Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Computer infected, can't find source or how to delete it. PLZ HELP

Started by TDanielek , Jun 03 2015 01:52 PM

This topic is locked

#1
TDanielek

Posted 03 June 2015 - 01:52 PM

New Member

Member
3 posts

Hi!

I've had my computer in storage after lending it to my younger sister. Now, that i have it up and running there I realize a lot of ads keep on popping up. I am unsure how to find the source of the problem, much less fix it.

Any assistance in this matter would be greatly appreciated!

I've pasted the a copy of the log below.

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-06-2015

Ran by Danielek at 2015-06-03 12:36:37

Running from C:\Users\Danielek\Downloads

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1935842042-1800119050-1235597994-500 - Administrator - Disabled)

Danielek (S-1-5-21-1935842042-1800119050-1235597994-1000 - Administrator - Enabled) => C:\Users\Danielek

Guest (S-1-5-21-1935842042-1800119050-1235597994-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1935842042-1800119050-1235597994-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)

Adobe Reader X (10.1.3) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)

AVG SafeGuard toolbar (HKLM\...\AVG SafeGuard toolbar) (Version: 14.2.0.1 - AVG Technologies)

Driver Pro v3.0 (HKLM\...\Driver Pro_is1) (Version: 3.0 - PC Utilities Pro) <==== ATTENTION

Garmin BaseCamp (HKLM\...\{22613FA5-4D3B-4EE5-8E4A-39EBE649324E}) (Version: 3.3.3 - Garmin Ltd or its subsidiaries)

Garmin TOPO U.S. 24K Southwest v2 (HKLM\...\{7CAD9E56-C6BA-4911-A519-AF4DE21C4129}) (Version: 2.0.0.0 - Garmin Ltd or its subsidiaries)

Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)

Google Chrome (HKU\S-1-5-21-1935842042-1800119050-1235597994-1000\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.21.135 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden

iLivid (HKLM\...\iLivid) (Version: 1.92 - Bandoo Media Inc) <==== ATTENTION

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)

Microsoft Office Converter Pack (HKLM\...\{6EECB283-E65F-40EF-86D3-D51BF02A8D43}) (Version: 11.0.0.0 - Microsoft Corporation - Office Resource Kit Group)

Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20125.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

MotoHelper MergeModules (Version: 1.2.0 - Motorola) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Norton Security Scan (HKLM\...\NSS) (Version: 3.7.6.5 - Symantec Corporation)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)

Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)

PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2414.0 - CyberLink Corporation)

RealDownloader (Version: 1.3.0 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden

RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden

Searchqu Toolbar (HKLM\...\Searchqu Toolbar) (Version: 4.1.0.2881 - Bandoo Media Inc) <==== ATTENTION

Unity Web Player (HKU\S-1-5-21-1935842042-1800119050-1235597994-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)

Yontoo 2.04.1 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 2.04.1 - Yontoo LLC) <==== ATTENTION

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.21.135\psuser.dll No File

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Danielek\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Chrome\Application\43.0.2357.81\delegate_execute.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.21.123\psuser.dll No File

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.26.9\psuser.dll No File

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.21.115\psuser.dll No File

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.27.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1935842042-1800119050-1235597994-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Danielek\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File

==================== Restore Points =========================

03-06-2015 11:46:49 Windows Update

03-06-2015 11:54:07 Removed MOTOROLA MEDIA LINK.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:04 - 2009-06-10 14:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {41509368-B2AC-41B3-96DB-AE496CF0231A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2007-03-01] (Google Inc.)

Task: {457680D2-3A7A-40F6-8E4D-886B8A98FD6E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2007-03-01] (Google Inc.)

Task: {52A5C21B-FDE2-4DAF-A1CC-7CA680B46452} - System32\Tasks\{983F34BE-9F84-4330-A5A5-93C779CAE5B4} => pcalua.exe -a C:\Garmin\MapInstall.exe -d C:\Garmin\

Task: {6BBF715D-3D69-4D44-8D5F-D777F5A16780} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1935842042-1800119050-1235597994-1000UA => C:\Users\Danielek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-29] (Google Inc.)

Task: {8AA4517E-750E-436C-B123-49AFEBBA637D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1935842042-1800119050-1235597994-1000Core => C:\Users\Danielek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-29] (Google Inc.)

