 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00098816 _____ () C:\Windows\sed.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00080412 _____ () C:\Windows\grep.exe
2014-11-28 01:08 - 2000-08-30 18:00 - 00068096 _____ () C:\Windows\zip.exe
2014-11-28 01:06 - 2014-11-28 01:06 - 00000000 ____D () C:\Windows\erdnt
2014-11-28 00:55 - 2014-12-06 23:40 - 00000000 ____D () C:\FRST
2014-11-26 15:32 - 2014-12-05 22:00 - 00000798 _____ () C:\Windows\Tasks\Security Center Update - 1470752179.job
2014-11-26 15:32 - 2014-11-26 15:32 - 00003806 _____ () C:\Windows\System32\Tasks\Security Center Update - 1470752179
2014-11-26 15:13 - 2014-11-26 15:13 - 00000000 ____D () C:\ProgramData\HeciBawuw
2014-11-25 01:28 - 2014-11-25 01:28 - 00000806 _____ () C:\Windows\Tasks\Security Center Update - 2042579260.job
2014-11-25 01:27 - 2014-12-05 22:00 - 00000800 _____ () C:\Windows\Tasks\Security Center Update - 3197449427.job
2014-11-25 01:27 - 2014-11-25 01:27 - 00003808 _____ () C:\Windows\System32\Tasks\Security Center Update - 3197449427
2014-11-25 01:23 - 2014-11-26 15:13 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2014-11-25 01:23 - 2014-11-25 01:23 - 00000000 ____D () C:\ProgramData\HonudZuwwo
2014-11-25 01:22 - 2014-11-25 01:22 - 00000000 ____D () C:\ProgramData\MasgAteri
2014-11-25 00:23 - 2014-11-25 00:37 - 05598874 ____R (Swearware) C:\Users\Daddy\Desktop\ComboFix.exe
2014-11-25 00:20 - 2014-11-28 10:34 - 02117632 _____ (Farbar) C:\Users\Daddy\Desktop\FRST64.exe
2014-11-24 23:35 - 2014-11-24 23:35 - 00000406 _____ () C:\Windows\DCEBOOT.RST
2014-11-24 23:35 - 2014-11-24 23:35 - 00000000 _____ () C:\Windows\DCEBOOT.LOG
2014-11-24 23:32 - 2014-11-24 23:33 - 00236080 _____ (Trend Micro Inc.) C:\Windows\RegBootClean64.exe
2014-11-24 23:32 - 2014-11-24 23:32 - 00025136 _____ (Trend Micro Inc.) C:\Windows\DCEBoot64.exe
2014-11-16 23:57 - 2014-11-28 12:47 - 00000000 ____D () C:\Users\Daddy\Documents\backups
2014-11-16 23:56 - 2014-11-16 23:56 - 00388608 _____ (Trend Micro Inc.) C:\Users\Daddy\Documents\HijackThis.exe
2014-11-15 20:09 - 2014-11-28 19:04 - 04443312 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-11-14 23:18 - 2014-11-14 23:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 12:31 - 2014-11-10 12:33 - 00834936 _____ (SlimWare Utilities, Inc.) C:\Users\Daddy\Downloads\DriverUpdate-setup.exe
2014-11-07 23:42 - 2014-12-06 23:26 - 00000476 ____H () C:\Windows\Tasks\GS_Booster-S-576482620.job
2014-11-07 23:42 - 2014-11-24 23:35 - 00000000 ____D () C:\Program Files (x86)\DeltaFix
2014-11-07 23:42 - 2014-11-07 23:42 - 00000000 ____D () C:\ProgramData\Trusted Publisher
2014-11-07 23:41 - 2014-11-16 23:58 - 00000000 ____D () C:\Program Files (x86)\YoutubeAdBlocke
2014-11-07 23:41 - 2014-11-07 23:41 - 00000000 ____D () C:\ProgramData\YoutubeAdBlocke
2014-11-07 23:40 - 2014-11-16 00:23 - 00000000 ____D () C:\ProgramData\GoSave
2014-11-07 23:40 - 2014-11-16 00:17 - 00000000 ____D () C:\ProgramData\1f2ee141e8770edc
2014-11-07 23:40 - 2014-11-16 00:17 - 00000000 ____D () C:\Program Files (x86)\GoSave
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest\AppData\Local\Chromatic Browser
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Guest
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-11-07 23:40 - 2014-11-07 23:40 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-11-07 23:06 - 2014-11-10 12:25 - 00000000 ____D () C:\ProgramData\BoostSoftware
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\DigitalSites
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2014-11-07 23:06 - 2014-11-07 23:06 - 00000000 ____D () C:\Program Files (x86)\STab
2014-11-06 23:30 - 2014-11-07 23:38 - 00000000 ____D () C:\Users\Daddy\Documents\minecraft mods

