TechSpot

PRS for music virus

Solved
By Dan James
Sep 30, 2012
  1. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    You ran it from within Windows.
    Re-read my reply #9 how to run it.
     
  2. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-10-2012 01 (ATTENTION: FRST version is 21 days old)
    Ran by SYSTEM at 23-10-2012 21:07:09
    Running from E:\
    Windows 7 Home Premium (X64) OS Language: English(US)
    The current controlset is ControlSet001
    ==================== Registry (Whitelisted) ===================
    HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2247976 2010-07-14] (Synaptics Incorporated)
    HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6486120 2010-09-03] (Realtek Semiconductor)
    HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3 [2120808 2010-09-03] (Realtek Semiconductor)
    HKLM\...\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start [283240 2010-08-12] (NVIDIA Corporation)
    HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1928976 2010-03-05] (Intel(R) Corporation)
    HKLM\...\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [727664 2010-09-24] ()
    HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1289704 2012-09-12] (Microsoft Corporation)
    HKLM-x32\...\Run: [NUSB3MON] "c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-04-27] (Renesas Electronics Corporation)
    HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
    HKLM-x32\...\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m [1807680 2010-02-09] ()
    HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [487562 2010-08-19] (Creative Technology Ltd)
    HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-09-04] (Sonic Solutions)
    HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [518640 2010-09-03] ()
    HKLM-x32\...\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [206064 2009-05-21] (SupportSoft, Inc.)
    HKLM-x32\...\Run: [Absolute Notifier] "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe" [86184 2010-10-08] (Absolute Software)
    HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-10-02] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [935288 2009-09-04] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 194.74.65.68 194.74.65.69
    AppInit_DLLs: C:\Windows\System32\nvinitx.dll
    Startup: C:\Users\Alex Skittery\Start Menu\Programs\Startup\ctfmon.lnk
    ShortcutTarget: ctfmon.lnk -> C:\ProgramData\lsass.exe (Microsoft Corporation)
    Startup: C:\Users\Alex Skittery\Start Menu\Programs\Startup\Dell Dock.lnk
    ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
    ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
    Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    ==================== Services (Whitelisted) ===================
    2 AbsoluteNotifier; "C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe" [10408 2010-10-08] (Microsoft)
    2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [22072 2012-09-12] (Microsoft Corporation)
    3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
    3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [368896 2012-09-12] (Microsoft Corporation)
    2 Secunia PSI Agent; "C:\Program Files (x86)\Secunia\PSI\PSIA.exe" --start-service [1301088 2012-05-29] (Secunia)
    2 Secunia Update Agent; "C:\Program Files (x86)\Secunia\PSI\sua.exe" --start-service [681056 2012-05-29] (Secunia)
    ==================== Drivers (Whitelisted) =====================
    0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [367912 2011-11-14] (PC Tools)
    0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [453896 2011-12-01] (PC Tools)
    0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [1096688 2011-12-01] (PC Tools)
    1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [230952 2012-02-24] (PC Tools)
    2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()
    3 catchme; \??\C:\ComboFix\catchme.sys [x]
    ==================== NetSvcs (Whitelisted) ====================