Task: {95A49598-A6A5-432A-A2DF-227CE012EE15} - System32\Tasks\Norton Security Scan for Danielek => C:\Program Files\Norton Security Scan\Engine\3.7.6.5\Nss.exe [2012-10-22] (Symantec Corporation)

Task: {B775E4B5-4947-419D-953F-8BCDD4E4FDCD} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1935842042-1800119050-1235597994-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

Task: {BA4D178A-926B-46BD-BB9F-271B80F9DE66} - System32\Tasks\Test TimeTrigger => C:\Users\Danielek\AppData\Local\Temp\Runner.exe [2012-11-02] () <==== ATTENTION

Task: {E17F06C6-4C6C-4E97-972A-B4B5848D4769} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-03] (Adobe Systems Incorporated)

Task: {EE70EDF5-82FC-43FA-B9D1-E3103EFE428E} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1935842042-1800119050-1235597994-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935842042-1800119050-1235597994-1000Core.job => C:\Users\Danielek\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935842042-1800119050-1235597994-1000UA.job => C:\Users\Danielek\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\Norton Security Scan for Danielek.job => C:\PROGRA~1\NORTON~2\Engine\376~1.5\Nss.exe

==================== Loaded Modules (Whitelisted) ==============

2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe

2012-06-06 20:56 - 2005-08-07 22:54 - 00167936 ____N () C:\Program Files\CyberLink\Shared Files\RichVideo.exe

2013-03-06 12:47 - 2013-03-06 12:47 - 00968880 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe

2013-05-14 02:30 - 2015-06-03 12:15 - 00013600 _____ () C:\Users\Danielek\AppData\Roaming\Yontoo\dat\Desktop.OS.Plugin.dll

2007-03-01 00:12 - 2015-05-22 13:22 - 01281864 _____ () C:\Users\Danielek\AppData\Local\Google\Chrome\Application\43.0.2357.81\libglesv2.dll

2007-03-01 00:12 - 2015-05-22 13:22 - 00080712 _____ () C:\Users\Danielek\AppData\Local\Google\Chrome\Application\43.0.2357.81\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1935842042-1800119050-1235597994-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Danielek\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 68.105.28.11 - 68.105.29.11

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: 24x7HELP => "C:\Program Files\24x7Help\App24x7Help.exe" /STARTUP

MSCONFIG\startupreg: PCFixSpeed => "C:\Program Files\PCFixSpeed\PCFixTray.exe" /startup

MSCONFIG\startupreg: TkBellExe => "c:\program files\real\realplayer\Update\realsched.exe" -osboot

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{171EEC41-A32C-412E-8868-74C0EFD4E974}] => (Allow) C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe

FirewallRules: [{1B3AB075-4559-45B6-AD77-689B65AFB4EF}] => (Allow) C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe

FirewallRules: [TCP Query User{194D2643-FF8B-4ED4-9623-95CD36C1BFC2}C:\users\danielek\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\danielek\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{3F9F8742-BB2E-403B-A603-57AF187E5715}C:\users\danielek\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\danielek\appdata\roaming\spotify\spotify.exe

FirewallRules: [TCP Query User{2B767154-034C-45BC-BA05-204C7FE28198}C:\program files\motorola media link\lite\mml.exe] => (Allow) C:\program files\motorola media link\lite\mml.exe

FirewallRules: [UDP Query User{CE1BC83F-1D23-49E4-AF17-4241B0A63460}C:\program files\motorola media link\lite\mml.exe] => (Allow) C:\program files\motorola media link\lite\mml.exe

FirewallRules: [TCP Query User{22386547-7223-41F1-9C6A-C4536CF9E178}C:\users\danielek\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\danielek\appdata\roaming\spotify\spotify.exe

FirewallRules: [UDP Query User{342525AF-A396-4EF9-9F76-BFF9D89B934F}C:\users\danielek\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\danielek\appdata\roaming\spotify\spotify.exe

==================== Faulty Device Manager Devices =============

Name: Mass Storage Controller

Description: Mass Storage Controller

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (03/01/2007 00:54:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Description: Failed extract of third-party root list from auto update cab at: <http://ctldl.windows...uthrootstl.cab>with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (03/01/2007 00:54:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

Error: (03/01/2007 00:54:33 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )

System errors:

=============

Error: (06/03/2015 00:12:15 PM) (Source: TPM) (EventID: 15) (User: )

Description: The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.

Error: (06/03/2015 11:54:31 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (06/03/2015 11:54:27 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (06/03/2015 11:47:12 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (06/03/2015 11:47:09 AM) (Source: Disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk0\DR0, has a bad block.

Error: (03/01/2007 00:03:14 AM) (Source: TPM) (EventID: 15) (User: )

Error: (03/01/2007 00:03:14 AM) (Source: TPM) (EventID: 2) (User: )

Description: The TPM self test command failed.

Error: (03/01/2007 06:55:39 AM) (Source: TPM) (EventID: 12) (User: )

Description: The device driver for the Trusted Platform Module (TPM) encountered an error in the TPM hardware, which might prevent some applications using TPM services from operating correctly. Please restart your computer to reset the TPM hardware. For further assistance on this hardware issue, please contact the computer manufacturer for more information.

Error: (03/01/2007 06:55:23 AM) (Source: TPM) (EventID: 15) (User: )

Error: (03/01/2007 06:55:23 AM) (Source: TPM) (EventID: 2) (User: )

Description: The TPM self test command failed.

Microsoft Office:

=========================

Error: (03/01/2007 00:54:34 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: )