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-06 23:38 - 2010-08-06 13:17 - 01293466 _____ () C:\Windows\WindowsUpdate.log
2014-12-06 23:37 - 2009-07-13 22:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-06 23:37 - 2009-07-13 22:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-06 23:26 - 2011-08-19 23:50 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-06 23:26 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-06 23:26 - 2009-07-13 22:51 - 00067105 _____ () C:\Windows\setupact.log
2014-12-06 01:00 - 2014-10-14 10:06 - 00000000 ____D () C:\ProgramData\Recovery
2014-12-06 00:39 - 2011-08-19 23:50 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-06 00:30 - 2010-12-28 04:47 - 00000000 ____D () C:\Users\Daddy
2014-12-05 22:05 - 2013-03-09 14:24 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-12-05 22:04 - 2013-10-12 10:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-01 03:01 - 2010-08-06 13:18 - 00000000 ____D () C:\ProgramData\PDFC
2014-11-28 19:04 - 2013-10-12 10:17 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-28 19:04 - 2012-08-13 21:40 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-28 19:04 - 2011-05-26 23:50 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-28 11:54 - 2010-08-06 15:25 - 00450286 _____ () C:\Windows\PFRO.log
2014-11-28 00:47 - 2012-12-08 23:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-27 13:14 - 2014-04-19 15:55 - 00000066 _____ () C:\Windows\system32\wbnfdi.eax
2014-11-24 23:32 - 2014-03-03 11:32 - 00000000 ____D () C:\Program Files\pcreg
2014-11-24 14:04 - 2010-12-27 17:07 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-24 01:01 - 2012-12-08 22:53 - 01005077 _____ () C:\Users\Daddy\AppData\Local\census.cache
2014-11-24 01:01 - 2012-12-08 22:18 - 00109808 _____ () C:\Users\Daddy\AppData\Local\ars.cache
2014-11-23 23:13 - 2014-10-14 07:07 - 00000000 ____D () C:\Windows\Minidump
2014-11-23 23:13 - 2010-08-06 15:25 - 00286983 ____N () C:\Windows\Minidump\112314-30045-01.dmp
2014-11-17 00:32 - 2009-07-13 23:13 - 00855780 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-13 23:07 - 2012-10-03 13:00 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDaddy
2014-11-13 23:07 - 2012-10-03 13:00 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForDaddy.job
2014-11-07 23:43 - 2011-05-25 14:20 - 00000000 ____D () C:\Users\Daddy\AppData\Roaming\Apple Computer
2014-11-07 23:43 - 2011-05-25 14:20 - 00000000 ____D () C:\Users\Daddy\AppData\Local\Apple Computer
2014-11-07 23:40 - 2014-03-03 11:35 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-11-07 23:15 - 2010-12-27 22:45 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-11-07 22:59 - 2012-05-02 14:03 - 00529408 ___SH () C:\Users\Daddy\Downloads\Thumbs.db
2014-11-06 23:54 - 2013-02-19 14:02 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-06 23:38 - 2012-01-19 11:30 - 00000000 ____D () C:\Users\Public\Documents\Stardock

Files to move or delete:
====================
C:\ProgramData\msahwaot.exe


Some content of TEMP:
====================
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_0d6bca0c.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_47a0e710.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_4cac5409.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_8ae4d2e9.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_a1669365.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_af3631f0.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_c5b65f38.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_c75a0971.exe
C:\Users\Daddy\AppData\Local\Temp\UpdateFlashPlayer_d0c1fc90.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll
[2011-06-20 18:57] - [2010-11-20 07:27] - 0516096 ____A (Microsoft Corporation) D8410D332A52533CA2E7782B233BDEA6

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-05 18:59

==================== End Of Log ============================

 

 