    ==================== One Month Created Files and Folders ========
    2012-10-23 13:37 - 2012-10-23 13:39 - 00000793 ____A C:\Users\Alex Skittery\Downloads\Search.txt
    2012-10-23 13:33 - 2012-10-23 13:35 - 00043395 ____A C:\Users\Alex Skittery\Downloads\FRST.txt
    2012-10-23 13:32 - 2012-10-23 13:32 - 01459119 ____A (Farbar) C:\Users\Alex Skittery\Downloads\FRST64.exe
    2012-10-23 13:20 - 2012-10-23 13:20 - 00003224 ____N C:\bootsqm.dat
    2012-10-23 13:05 - 2012-10-23 13:16 - 83023306 ___AT C:\Users\All Users\Application Data\0tbpw.pad
    2012-10-23 13:05 - 2012-10-23 13:16 - 83023306 ___AT C:\Users\All Users\0tbpw.pad
    2012-10-23 13:05 - 2012-10-23 13:05 - 00044544 ____A (Microsoft Corporation) C:\Users\All Users\lsass.exe
    2012-10-23 13:05 - 2012-10-23 13:05 - 00044544 ____A (Microsoft Corporation) C:\Users\All Users\Application Data\lsass.exe
    2012-10-23 12:52 - 2012-10-23 12:52 - 00000165 ___AH C:\Users\Alex Skittery\Desktop\~$work.xlsx
    2012-10-23 11:23 - 2012-10-23 11:23 - 00000273 ____A C:\Users\Alex Skittery\Desktop\ESETScan.txt
    2012-10-23 04:53 - 2012-10-23 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
    2012-10-23 02:33 - 2012-10-23 02:33 - 02322184 ____A (ESET) C:\Users\Alex Skittery\Downloads\esetsmartinstaller_enu(1).exe
    2012-10-22 15:44 - 2012-10-22 15:44 - 02322184 ____A (ESET) C:\Users\Alex Skittery\Downloads\esetsmartinstaller_enu.exe
    2012-10-22 15:44 - 2012-10-22 15:44 - 00000000 ____D C:\Program Files (x86)\ESET
    2012-10-22 15:33 - 2012-10-22 15:33 - 00448512 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\TFC(1).exe
    2012-10-22 15:00 - 2012-10-22 15:00 - 00448512 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\TFC.exe
    2012-10-22 14:26 - 2012-10-22 14:27 - 00002908 ____A C:\Users\Alex Skittery\Downloads\FSS.txt
    2012-10-22 14:26 - 2012-10-22 14:26 - 00694323 ____A (Farbar) C:\Users\Alex Skittery\Downloads\FSS.exe
    2012-10-22 14:22 - 2012-10-22 14:22 - 00881773 ____A C:\Users\Alex Skittery\Downloads\SecurityCheck.exe
    2012-10-22 14:05 - 2012-10-22 14:05 - 00000000 ____D C:\_OTL
    2012-10-14 14:29 - 2012-10-14 14:57 - 00000000 ____D C:\Users\Alex Skittery\Desktop\wall pics
    2012-10-13 13:57 - 2012-10-13 13:57 - 03177840 ____A (McAfee, Inc.) C:\Users\Alex Skittery\Downloads\MCPR.exe
    2012-10-10 12:11 - 2012-10-10 12:11 - 00064656 ____A C:\Users\Alex Skittery\Desktop\Extras.Txt
    2012-10-10 12:09 - 2012-10-16 12:12 - 00097622 ____A C:\Users\Alex Skittery\Desktop\OTL.Txt
    2012-10-10 12:00 - 2012-10-10 12:00 - 00602112 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\OTL.exe
    2012-10-10 12:00 - 2012-10-10 12:00 - 00602112 ____A (OldTimer Tools) C:\Users\Alex Skittery\Desktop\OTL.exe
    2012-10-10 11:23 - 2012-08-31 13:02 - 01656688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
    2012-10-10 11:23 - 2012-08-30 13:11 - 05505904 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
    2012-10-10 11:23 - 2012-08-30 12:18 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2012-10-10 11:23 - 2012-08-30 12:18 - 03902832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2012-10-10 11:23 - 2012-08-24 13:05 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
    2012-10-10 11:23 - 2012-08-24 12:10 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2012-10-10 11:22 - 2012-09-14 14:23 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
    2012-10-10 11:22 - 2012-09-14 13:30 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2012-10-10 11:22 - 2012-08-18 10:43 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
    2012-10-10 11:22 - 2012-08-18 10:43 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
    2012-10-10 11:22 - 2012-08-18 10:43 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
    2012-10-10 11:22 - 2012-08-18 10:42 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
    2012-10-10 11:22 - 2012-08-18 10:40 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
    2012-10-10 11:22 - 2012-08-18 10:37 - 01162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
    2012-10-10 11:22 - 2012-08-18 10:37 - 00425984 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
    2012-10-10 11:22 - 2012-08-18 10:34 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
    2012-10-10 11:22 - 2012-08-18 10:22 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 10:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:22 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2012-10-10 11:22 - 2012-08-18 06:19 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2012-10-10 11:22 - 2012-08-18 06:17 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2012-10-10 11:22 - 2012-08-18 06:17 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2012-10-10 11:22 - 2012-08-18 06:17 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 06:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 04:12 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2012-10-10 11:22 - 2012-08-18 04:12 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2012-10-10 11:22 - 2012-08-18 04:07 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 04:07 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 04:07 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-18 04:07 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2012-10-10 11:22 - 2012-08-10 19:53 - 00714752 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
    2012-10-10 11:22 - 2012-08-10 18:54 - 00541184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2012-10-10 11:21 - 2012-06-02 00:25 - 01462784 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
    2012-10-10 11:21 - 2012-06-02 00:25 - 00182272 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
    2012-10-10 11:21 - 2012-06-02 00:25 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