Addition

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-11-2014 01
Ran by Daddy at 2014-12-06 23:42:23
Running from C:\Users\Daddy\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{47F9B7C3-F172-940F-D0C4-203C7914E5D2}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: - SlySoft)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI AVIVO64 Codecs (Version: 11.6.0.10627 - ATI Technologies Inc.) Hidden
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Belkin Setup and Router Monitor (HKLM-x32\...\Belkin Setup and Router Monitor_is1) (Version: - )
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CinemaNow Media Manager (HKLM-x32\...\{6C122441-1861-4CD7-B1C5-A163A6984E12}) (Version: 1.9.1.105 - CinemaNow, Inc.)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: - Elaborate Bytes)
Crystal Reports Basic Runtime for Visual Studio 2008 (HKLM-x32\...\{CE26F10F-C80F-4377-908B-1B7882AE2CE3}) (Version: 10.5.0.0 - Business Objects)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2823 - CyberLink Corp.)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dora's Carnival Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
DVD Menu Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 4.1.4030 - Hewlett-Packard)
DVD Menu Pack for HP MediaSmart Video (x32 Version: 4.1.4030 - Hewlett-Packard) Hidden
Escape Rosecliff Island (x32 Version: 2.2.0.95 - WildTangent) Hidden
Fallen Enchantress (HKLM-x32\...\Steam App 216390) (Version: - Stardock Entertainment)
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
Final Drive Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Galactic Civilizations II - Ultimate Edition (HKLM-x32\...\Galactic Civilizations II - Ultimate Edition) (Version: - Stardock Entertainment, Inc.)
Galactic Civilizations II - Ultimate Edition (x32 Version: 2.02.007 - Stardock Entertainment, Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GS_Booster (HKLM-x32\...\S-576482620) (Version: 2.0.0.1956 - GS_Booster) <==== ATTENTION
GS_Sustainer (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{fc67e7a0}) (Version: - Genuine P Software) <==== ATTENTION
Heroes of Hellas 2 - Olympia (x32 Version: 2.2.0.95 - WildTangent) Hidden
Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - )
HL-2240 (HKLM-x32\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.12850.3526 - Hewlett-Packard)
HP Deskjet 3050A J611 series Basic Device Software (HKLM\...\{FB555BCF-9202-4886-9203-88C9A210D727}) (Version: 25.0.571.0 - Hewlett-Packard Co.)
HP Deskjet 3050A J611 series Help (HKLM-x32\...\{97DDCAB8-B770-4089-A10F-67568069D78A}) (Version: 140.0.2.2 - Hewlett Packard)
HP Deskjet 3050A J611 series Product Improvement Study (HKLM\...\{710D4D91-1924-4A6B-8659-9CDE02DC7207}) (Version: 25.0.571.0 - Hewlett-Packard Co.)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.1.3 - WildTangent)
HP MediaSmart CinemaNow 2.0 (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 4.1.4229 - Hewlett-Packard)
HP MediaSmart Music (HKLM-x32\...\InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}) (Version: 4.1.4215 - Hewlett-Packard)
HP MediaSmart Photo (HKLM-x32\...\InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}) (Version: 4.1.4211 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\...\{5B08AF35-B699-4A44-BB89-3E51E70611E8}) (Version: 3.1.1.12 - Hewlett-Packard)
HP MediaSmart Video (HKLM-x32\...\InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}) (Version: 4.1.4214 - Hewlett-Packard)
HP MediaSmart/TouchSmart Netflix (HKLM-x32\...\{BDDA1E1E-204E-4368-B0C2-737F16B76307}) (Version: 1.0.3.0 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.12992 - HP Photo Creations)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.1.2.27173 - Hewlett-Packard)
HydraVision (x32 Version: 4.2.208.0 - ATI Technologies Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Impulse (HKLM-x32\...\Impulse) (Version: 3.30 - Stardock)
Impulse® (HKLM-x32\...\Impulse®) (Version: 3.30 - GameStop)
Impulse® (x32 Version: 3.30 - GameStop) Hidden
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.550 - Oracle)
Jewel Quest 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Kobo (HKLM-x32\...\Kobo) (Version: - )
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2823 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2823 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM-x32\...\{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}) (Version: 2.0.675.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{FD052FB9-FE90-4438-B355-15EDC89D8FB1}) (Version: 2.0.673.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2627.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{86177DAE-38B1-49DD-912E-35CB703AB779}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Movie Theme Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 4.1.4030 - Hewlett-Packard)
Movie Theme Pack for HP MediaSmart Video (x32 Version: 4.1.4030 - Hewlett-Packard) Hidden
Mozilla Firefox 33.1.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 en-US)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NRP Instructor DVD-ROM (HKLM-x32\...\NRP Instructor DVD-ROM) (Version: - American Academy of Pediatrics)
Oblivion (HKLM-x32\...\{35CB6715-41F8-4F99-8881-6FC75BF054B0}) (Version: 1.00.0000 - Bethesda Softworks)
Opera 12.17 (HKLM-x32\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 3.5.111 - PDF Complete, Inc)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4022 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4022 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2906 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.2906 - CyberLink Corp.) Hidden
PressReader (HKLM-x32\...\{912CED74-88D3-4C5B-ACB0-13231864975D}) (Version: 5.10.621.0 - NewspaperDirect Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6132 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.2926 - CyberLink Corp.) Hidden
Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)
Shutterfly Express Uploader (HKLM-x32\...\com.Shutterfly.ExpressUploader) (Version: 1.0.0.4 - Shutterfly, Inc.)
Shutterfly Express Uploader (x32 Version: 1.0.0 - Shutterfly, Inc.) Hidden
SpongeBob SquarePants Typing (HKLM-x32\...\SpongeBob SquarePants Typing) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
Switched-On Schoolhouse 2009 - Home Edition Database (HKLM-x32\...\{AA5E022C-F4DB-46F4-9379-0F4397A90C23}) (Version: 4.1.0.36 - Alpha Omega Publications)
Trainz 'Blue Comet' Addon Pack (HKLM-x32\...\AuranTS2009_DLC0_is1) (Version: - Auran)
Trainz 'Coronation Scot' Addon Pack (HKLM-x32\...\AuranTS2009_DLC3_is1) (Version: - Auran)
Trainz 'Duchess' Addon Pack (HKLM-x32\...\AuranTS2009_DLC1_is1) (Version: - Auran)
Trainz Simulator 12 (HKLM-x32\...\AuranTS2009_is1) (Version: - Auran)
Virtual Families (x32 Version: 2.2.0.95 - WildTangent) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Wheel of Fortune 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 5.01 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
YoutubeAdBlocke (HKLM-x32\...\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version: 1.2.0.1288 - ) <==== ATTENTION
Zinio Reader 4 (HKLM-x32\...\ZinioReader4.9310D8F796442B71068C511E15D70529A702D19D.1) (Version: 4.0.2811 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.0.2811 - Zinio LLC) Hidden
Zip Uncompressor (HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Zip Uncompressor) (Version: - )
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2418151325-680678365-4071922823-1001_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\umpo.dll (Microsoft Corporation)

==================== Restore Points =========================

02-12-2014 21:28:22 Windows Update
02-12-2014 23:18:20 Windows Update
03-12-2014 04:36:52 Windows Update
03-12-2014 09:00:26 Windows Update
03-12-2014 09:58:35 Windows Update
03-12-2014 15:10:50 Windows Update
03-12-2014 20:28:53 Windows Update
04-12-2014 01:39:37 Windows Update
05-12-2014 23:49:41 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2014-11-26 15:13 - 00001509 _RASH C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
212.83.161.210 www.google-analytics.com.
212.83.161.210 google-analytics.com.
212.83.161.210 connect.facebook.net.
192.99.206.114 www.google-analytics.com.
192.99.206.114 google-analytics.com.
192.99.206.114 connect.facebook.net.
95.141.32.73 www.google-analytics.com.
95.141.32.73 google-analytics.com.
95.141.32.73 connect.facebook.net.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {172B30A8-DDE2-4687-AB94-3793A6344AF1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-28] (Adobe Systems Incorporated)
Task: {2A710B6B-2BA0-4C20-A393-047F39597640} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3C374920-A6E0-43FE-AF59-DB57BDCD7CAC} - \GS_Booster-S-576482620 No Task File <==== ATTENTION
Task: {3FCFE47A-C3CF-4BFD-A227-8A587293C0C7} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2013-03-09] ()
Task: {51713995-DFF3-42A7-8710-C3E24419F93A} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {522B7813-D8E0-40EE-B506-AD6AC090317D} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {7EF272F8-BF45-407F-8EA8-491BCF10484D} - System32\Tasks\Security Center Update - 1470752179 => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe <==== ATTENTION
Task: {824D0E25-34F7-4A9B-955C-F547B3AC0EF5} - System32\Tasks\HPCeeScheduleForDaddy => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {83EBCF72-468D-474E-AB66-26A857AE3C71} - System32\Tasks\HPCustParticipation HP Deskjet 3050A J611 series => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-06-08] (Hewlett-Packard Co.)
Task: {8C751A7C-F4D8-4570-8A12-3EBDA148E924} - System32\Tasks\Security Center Update - 3197449427 => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe <==== ATTENTION
Task: {99AF1223-5EE3-4D42-9EF8-C339EA350627} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {9DCEE8C4-3700-4BA8-9B4E-356E792B7633} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2418151325-680678365-4071922823-1001
Task: {A0D0A5BB-5AF7-4E81-938D-2720378935B8} - System32\Tasks\BitGuard => Sc.exe start BitGuard <==== ATTENTION
Task: {A667FD9A-6B0D-419D-8982-CE22A6BA1662} - \pcreg No Task File <==== ATTENTION
Task: {C18B431B-201D-41CE-AB6D-403F5C03E34A} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
Task: {C230D45E-A458-4C0E-80C0-F6214B61B6C5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {D09D2C62-5BB7-4BCD-8677-8334474090BA} - System32\Tasks\{A1BE5E4B-F6ED-47AD-8BAF-E027EE4DBA62} => C:\Windows\system32\mvugsv.dll [2014-10-13] ()
Task: {D2623B81-FC81-4781-9C9F-5C7D64F702F4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GS_Booster-S-576482620.job => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\HPCeeScheduleForDaddy.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\Security Center Update - 1470752179.job => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 2042579260.job => C:\Users\Daddy\AppData\Roaming\Sedoimry\eqrygi.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 3197449427.job => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPAdvisorDock => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: InstaLAN => "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: MobileDocuments => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartMenu => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent

========================= Accounts: ==========================

Administrator (S-1-5-21-2418151325-680678365-4071922823-500 - Administrator - Disabled)
Daddy (S-1-5-21-2418151325-680678365-4071922823-1001 - Administrator - Enabled) => C:\Users\Daddy
Guest (S-1-5-21-2418151325-680678365-4071922823-501 - Administrator - Disabled)
HomeGroupUser$ (S-1-5-21-2418151325-680678365-4071922823-1002 - Administrator - Enabled)

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/02/2014 11:57:37 AM) (Source: HP Advisor) (EventID: 400) (User: )
Description: Timestamp: 12/02/2014 11:57:37.912;
Category: FATAL;
Priority:(4);
Win32 Thread Id: [8196];
Message: Application::OnStartup() failed !!!, shutdown application... ;
EventId: 400;
Severity: Critical;
Machine: HAL;
Application Domain: HPAdvisor.exe;
Process Id: 8216;
Process Name: C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe;
Extended Properties:

Error: (12/02/2014 11:53:07 AM) (Source: MsiInstaller) (EventID: 11706) (User: HAL)
Description: Product: Microsoft Office XP Professional with FrontPage -- Error 1706. Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see C:\Program Files (x86)\Microsoft Office\Office10\1033\SETUP.HLP.

Error: (12/02/2014 11:39:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x81000101).

Error: (11/29/2014 00:33:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521eaf24
Exception code: 0xc000070a
Fault offset: 0x000000000005cf99
Faulting process id: 0x9cc
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3

Error: (11/29/2014 11:13:41 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x800706b5, The interface is unknown.
.

Error: (11/29/2014 11:13:41 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x800706b5, The interface is unknown.
]

Error: (11/29/2014 11:13:40 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x800706b5, The interface is unknown.
.