    2012-10-10 11:21 - 2012-06-01 23:45 - 01157632 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2012-10-10 11:21 - 2012-06-01 23:45 - 00139264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2012-10-10 11:21 - 2012-06-01 23:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2012-10-07 13:02 - 2012-10-07 13:02 - 00021449 ____A C:\ComboFix.txt
    2012-10-07 12:28 - 2011-06-26 01:45 - 00256000 ____A C:\Windows\PEV.exe
    2012-10-07 12:28 - 2010-11-07 12:20 - 00208896 ____A C:\Windows\MBR.exe
    2012-10-07 12:28 - 2009-04-19 23:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
    2012-10-07 12:28 - 2000-08-30 19:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
    2012-10-07 12:28 - 2000-08-30 19:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
    2012-10-07 12:28 - 2000-08-30 19:00 - 00098816 ____A C:\Windows\sed.exe
    2012-10-07 12:28 - 2000-08-30 19:00 - 00080412 ____A C:\Windows\grep.exe
    2012-10-07 12:28 - 2000-08-30 19:00 - 00068096 ____A C:\Windows\zip.exe
    2012-10-07 12:25 - 2012-10-07 13:03 - 00000000 ____D C:\Qoobox
    2012-10-07 12:24 - 2012-10-07 12:24 - 04762471 ____R (Swearware) C:\Users\Alex Skittery\Desktop\ComboFix.exe
    2012-10-07 12:24 - 2012-10-07 12:24 - 04762471 ____A (Swearware) C:\Users\Alex Skittery\Downloads\ComboFix.exe
    2012-10-04 11:20 - 2012-10-04 11:20 - 04731392 ____A (AVAST Software) C:\Users\Alex Skittery\Desktop\aswMBR.exe
    2012-10-04 11:19 - 2012-10-04 11:20 - 04731392 ____A (AVAST Software) C:\Users\Alex Skittery\Downloads\aswMBR.exe
    2012-10-04 10:55 - 2012-10-04 10:55 - 00001878 ____A C:\Users\Alex Skittery\Desktop\RKreport[2].txt
    2012-10-04 10:54 - 2012-10-04 10:54 - 00001889 ____A C:\Users\Alex Skittery\Desktop\RKreport[1].txt
    2012-10-04 10:53 - 2012-10-04 10:55 - 00000000 ____D C:\Users\Alex Skittery\Desktop\RK_Quarantine
    2012-10-04 10:52 - 2012-10-04 10:51 - 01422336 ____A C:\Users\Alex Skittery\Desktop\RogueKiller.exe
    2012-10-04 10:51 - 2012-10-04 10:51 - 01422336 ____A C:\Users\Alex Skittery\Downloads\RogueKiller.exe
    2012-10-04 10:48 - 2012-10-04 10:48 - 00208216 ____A (Kaspersky Lab, GERT) C:\Windows\System32\Drivers\76671082.sys
    2012-10-04 10:47 - 2012-10-04 10:47 - 00000000 ____D C:\Users\Alex Skittery\Desktop\tdsskiller
    2012-10-04 10:47 - 2012-10-04 10:46 - 02193278 ____A C:\Users\Alex Skittery\Desktop\tdsskiller.zip
    2012-10-04 10:45 - 2012-10-04 10:46 - 02193278 ____A C:\Users\Alex Skittery\Downloads\tdsskiller.zip
    2012-10-04 07:38 - 2012-10-04 07:38 - 00001945 ____A C:\Windows\epplauncher.mif
    2012-10-04 07:34 - 2012-10-04 07:33 - 197642182 ____A C:\Users\Alex Skittery\Desktop\EmsisoftEmergencyKit.zip
    2012-10-04 07:25 - 2012-10-04 07:33 - 197642182 ____A C:\Users\Alex Skittery\Downloads\EmsisoftEmergencyKit.zip
    2012-10-04 06:45 - 2012-10-04 06:45 - 00002330 ____A C:\Users\Alex Skittery\Desktop\aswMBR.txt
    2012-10-04 06:27 - 2012-10-04 06:45 - 00000512 ____A C:\Users\Alex Skittery\Desktop\MBR.dat
    2012-09-30 07:17 - 2012-09-30 14:21 - 00000000 ____D C:\29588b5f190039290a92
    2012-09-26 02:43 - 2012-09-26 02:44 - 00711432 ____A C:\Windows\Minidump\092612-21793-01.dmp
    2012-09-25 05:16 - 2012-09-25 05:17 - 06135536 ____A C:\Users\Alex Skittery\Downloads\aGUP4870.part
    2012-09-25 04:51 - 2012-09-25 04:58 - 78574576 ____A C:\Users\Alex Skittery\Downloads\Tokyo Police Club - 10x10x10 (2011).rar
    2012-09-25 03:56 - 2012-08-24 05:22 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-09-25 03:56 - 2012-08-24 05:20 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-09-25 03:56 - 2012-08-24 05:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-09-25 03:56 - 2012-08-24 05:14 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-09-25 03:56 - 2012-08-24 05:10 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-09-25 03:56 - 2012-08-24 05:09 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-09-25 03:56 - 2012-08-24 05:04 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-09-25 03:56 - 2012-08-24 01:51 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-09-25 03:56 - 2012-08-24 01:51 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-09-25 03:56 - 2012-08-24 01:49 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-09-25 03:56 - 2012-08-24 01:47 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2012-09-25 03:56 - 2012-08-24 01:47 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-09-25 03:56 - 2012-08-24 01:44 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-09-25 03:56 - 2012-08-24 01:43 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-09-25 03:56 - 2012-08-24 01:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-09-25 03:55 - 2012-08-24 06:15 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-09-25 03:55 - 2012-08-24 05:39 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-09-25 03:55 - 2012-08-24 05:31 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-09-25 03:55 - 2012-08-24 05:21 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-09-25 03:55 - 2012-08-24 05:17 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-09-25 03:55 - 2012-08-24 05:14 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-09-25 03:55 - 2012-08-24 05:13 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
    2012-09-25 03:55 - 2012-08-24 05:12 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-09-25 03:55 - 2012-08-24 05:11 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
    2012-09-25 03:55 - 2012-08-24 02:27 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-09-25 03:55 - 2012-08-24 02:03 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-09-25 03:55 - 2012-08-24 01:59 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
     