Error: (11/29/2014 11:13:40 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x800706b5, The interface is unknown.
]

Error: (11/29/2014 11:11:57 AM) (Source: Windows Search Service) (EventID: 3100) (User: )
Description: Unable to initialize the filter host process. Terminating.


Details:
This operation returned because the timeout period expired. (HRESULT : 0x800705b4) (0x800705b4)

Error: (11/28/2014 00:11:59 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x81000101).


System errors:
=============
Error: (12/06/2014 11:41:58 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:27 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (12/06/2014 11:40:27 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/06/2014 11:40:26 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (12/06/2014 11:40:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068


Microsoft Office Sessions:
=========================
Error: (12/02/2014 11:57:37 AM) (Source: HP Advisor) (EventID: 400) (User: )
Description: Timestamp: 12/02/2014 11:57:37.912;
Category: FATAL;
Priority:(4);
Win32 Thread Id: [8196];
Message: Application::OnStartup() failed !!!, shutdown application... ;
EventId: 400;
Severity: Critical;
Machine: HAL;
Application Domain: HPAdvisor.exe;
Process Id: 8216;
Process Name: C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe;
Extended Properties:

Error: (12/02/2014 11:53:07 AM) (Source: MsiInstaller) (EventID: 11706) (User: HAL)
Description: Product: Microsoft Office XP Professional with FrontPage -- Error 1706. Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see C:\Program Files (x86)\Microsoft Office\Office10\1033\SETUP.HLP.(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (12/02/2014 11:39:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x81000101

Error: (11/29/2014 00:33:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.18247521eaf24c000070a000000000005cf999cc01d00bf879cb927bC:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll4788be1d-77f6-11e4-a6f7-d4856418c280

Error: (11/29/2014 11:13:41 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x800706b5, The interface is unknown.

Error: (11/29/2014 11:13:41 AM) (Source: VSS) (EventID: 13) (User: )
Description: {4e14fba2-2e22-11d1-9964-00c04fbbb345}CEventSystem0x800706b5, The interface is unknown.

Error: (11/29/2014 11:13:40 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x800706b5, The interface is unknown.

Error: (11/29/2014 11:13:40 AM) (Source: VSS) (EventID: 13) (User: )
Description: {4e14fba2-2e22-11d1-9964-00c04fbbb345}CEventSystem0x800706b5, The interface is unknown.

Error: (11/29/2014 11:11:57 AM) (Source: Windows Search Service) (EventID: 3100) (User: )
Description:
Details:
This operation returned because the timeout period expired. (HRESULT : 0x800705b4) (0x800705b4)

Error: (11/28/2014 00:11:59 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x81000101


==================== Memory info ===========================

Processor: AMD Athlon™ II X2 250 Processor
Percentage of memory in use: 16%
Total physical RAM: 4863.29 MB
Available physical RAM: 4062.42 MB
Total Pagefile: 9726.57 MB
Available Pagefile: 8969.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.54 GB) (Free:508.71 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:11.87 GB) (Free:1.45 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: F658CB99)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=919.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11.9 GB) - (Type=07 NTFS)

==================== End Of Log =========================


  • 0

#5
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

Is there a reason that you ran the logs in Safe Mode? Are you not able to run them in Normal mode?


  • 0

#6
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

Thanks for the logs. You have many infections and a patched windows file so it will take a few passes to get you clean. Please follow the instructions below.
 
Step#1 - FRST Fix
 
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download attached file and save it to the DesktopAttached File  fixlist.txt   10.77KB   208 downloads
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 
Step#2 - File Identification
1. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
2. Copy rpcss.dll and paste it into the Search box of the FRST window.
3. Click the Search Files button.
4. When the search is done it will open a notepad window with the results. Can you copy/paste the contents of this window into your next post?

 
Items for your next post

1. FRST Fix Log
2. FRST Search Log


  • 0

#7
alrn214

alrn214

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts

Thanks i ran it is safe mode because the virus was just slowing down my system so much. I ran the fixlog the search is still running an I have to head to bed. I think it's taking so long because there is teo explorer.exe running and one is taking up 86% of my processing power. think it may be update related. so I'll let it run and see if I can get the search log for you soon i may have to run in safe mode. I work the next few days so there will be a delay sorry. here is my fixlog:

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-12-2014 02
Ran by Daddy at 2014-12-07 22:52:58 Run:1
Running from C:\Users\Daddy\Desktop
Loaded Profile: Daddy (Available profiles: Daddy)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM\...\Run: [pcreg] => C:\Program Files\pcreg\service.exe
C:\Program Files\pcreg
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\oxnlwag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnlwag.dll ()
Winlogon\Notify\oxnmkag-x32: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnmkag.dll ()
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnlwag.dll
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnmkag.dll
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Sebuyfpipe] => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Run: [Yhsise] => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Run: [MasgAteri] => regsvr32.exe "C:\ProgramData\MasgAteri\MasgAteri.dat"
C:\ProgramData\MasgAteri
HKU\S-1-5-18\...\Run: [HonudZuwwo] => regsvr32.exe "C:\ProgramData\HonudZuwwo\HonudZuwwo.dat"
C:\ProgramData\HonudZuwwo
HKU\S-1-5-18\...\Run: [oxnmkag] => rundll32 "C:\Windows\system32\config\systemprofile\AppData\Local\oxnmkag.dll",oxnmkag <===== ATTENTION
C:\Windows\system32\config\systemprofile\AppData\Local\oxnmkag.dll
HKU\S-1-5-18\...\Run: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe
HKU\S-1-5-18\...\RunOnce: [rdrmemptylst] => C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe [134656 2014-03-04] ()
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Policies\Explorer: [Run] "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe (Anubisel Corporatu)
C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\.DEFAULT\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylo...000d4856418c280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.v9.com...q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?t...=WDCXWD1001FAES
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.v9.com...q={searchTerms}
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL = http://www.ask.com/w...}&l=dis&o=ushpd
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.v9.com/we...q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {EDCF6BB3-29DA-4EE9-A8C0-055D31AAB204} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> DefaultScope 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> URL http://search.condui...rchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> SuggestionsURL_JSON http://suggest.searc...x={searchTerms}
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> 50DA95C4697B43C9AA069B8051E4B6C2 URL = http://search.babylo...000d4856418c280
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {33532E57-ED6E-4D55-A0B4-A91A2D3A7A46} URL =
SearchScopes: HKU\S-1-5-21-2418151325-680678365-4071922823-1001 -> {FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5} URL =
BHO: Start Savin BHO -> {181F2C09-56DD-4F98-86D7-59BA2BC59B5A} -> C:\Program Files (x86)\Start Savin\FrameworkBHO64.dll No File
C:\Program Files (x86)\Start Savin
BHO: YoutubeAdBlocke -> {6c74318f-cf02-41c3-b044-f44006112093} -> C:\Program Files (x86)\YoutubeAdBlocke\2hnE6l2EEaexfW.x64.dll ()
C:\Program Files (x86)\YoutubeAdBlocke
FF SearchEngineOrder.1: Search the web (Babylon)
FF Homepage: hxxp://www.v9.com/?type=hp&ts=1415423197&from=cor&uid=WDCXWD1001FAES
FF user.js: detected! => C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\bing-zugo.xml
FF SearchPlugin: C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\google-default.xml
FF Extension: Coupons.com CouponBar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\Coupons.com [2013-12-05]
FF Extension: Babylon Toolbar - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2012-12-08]
FF Extension: GoSave - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF Extension: YoutubeAdBlocke - C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] [2014-11-10]
FF HKLM-x32\...\Firefox\Extensions: [{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}] - C:\Program Files (x86)\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi
C:\Program Files (x86)\Coupons.com CouponBar
S4 IHProtect Service; C:\Program Files (x86)\STab\ProtectService.exe [158864 2014-11-05] (TODO: <Company name>)
C:\Program Files (x86)\STab
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [cnpkmcjgpcihgfnkcjapiaabbbplkcmf] - C:\Program Files (x86)\Coupons.com CouponBar\chrome\Coupons.com.crx []
CHR HKLM-x32\...\Chrome\Extension: [lcnnhcneegeeojhgpfijnlnocjdmlaon] - C:\ProgramData\ValueApps\CH\ValueApps.crx [2014-01-10]
C:\ProgramData\ValueApps
S4 fc67e7a0; [X]
S4 pcregservice; [X]
S1 yiiuobyi; \??\C:\Windows\system32\drivers\yiiuobyi.sys [X]
C:\Windows\system32\drivers\yiiuobyi.sys
C:\ProgramData\HeciBawuw
2014-11-25 01:28 - 2014-11-25 01:28 - 00000806 _____ () C:\Windows\Tasks\Security Center Update - 2042579260.job
2014-11-25 01:27 - 2014-12-05 22:00 - 00000800 _____ () C:\Windows\Tasks\Security Center Update - 3197449427.job
2014-11-25 01:27 - 2014-11-25 01:27 - 00003808 _____ () C:\Windows\System32\Tasks\Security Center Update - 3197449427
2014-11-07 23:42 - 2014-12-06 23:26 - 00000476 ____H () C:\Windows\Tasks\GS_Booster-S-576482620.job
C:\ProgramData\GoSave
C:\ProgramData\YoutubeAdBlocke
C:\ProgramData\1f2ee141e8770edc
C:\Users\HomeGroupUser$\AppData\Local\Torch
C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
C:\Users\Guest\AppData\Local\Torch
C:\Users\Guest\AppData\Local\Chromatic Browser
C:\Users\Administrator\AppData\Local\Torch
C:\Users\Administrator\AppData\Local\Chromatic Browser
C:\ProgramData\BoostSoftware
C:\Users\Daddy\AppData\Roaming\DigitalSites
C:\ProgramData\IHProtectUpDate
CustomCLSID: HKU\S-1-5-21-2418151325-680678365-4071922823-1001_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\umpo.dll (Microsoft Corporation)
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
Task: {3C374920-A6E0-43FE-AF59-DB57BDCD7CAC} - \GS_Booster-S-576482620 No Task File <==== ATTENTION
Task: {7EF272F8-BF45-407F-8EA8-491BCF10484D} - System32\Tasks\Security Center Update - 1470752179 => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe <==== ATTENTION
C:\Users\Daddy\AppData\Roaming\Uzucxe
Task: {8C751A7C-F4D8-4570-8A12-3EBDA148E924} - System32\Tasks\Security Center Update - 3197449427 => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe <==== ATTENTION
C:\Users\Daddy\AppData\Roaming\Maavty\
Task: {A0D0A5BB-5AF7-4E81-938D-2720378935B8} - System32\Tasks\BitGuard => Sc.exe start BitGuard <==== ATTENTION
Task: {A667FD9A-6B0D-419D-8982-CE22A6BA1662} - \pcreg No Task File <==== ATTENTION
Task: {C18B431B-201D-41CE-AB6D-403F5C03E34A} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
Task: {D09D2C62-5BB7-4BCD-8677-8334474090BA} - System32\Tasks\{A1BE5E4B-F6ED-47AD-8BAF-E027EE4DBA62} => C:\Windows\system32\mvugsv.dll [2014-10-13] ()
C:\Windows\system32\mvugsv.dll
Task: C:\Windows\Tasks\GS_Booster-S-576482620.job => c:\programdata\trusted publisher\gs_booster\GS_Booster.exe <==== ATTENTION
c:\programdata\trusted publisher\
Task: C:\Windows\Tasks\Security Center Update - 1470752179.job => C:\Users\Daddy\AppData\Roaming\Uzucxe\kaitma.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 2042579260.job => C:\Users\Daddy\AppData\Roaming\Sedoimry\eqrygi.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 3197449427.job => C:\Users\Daddy\AppData\Roaming\Maavty\uqfatyu.exe <==== ATTENTION
C:\Users\Daddy\AppData\Roaming\Sedoimry
C:\Users\Daddy\AppData\Roaming\Maavty
Hosts:
cmd:ipconfig /flushdns
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services" /F
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
cmd:type c:\combofix.txt
cmd:bitsadmin /reset /allusers




*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\pcreg => value deleted successfully.
C:\Program Files\pcreg => Moved successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\oxnlwag" => Key deleted successfully.
"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\oxnmkag" => Key deleted successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnlwag.dll => Moved successfully.
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\oxnmkag.dll => Moved successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAHealth => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\TaskbarNoNotification => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Sebuyfpipe => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Yhsise => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAHealth => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\TaskbarNoNotification => value deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\MasgAteri => value deleted successfully.
C:\ProgramData\MasgAteri => Moved successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\HonudZuwwo => value deleted successfully.
C:\ProgramData\HonudZuwwo => Moved successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\oxnmkag => value deleted successfully.
"C:\Windows\system32\config\systemprofile\AppData\Local\oxnmkag.dll" => File/Directory not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\rdrmemptylst => value deleted successfully.
C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IEUpdate\rdrmemptylst.exe => Moved successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\rdrmemptylst => value deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAHealth => value deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\TaskbarNoNotification => value deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\Run => value deleted successfully.
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe => Moved successfully.
"C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe" => File/Directory not found.
C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe not found.
"C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hivoug.exe" => File/Directory not found.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\.DEFAULT\SOFTWARE\Policies\Google" => Key deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\Software\Microsoft\Internet Explorer\Main\\bProtector Start Page => value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.
"HKCR\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key deleted successfully.
"HKCR\CLSID\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\bProtectorDefaultScope => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => value deleted successfully.
HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => value deleted successfully.
"HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\50DA95C4697B43C9AA069B8051E4B6C2" => Key deleted successfully.
"HKCR\CLSID\50DA95C4697B43C9AA069B8051E4B6C2" => Key not found.
"HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.
"HKCR\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key not found.
"HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key deleted successfully.
"HKCR\CLSID\{33532E57-ED6E-4D55-A0B4-A91A2D3A7A46}" => Key not found.
"HKU\S-1-5-21-2418151325-680678365-4071922823-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5}" => Key deleted successfully.
"HKCR\CLSID\{FCA087C2-F14C-4F8F-B004-F2EDA8BA0EE5}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{181F2C09-56DD-4F98-86D7-59BA2BC59B5A}" => Key deleted successfully.
"HKCR\CLSID\{181F2C09-56DD-4F98-86D7-59BA2BC59B5A}" => Key deleted successfully.
"C:\Program Files (x86)\Start Savin" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c74318f-cf02-41c3-b044-f44006112093}" => Key deleted successfully.
"HKCR\CLSID\{6c74318f-cf02-41c3-b044-f44006112093}" => Key deleted successfully.
C:\Program Files (x86)\YoutubeAdBlocke => Moved successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox homepage deleted successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\user.js => Moved successfully.
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.) => Error: No automatic fix found for this entry.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\ask-search.xml => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\babylon1.xml => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\bing-zugo.xml => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\searchplugins\google-default.xml => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\Coupons.com => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] => Moved successfully.
C:\Users\Daddy\AppData\Roaming\Mozilla\Firefox\Profiles\nurj2h8b.default\Extensions\[email protected] => Moved successfully.
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D} => value deleted successfully.
"C:\Program Files (x86)\Coupons.com CouponBar" => File/Directory not found.
IHProtect Service => Service deleted successfully.
C:\Program Files (x86)\STab => Moved successfully.
CHR dev: Chrome dev build detected! <======= ATTENTION => Error: No automatic fix found for this entry.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cnpkmcjgpcihgfnkcjapiaabbbplkcmf" => Key deleted successfully.
"C:\Program Files (x86)\Coupons.com CouponBar\chrome\Coupons.com.crx" => File/Directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon" => Key deleted successfully.
C:\ProgramData\ValueApps\CH\ValueApps.crx => Moved successfully.
C:\ProgramData\ValueApps => Moved successfully.
fc67e7a0 => Service deleted successfully.
pcregservice => Service deleted successfully.
yiiuobyi => Service deleted successfully.
"C:\Windows\system32\drivers\yiiuobyi.sys" => File/Directory not found.
C:\ProgramData\HeciBawuw => Moved successfully.
C:\Windows\Tasks\Security Center Update - 2042579260.job => Moved successfully.
C:\Windows\Tasks\Security Center Update - 3197449427.job => Moved successfully.
C:\Windows\System32\Tasks\Security Center Update - 3197449427 => Moved successfully.
C:\Windows\Tasks\GS_Booster-S-576482620.job => Moved successfully.
C:\ProgramData\GoSave => Moved successfully.
C:\ProgramData\YoutubeAdBlocke => Moved successfully.
C:\ProgramData\1f2ee141e8770edc => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Torch => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\Guest\AppData\Local\Torch => Moved successfully.
C:\Users\Guest\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\Administrator\AppData\Local\Torch => Moved successfully.
C:\Users\Administrator\AppData\Local\Chromatic Browser => Moved successfully.
C:\ProgramData\BoostSoftware => Moved successfully.
C:\Users\Daddy\AppData\Roaming\DigitalSites => Moved successfully.
C:\ProgramData\IHProtectUpDate => Moved successfully.
"HKU\S-1-5-21-2418151325-680678365-4071922823-1001_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}" => Key deleted successfully.