  3. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    2012-09-25 03:55 - 2012-08-24 01:51 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-09-25 03:55 - 2012-08-24 01:48 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-09-25 03:55 - 2012-08-24 01:47 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-09-25 03:55 - 2012-08-24 01:45 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2012-09-25 03:55 - 2012-08-24 01:44 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    ==================== 3 Months Modified Files ==================
    2012-10-23 14:05 - 2009-07-14 00:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI
    2012-10-23 13:39 - 2012-10-23 13:37 - 00000793 ____A C:\Users\Alex Skittery\Downloads\Search.txt
    2012-10-23 13:35 - 2012-10-23 13:33 - 00043395 ____A C:\Users\Alex Skittery\Downloads\FRST.txt
    2012-10-23 13:32 - 2012-10-23 13:32 - 01459119 ____A (Farbar) C:\Users\Alex Skittery\Downloads\FRST64.exe
    2012-10-23 13:20 - 2012-10-23 13:20 - 00003224 ____N C:\bootsqm.dat
    2012-10-23 13:20 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-10-23 13:20 - 2009-07-13 23:51 - 00066391 ____A C:\Windows\setupact.log
    2012-10-23 13:16 - 2012-10-23 13:05 - 83023306 ___AT C:\Users\All Users\Application Data\0tbpw.pad
    2012-10-23 13:16 - 2012-10-23 13:05 - 83023306 ___AT C:\Users\All Users\0tbpw.pad
    2012-10-23 13:05 - 2012-10-23 13:05 - 00044544 ____A (Microsoft Corporation) C:\Users\All Users\lsass.exe
    2012-10-23 13:05 - 2012-10-23 13:05 - 00044544 ____A (Microsoft Corporation) C:\Users\All Users\Application Data\lsass.exe
    2012-10-23 13:04 - 2012-06-16 15:08 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
    2012-10-23 12:52 - 2012-10-23 12:52 - 00000165 ___AH C:\Users\Alex Skittery\Desktop\~$work.xlsx
    2012-10-23 12:52 - 2012-09-20 11:32 - 00010478 ____A C:\Users\Alex Skittery\Desktop\work.xlsx
    2012-10-23 12:46 - 2009-07-14 00:10 - 01897689 ____A C:\Windows\WindowsUpdate.log
    2012-10-23 11:23 - 2012-10-23 11:23 - 00000273 ____A C:\Users\Alex Skittery\Desktop\ESETScan.txt
    2012-10-23 02:33 - 2012-10-23 02:33 - 02322184 ____A (ESET) C:\Users\Alex Skittery\Downloads\esetsmartinstaller_enu(1).exe
    2012-10-22 15:45 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-10-22 15:45 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-10-22 15:44 - 2012-10-22 15:44 - 02322184 ____A (ESET) C:\Users\Alex Skittery\Downloads\esetsmartinstaller_enu.exe
    2012-10-22 15:33 - 2012-10-22 15:33 - 00448512 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\TFC(1).exe
    2012-10-22 15:00 - 2012-10-22 15:00 - 00448512 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\TFC.exe
    2012-10-22 14:27 - 2012-10-22 14:26 - 00002908 ____A C:\Users\Alex Skittery\Downloads\FSS.txt
    2012-10-22 14:26 - 2012-10-22 14:26 - 00694323 ____A (Farbar) C:\Users\Alex Skittery\Downloads\FSS.exe
    2012-10-22 14:22 - 2012-10-22 14:22 - 00881773 ____A C:\Users\Alex Skittery\Downloads\SecurityCheck.exe
    2012-10-16 12:12 - 2012-10-10 12:09 - 00097622 ____A C:\Users\Alex Skittery\Desktop\OTL.Txt
    2012-10-13 16:14 - 2010-12-30 15:34 - 00054468 ____A C:\Windows\PFRO.log
    2012-10-13 14:13 - 2011-01-04 16:16 - 00090624 ____A C:\Users\Alex Skittery\Local Settings\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-10-13 14:13 - 2011-01-04 16:16 - 00090624 ____A C:\Users\Alex Skittery\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-10-13 14:13 - 2011-01-04 16:16 - 00090624 ____A C:\Users\Alex Skittery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-10-13 13:57 - 2012-10-13 13:57 - 03177840 ____A (McAfee, Inc.) C:\Users\Alex Skittery\Downloads\MCPR.exe
    2012-10-11 12:04 - 2012-06-16 15:08 - 00696760 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2012-10-11 12:04 - 2011-11-29 16:49 - 00073656 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2012-10-10 12:11 - 2012-10-10 12:11 - 00064656 ____A C:\Users\Alex Skittery\Desktop\Extras.Txt
    2012-10-10 12:00 - 2012-10-10 12:00 - 00602112 ____A (OldTimer Tools) C:\Users\Alex Skittery\Downloads\OTL.exe
    2012-10-10 12:00 - 2012-10-10 12:00 - 00602112 ____A (OldTimer Tools) C:\Users\Alex Skittery\Desktop\OTL.exe
    2012-10-10 11:21 - 2012-03-20 13:33 - 02155915 ____A C:\Windows\System32\Drivers\Cat.DB
    2012-10-07 13:02 - 2012-10-07 13:02 - 00021449 ____A C:\ComboFix.txt
    2012-10-07 12:42 - 2009-07-13 21:34 - 00000215 ____A C:\Windows\system.ini
    2012-10-07 12:24 - 2012-10-07 12:24 - 04762471 ____R (Swearware) C:\Users\Alex Skittery\Desktop\ComboFix.exe
    2012-10-07 12:24 - 2012-10-07 12:24 - 04762471 ____A (Swearware) C:\Users\Alex Skittery\Downloads\ComboFix.exe
    2012-10-04 11:20 - 2012-10-04 11:20 - 04731392 ____A (AVAST Software) C:\Users\Alex Skittery\Desktop\aswMBR.exe
    2012-10-04 11:20 - 2012-10-04 11:19 - 04731392 ____A (AVAST Software) C:\Users\Alex Skittery\Downloads\aswMBR.exe
    2012-10-04 10:57 - 2012-06-16 15:03 - 00001115 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2012-10-04 10:57 - 2012-06-16 15:03 - 00001115 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    2012-10-04 10:55 - 2012-10-04 10:55 - 00001878 ____A C:\Users\Alex Skittery\Desktop\RKreport[2].txt
    2012-10-04 10:54 - 2012-10-04 10:54 - 00001889 ____A C:\Users\Alex Skittery\Desktop\RKreport[1].txt
    2012-10-04 10:51 - 2012-10-04 10:52 - 01422336 ____A C:\Users\Alex Skittery\Desktop\RogueKiller.exe
    2012-10-04 10:51 - 2012-10-04 10:51 - 01422336 ____A C:\Users\Alex Skittery\Downloads\RogueKiller.exe
    2012-10-04 10:48 - 2012-10-04 10:48 - 00208216 ____A (Kaspersky Lab, GERT) C:\Windows\System32\Drivers\76671082.sys
    2012-10-04 10:46 - 2012-10-04 10:47 - 02193278 ____A C:\Users\Alex Skittery\Desktop\tdsskiller.zip
    2012-10-04 10:46 - 2012-10-04 10:45 - 02193278 ____A C:\Users\Alex Skittery\Downloads\tdsskiller.zip
    2012-10-04 07:38 - 2012-10-04 07:38 - 00001945 ____A C:\Windows\epplauncher.mif
    2012-10-04 07:33 - 2012-10-04 07:34 - 197642182 ____A C:\Users\Alex Skittery\Desktop\EmsisoftEmergencyKit.zip
    2012-10-04 07:33 - 2012-10-04 07:25 - 197642182 ____A C:\Users\Alex Skittery\Downloads\EmsisoftEmergencyKit.zip
    2012-10-04 06:45 - 2012-10-04 06:45 - 00002330 ____A C:\Users\Alex Skittery\Desktop\aswMBR.txt
    2012-10-04 06:45 - 2012-10-04 06:27 - 00000512 ____A C:\Users\Alex Skittery\Desktop\MBR.dat
    2012-09-26 02:44 - 2012-09-26 02:43 - 00711432 ____A C:\Windows\Minidump\092612-21793-01.dmp
    2012-09-26 02:43 - 2011-12-03 11:17 - 670479582 ____A C:\Windows\MEMORY.DMP
    2012-09-25 05:17 - 2012-09-25 05:16 - 06135536 ____A C:\Users\Alex Skittery\Downloads\aGUP4870.part
    2012-09-25 04:58 - 2012-09-25 04:51 - 78574576 ____A C:\Users\Alex Skittery\Downloads\Tokyo Police Club - 10x10x10 (2011).rar
    2012-09-14 14:23 - 2012-10-10 11:22 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
    2012-09-14 13:30 - 2012-10-10 11:22 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2012-09-10 14:37 - 2012-07-26 05:02 - 00009473 ____A C:\Users\Alex Skittery\Desktop\job search.xlsx
    2012-09-07 11:04 - 2012-06-16 15:03 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
    2012-08-31 13:02 - 2012-10-10 11:23 - 01656688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
    2012-08-30 16:03 - 2012-08-30 16:03 - 00228768 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\MpFilter.sys
    2012-08-30 16:03 - 2012-03-20 14:44 - 00128456 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\NisDrvWFP.sys
    2012-08-30 13:11 - 2012-10-10 11:23 - 05505904 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
    2012-08-30 12:18 - 2012-10-10 11:23 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2012-08-30 12:18 - 2012-10-10 11:23 - 03902832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2012-08-24 13:05 - 2012-10-10 11:23 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
    2012-08-24 12:10 - 2012-10-10 11:23 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2012-08-24 06:15 - 2012-09-25 03:55 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-08-24 05:39 - 2012-09-25 03:55 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-08-24 05:31 - 2012-09-25 03:55 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-08-24 05:22 - 2012-09-25 03:56 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-08-24 05:21 - 2012-09-25 03:55 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-08-24 05:20 - 2012-09-25 03:56 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-08-24 05:18 - 2012-09-25 03:56 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-08-24 05:17 - 2012-09-25 03:55 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-08-24 05:14 - 2012-09-25 03:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-08-24 05:14 - 2012-09-25 03:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-08-24 05:13 - 2012-09-25 03:55 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
    2012-08-24 05:12 - 2012-09-25 03:55 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-08-24 05:11 - 2012-09-25 03:55 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
    2012-08-24 05:10 - 2012-09-25 03:56 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-08-24 05:09 - 2012-09-25 03:56 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-08-24 05:04 - 2012-09-25 03:56 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-08-24 02:27 - 2012-09-25 03:55 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-08-24 02:03 - 2012-09-25 03:55 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-08-24 01:59 - 2012-09-25 03:55 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2012-08-24 01:51 - 2012-09-25 03:56 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-08-24 01:51 - 2012-09-25 03:56 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-08-24 01:51 - 2012-09-25 03:55 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-08-24 01:49 - 2012-09-25 03:56 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-08-24 01:48 - 2012-09-25 03:55 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-08-24 01:47 - 2012-09-25 03:56 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2012-08-24 01:47 - 2012-09-25 03:56 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-08-24 01:47 - 2012-09-25 03:55 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-08-24 01:45 - 2012-09-25 03:55 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2012-08-24 01:44 - 2012-09-25 03:56 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-08-24 01:44 - 2012-09-25 03:55 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2012-08-24 01:43 - 2012-09-25 03:56 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-08-24 01:40 - 2012-09-25 03:56 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-08-21 11:33 - 2012-08-21 11:33 - 00285760 ____A C:\Windows\Minidump\082112-32619-01.dmp
    2012-08-18 10:43 - 2012-10-10 11:22 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
    2012-08-18 10:43 - 2012-10-10 11:22 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
    2012-08-18 10:43 - 2012-10-10 11:22 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
    2012-08-18 10:42 - 2012-10-10 11:22 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
    2012-08-18 10:40 - 2012-10-10 11:22 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
    2012-08-18 10:37 - 2012-10-10 11:22 - 01162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
    2012-08-18 10:37 - 2012-10-10 11:22 - 00425984 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
    2012-08-18 10:34 - 2012-10-10 11:22 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
    2012-08-18 10:22 - 2012-10-10 11:22 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
    2012-08-18 10:22 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
    2012-08-18 06:22 - 2012-10-10 11:22 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2012-08-18 06:19 - 2012-10-10 11:22 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2012-08-18 06:17 - 2012-10-10 11:22 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2012-08-18 06:17 - 2012-10-10 11:22 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2012-08-18 06:17 - 2012-10-10 11:22 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2012-08-18 06:09 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2012-08-18 04:41 - 2009-07-13 23:45 - 00355392 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-08-18 04:12 - 2012-10-10 11:22 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2012-08-18 04:12 - 2012-10-10 11:22 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2012-08-18 04:07 - 2012-10-10 11:22 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2012-08-18 04:07 - 2012-10-10 11:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2012-08-18 04:07 - 2012-10-10 11:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2012-08-18 04:07 - 2012-10-10 11:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2012-08-10 19:53 - 2012-10-10 11:22 - 00714752 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
    2012-08-10 18:54 - 2012-10-10 11:22 - 00541184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2012-08-02 12:55 - 2012-09-12 01:55 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
    2012-08-02 12:05 - 2012-09-12 01:55 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
    2012-08-01 08:11 - 2012-08-01 08:11 - 00000165 ___AH C:\Users\Alex Skittery\Desktop\~$job search.xlsx
    ==================== Known DLLs (Whitelisted) =================

    ==================== Bamital & volsnap Check =================
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
    ==================== EXE ASSOCIATION =====================
    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK
    ==================== Restore Points =========================
    Restore point made on: 2012-10-10 21:01:09
    Restore point made on: 2012-10-14 03:17:24
    Restore point made on: 2012-10-18 14:44:06
    Restore point made on: 2012-10-22 14:27:42
    ==================== Memory info ===========================
    Percentage of memory in use: 15%
    Total physical RAM: 3828.3 MB
    Available physical RAM: 3227.76 MB
    Total Pagefile: 3826.45 MB
    Available Pagefile: 3221.23 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.89 MB
    ==================== Partitions =============================
    1 Drive c: (OS) (Fixed) (Total:581.48 GB) (Free:426.17 GB) NTFS
    3 Drive e: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FAT
    4 Drive f: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:7.74 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 596 GB 0 B
    Disk 1 Online 960 MB 0 B
    Partitions of Disk 0:
    ===============
    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 OEM 39 MB 31 KB
    Partition 2 Primary 14 GB 39 MB
    Partition 3 Primary 581 GB 14 GB
    ==================================================================================
    Disk: 0
    Partition 1
    Type : DE
    Hidden: Yes
    Active: No
    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 FAT Partition 39 MB Healthy Hidden
    =========================================================
    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: Yes
    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 F RECOVERY NTFS Partition 14 GB Healthy
    =========================================================
    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: No
    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 C OS NTFS Partition 581 GB Healthy
    =========================================================
    Partitions of Disk 1:
    ===============
    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 960 MB 16 KB
    ==================================================================================
    Disk: 1
    Partition 1
    Type : 06
    Hidden: No
    Active: Yes
    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 E FAT Removable 960 MB Healthy
    =========================================================
    Last Boot: 2012-10-16 02:48
    ==================== End Of Log =============================
     
  4. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Farbar Recovery Scan Tool (x64) Version: 02-10-2012 01
    Ran by SYSTEM at 2012-10-23 21:08:48
    Running from E:\
    ================== Search: "services.exe" ===================
    C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
    [2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
    C:\Windows\System32\services.exe
    [2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
    C:\Windows\ERDNT\cache64\services.exe
    [2012-06-14 03:47] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB
    ====== End Of Search ======
     
  5. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    On Vista or Windows 7: Now please enter System Recovery Options.
    On Windows XP: Now please boot into the UBCD.
    Run FRST/FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

    See if you can start normally and report on any issues.
     

    Attached Files:

  6. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2012 01
    Ran by SYSTEM at 2012-10-24 19:32:44 Run:3
    Running from F:\
    ==============================================
    C:\Users\Alex Skittery\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
    C:\ProgramData\lsass.exe moved successfully.
    C:\Users\Alex Skittery\Start Menu\Programs\Startup\ctfmon.lnk not found.
    C:\ProgramData\lsass.exe not found.
    ==== End of Fixlog ====
     
  7. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Things seem to be working ok at the moment! :)
     
  8. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    Good :)

    Continue with my reply #46.
     
  9. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    After I ran OTL and it restarted I didn't get a log and there are some translucent items and the desktop such as: desktop.ini. Should I ignore it and carry on?
     
  10. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Hide protected operating system files.

    As for OTL re-run the fix from safe mode.
     
  11. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Turns out when I opened OTL it came up with the log below:
    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Alex Skittery
    ->Temp folder emptied: 41127341 bytes
    ->Temporary Internet Files folder emptied: 3153642 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 134293413 bytes
    ->Flash cache emptied: 2458 bytes

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: UpdatusUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 20624 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
    RecycleBin emptied: 9693 bytes

    Total Files Cleaned = 170.00 mb


    [EMPTYFLASH]

    User: Alex Skittery
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default

    User: Default User

    User: Public

    User: UpdatusUser

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYJAVA]

    User: Alex Skittery
    ->Java cache emptied: 0 bytes

    User: All Users

    User: Default

    User: Default User

    User: Public

    User: UpdatusUser

    Total Java Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.69.0 log created on 10252012_195752

    Files\Folders moved on Reboot...
    File move failed. C:\Users\Alex Skittery\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...
     
     
  12. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Is that OK or should I still do it again in safe mode?
     
  13. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    That's fine.

     
  14. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Everythine seems to be ok thanks. :) Shall I continue with reply #46?
     
  15. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    Sure. Make sure you complete all those steps.

    Good luck and stay safe :)
     
  16. Dan James

    Dan James TS Rookie Topic Starter Posts: 80

    Thanks Broni, there doesn't seem to be any problems any more :) you are the best mate!
     
  17. Broni

    Broni Malware Annihilator Posts: 47,022   +255

    You're very welcome [​IMG]
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.