"C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" directory move:

Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a" => Scheduled to move on reboot.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\eaq.tmp" => Scheduled to move on reboot.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\gauuyc.tmp => Moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\gmsaam.tmp => Moved successfully.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\umpo.dll" => Scheduled to move on reboot.
Could not move "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}" directory. => Scheduled to move on reboot.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3C374920-A6E0-43FE-AF59-DB57BDCD7CAC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3C374920-A6E0-43FE-AF59-DB57BDCD7CAC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GS_Booster-S-576482620" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7EF272F8-BF45-407F-8EA8-491BCF10484D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EF272F8-BF45-407F-8EA8-491BCF10484D}" => Key deleted successfully.
C:\Windows\System32\Tasks\Security Center Update - 1470752179 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 1470752179" => Key deleted successfully.
"C:\Users\Daddy\AppData\Roaming\Uzucxe" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C751A7C-F4D8-4570-8A12-3EBDA148E924}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C751A7C-F4D8-4570-8A12-3EBDA148E924}" => Key deleted successfully.
C:\Windows\System32\Tasks\Security Center Update - 3197449427 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Security Center Update - 3197449427" => Key deleted successfully.
"C:\Users\Daddy\AppData\Roaming\Maavty" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A0D0A5BB-5AF7-4E81-938D-2720378935B8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0D0A5BB-5AF7-4E81-938D-2720378935B8}" => Key deleted successfully.
C:\Windows\System32\Tasks\BitGuard => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BitGuard" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A667FD9A-6B0D-419D-8982-CE22A6BA1662}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A667FD9A-6B0D-419D-8982-CE22A6BA1662}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\pcreg" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C18B431B-201D-41CE-AB6D-403F5C03E34A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C18B431B-201D-41CE-AB6D-403F5C03E34A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D09D2C62-5BB7-4BCD-8677-8334474090BA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D09D2C62-5BB7-4BCD-8677-8334474090BA}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A1BE5E4B-F6ED-47AD-8BAF-E027EE4DBA62} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1BE5E4B-F6ED-47AD-8BAF-E027EE4DBA62}" => Key deleted successfully.
C:\Windows\system32\mvugsv.dll => Moved successfully.
C:\Windows\Tasks\GS_Booster-S-576482620.job not found.
c:\programdata\trusted publisher => Moved successfully.
C:\Windows\Tasks\Security Center Update - 1470752179.job => Moved successfully.
C:\Windows\Tasks\Security Center Update - 2042579260.job not found.
C:\Windows\Tasks\Security Center Update - 3197449427.job not found.
"C:\Users\Daddy\AppData\Roaming\Sedoimry" => File/Directory not found.
"C:\Users\Daddy\AppData\Roaming\Maavty" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services" /F =========

The operation completed successfully.



========= End of Reg: =========


========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\services" /F =========

The operation completed successfully.



========= End of Reg: =========


========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

The operation completed successfully.



========= End of Reg: =========


========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

The operation completed successfully.



========= End of Reg: =========


========= type c:\combofix.txt =========

The system cannot find the file specified.

========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========


=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-07 23:01:30)<=

C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\eaq.tmp => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\umpo.dll => Is moved successfully.
C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} => Is moved successfully.

==== End of Fixlog ====


  • 0

#8
BrianDrab

BrianDrab

    Trusted Helper

  • Malware Removal
  • 3,591 posts

Are you still going to get the search results file?


  • 0

#9
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP