Solved Am I still infected?

Broni · Jan 10, 2015

Yes.
"Download attached fixlist.txt file and save it to the Desktop."

learninmypc · Jan 10, 2015

Ok, I did that. What next?

Broni · Jan 10, 2015

Please read my instructions.
They're pretty straightforward.

learninmypc · Jan 10, 2015

Hope this is correct
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-01-2015
Ran by Thomas Paine (administrator) on HAL-9000 on 10-01-2015 18:13:50
Running from C:\Users\Thomas Paine\Pictures\OTHER FOLDERS\Desktop
Loaded Profile: Thomas Paine (Available profiles: Thomas Paine)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(mozilla.org) C:\Program Files (x86)\SeaMonkey\seamonkey.exe
(Mozilla Corporation) C:\Program Files (x86)\SeaMonkey\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610360 2009-09-14] ()
HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-16] (PC-Doctor, Inc.)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-09] (AVAST Software)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-10-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-12-16] (Hewlett-Packard)
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024 2010-03-10] (AMD)
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2014-12-17] (SUPERAntiSpyware)
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
Startup: C:\Users\Thomas Paine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kirotv.com/
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM -> {3412F329-7A6D-49A7-9296-1D66AB3B03F2} URL = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {3412F329-7A6D-49A7-9296-1D66AB3B03F2} URL = http://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-555829191-1849574639-2068614983-1001 -> {3412F329-7A6D-49A7-9296-1D66AB3B03F2} URL =
BHO: No Name -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO: VuaUdixx -> {ec0d6a6b-b8b5-4cdb-80a5-f2dedfe6d589} -> C:\Program Files (x86)\VuaUdixx\cR4Nbe9VpxZP4b.x64.dll No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 74.40.74.40

FireFox:
========
FF ProfilePath: C:\Users\Thomas Paine\AppData\Roaming\Mozilla\Firefox\Profiles\pjnhxxo7.default
FF Homepage: www.kirotv.com
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @ei.RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\NP4jEISB.dll No File
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKU\S-1-5-21-555829191-1849574639-2068614983-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Thomas Paine\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-555829191-1849574639-2068614983-1001: @talk.google.com/O1DPlugin -> C:\Users\Thomas Paine\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-555829191-1849574639-2068614983-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Thomas Paine\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-555829191-1849574639-2068614983-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Thomas Paine\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Thomas Paine\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Thomas Paine\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF Extension: WOT - C:\Users\Thomas Paine\AppData\Roaming\Mozilla\Firefox\Profiles\pjnhxxo7.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-11-21]
FF Extension: DownloadHelper - C:\Users\Thomas Paine\AppData\Roaming\Mozilla\Firefox\Profiles\pjnhxxo7.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-11-21]
FF Extension: X-notifier - C:\Users\Thomas Paine\AppData\Roaming\Mozilla\Firefox\Profiles\pjnhxxo7.default\Extensions\{37fa1426-b82d-11db-8314-0800200c9a66}.xpi [2014-11-22]
FF Extension: Adblock Plus - C:\Users\Thomas Paine\AppData\Roaming\Mozilla\Firefox\Profiles\pjnhxxo7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-12-24]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Video Download Professional) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\afkbpebmpocjmdpmnaijjeniajofohci [2014-10-20]
CHR Extension: (Google Drive) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-19]
CHR Extension: (AdBlock Plus) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhbihjkbifdakjlfjkpfeadmgefejcdk [2014-10-15]
CHR Extension: (WOT) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-06-19]
CHR Extension: (YouTube) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-19]
CHR Extension: (Adblock Plus) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-10-15]
CHR Extension: (Google Search) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-19]
CHR Extension: (AdBlock Plus) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebophoempopiimfdkeechjfchhmdmmnc [2014-08-01]
CHR Extension: (SmoothScroll) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbokbjkabcmbfdlbddjidfmibcpneigj [2014-08-29]
CHR Extension: ( Youtube Downloader) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\nggdfjkecnbpgdabpjaddhacaifackhp [2014-10-20]
CHR Extension: (Seahawks Passion) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlcffealkfglnohgcnnjpcbpobmollhb [2015-01-03]
CHR Extension: (Google Wallet) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-19]
CHR Extension: (Gmail) - C:\Users\Thomas Paine\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-19]
CHR Extension: (VuaUdixx) - C:\ProgramData\mfglbkohmegifdjhhfjcedkmblfbphko\ [2014-06-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-10-08] (Advanced Micro Devices, Inc.) [File not signed]
R2 AMD_RAIDXpert; C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [122880 2009-09-19] (AMD) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-12] (AVAST Software)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244448 2014-10-28] (Foxit Software Inc.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [86528 2012-09-27] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-12] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-12] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-12] ()
S3 CTV1W; C:\Windows\System32\DRIVERS\CTV1W.sys [1118048 2010-04-19] (Ralink Technology Corp.)
R1 kl1; C:\Windows\System32\DRIVERS\kl1.sys [157712 2009-09-01] (Kaspersky Lab)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2008-07-11] (SafeNet, Inc.)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-01-09] ()
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-09-17] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 FSUSBCAM; system32\drivers\fsUsbCam.sys [X]
S3 PcdrNdisuio; syswow64\drivers\pcdrndisuio.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 17:49 - 2015-01-10 18:13 - 00000000 ____D () C:\FRST
2015-01-10 17:42 - 2015-01-10 17:42 - 00000000 ____D () C:\Windows\ERUNT
2015-01-10 17:17 - 2015-01-10 17:34 - 00000000 ____D () C:\AdwCleaner
2015-01-10 16:58 - 2015-01-10 16:58 - 00028409 _____ () C:\ComboFix.txt
2015-01-10 16:36 - 2015-01-10 17:35 - 00003980 _____ () C:\Windows\PFRO.log
2015-01-10 16:28 - 2015-01-10 16:28 - 00000000 ____D () C:\Users\Thomas Paine\Documents\ProcAlyzer Dumps
2015-01-10 16:22 - 2015-01-10 16:58 - 00000000 ____D () C:\Qoobox
2015-01-10 13:57 - 2015-01-10 13:57 - 00003544 ____N () C:\bootsqm.dat
2015-01-09 20:31 - 2015-01-10 05:48 - 00000000 ____D () C:\Users\Thomas Paine\AppData\Local\CrashDumps
2015-01-09 18:02 - 2015-01-09 18:02 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2015-01-09 18:02 - 2015-01-09 18:02 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-01-09 16:44 - 2015-01-09 16:44 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-09 09:17 - 2015-01-09 09:17 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-09 06:15 - 2015-01-10 17:35 - 00000504 _____ () C:\Windows\setupact.log
2015-01-09 06:15 - 2015-01-09 06:15 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-09 06:13 - 2015-01-09 06:13 - 00000000 ____D () C:\ProgramData\mfglbkohmegifdjhhfjcedkmblfbphko
2015-01-09 06:12 - 2015-01-09 15:32 - 00000000 ____D () C:\ProgramData\{1d7cc7f9-be7f-83cd-1d7c-cc7f9be71fe6}
2015-01-07 08:09 - 2013-04-14 09:03 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts.20150107-080958.backup
2015-01-06 11:19 - 2015-01-10 16:36 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-04 17:12 - 2015-01-04 17:12 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-01-04 17:12 - 2015-01-04 17:12 - 00001345 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2014-12-25 06:56 - 2014-12-25 06:56 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-12-25 06:55 - 2014-12-25 06:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2014-12-22 15:08 - 2014-12-22 15:09 - 122995452 _____ () C:\Users\Thomas Paine\Documents\Joe_Cocker_Woodstock_94_Full_concert.mp4
2014-12-17 22:12 - 2014-12-12 21:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 22:12 - 2014-12-12 19:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-17 18:29 - 2014-12-17 18:40 - 00000000 ____D () C:\Users\Thomas Paine\AppData\Local\Popcorn-Time
2014-12-17 18:29 - 2014-12-17 18:29 - 00000000 ____D () C:\Users\Thomas Paine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn Time
2014-12-17 18:28 - 2014-12-17 18:29 - 00000000 ____D () C:\Users\Thomas Paine\AppData\Local\Popcorn Time
2014-12-16 21:01 - 2014-12-17 00:01 - 576891111 _____ () C:\Users\Thomas Paine\Documents\ff2104b4009f441cffdf52c8a8a057fd20.flv
2014-12-15 10:43 - 2015-01-08 20:38 - 00000000 ____D () C:\Users\Thomas Paine\Documents\MOVIES
2014-12-15 08:12 - 2014-12-15 08:34 - 212287246 _____ () C:\Users\Thomas Paine\Documents\4ddb693e1b127.flv
2014-12-14 08:42 - 2014-12-14 08:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-12-14 08:42 - 2014-11-12 07:57 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-12-11 15:29 - 2014-12-11 16:42 - 608464035 _____ () C:\Users\Thomas Paine\Documents\ffc3083e219b8e03811090f549d6f38538.flv
2014-12-11 14:34 - 2015-01-06 05:26 - 00000000 ____D () C:\Users\Thomas Paine\Documents\121214

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-10 17:55 - 2014-10-21 18:43 - 00000936 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-555829191-1849574639-2068614983-1001UA.job
2015-01-10 17:46 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-10 17:46 - 2009-07-13 20:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-10 17:43 - 2010-05-11 13:53 - 01195471 _____ () C:\Windows\WindowsUpdate.log
2015-01-10 17:37 - 2012-04-28 06:37 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-10 17:36 - 2014-11-14 16:47 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-01-10 17:35 - 2014-06-19 06:13 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-10 17:35 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-10 17:34 - 2009-07-13 21:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-01-10 17:13 - 2012-12-24 10:19 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-10 16:56 - 2009-07-13 18:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-10 16:35 - 2014-06-19 06:13 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-10 16:00 - 2014-04-20 10:34 - 00000000 ____D () C:\Users\Thomas Paine\Documents\GREAT
2015-01-10 14:41 - 2014-10-12 13:17 - 00000360 _____ () C:\Windows\Tasks\HPCeeScheduleForThomas Paine.job
2015-01-10 14:03 - 2013-01-26 08:16 - 00003954 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{44E06F25-55A1-432C-804B-FFCCBEE7FEAD}
2015-01-10 13:58 - 2009-07-13 21:08 - 00032536 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-10 08:01 - 2013-08-14 14:13 - 00000000 ____D () C:\Users\Thomas Paine\Documents\OUR TV
2015-01-10 05:48 - 2013-10-18 07:06 - 00000000 ____D () C:\Users\Thomas Paine\AppData\Roaming\vlc
2015-01-09 18:32 - 2013-08-24 18:04 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-09 18:16 - 2014-04-28 17:37 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-09 18:15 - 2014-04-28 17:37 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-09 13:55 - 2014-10-21 18:43 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-555829191-1849574639-2068614983-1001Core.job
2015-01-08 20:38 - 2012-12-19 15:16 - 00000000 ____D () C:\Users\Thomas Paine\Documents\SONGS
2015-01-07 14:21 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-07 04:22 - 2013-03-20 06:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-06 05:28 - 2014-11-02 17:14 - 00000000 ____D () C:\Users\Thomas Paine\Documents\iPhone
2015-01-06 05:20 - 2014-11-11 20:39 - 00204800 ___SH () C:\Users\Thomas Paine\Documents\Thumbs.db
2015-01-06 04:36 - 2010-07-16 18:26 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-01-04 23:58 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2015-01-04 17:11 - 2009-07-13 23:44 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-04 17:11 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-01-04 14:16 - 2011-10-30 18:23 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2015-01-04 14:16 - 2010-07-19 02:55 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-01-03 17:52 - 2014-10-15 13:04 - 00000000 ____D () C:\Users\Thomas Paine\Documents\GODS LOVE
2014-12-31 16:22 - 2009-07-13 21:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-31 15:59 - 2014-12-04 08:16 - 00000000 ____D () C:\Users\Thomas Paine\dwhelper
2014-12-30 08:19 - 2014-11-25 08:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-30 08:19 - 2014-09-08 10:38 - 00000784 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-12-29 16:17 - 2012-12-24 09:49 - 00000000 ____D () C:\Program Files (x86)\SpywareBlaster
2014-12-29 16:17 - 2010-02-22 18:38 - 00000000 ____D () C:\ProgramData\Temp
2014-12-28 10:30 - 2010-07-26 17:15 - 00060928 _____ () C:\Users\Thomas Paine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-25 19:22 - 2010-11-07 14:41 - 00000000 ____D () C:\Windows\Minidump
2014-12-25 11:35 - 2014-12-04 06:45 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-12-25 11:34 - 2014-12-04 06:45 - 00000973 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2014-12-25 11:34 - 2014-12-04 06:45 - 00000961 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
2014-12-25 06:54 - 2012-04-28 06:37 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-25 06:54 - 2012-04-28 06:37 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-25 06:54 - 2011-05-16 16:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-21 14:41 - 2014-10-12 13:17 - 00003228 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForThomas Paine
2014-12-14 08:31 - 2012-12-27 20:31 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-12-14 08:31 - 2010-02-22 19:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-12-14 03:03 - 2012-12-27 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-12-12 07:40 - 2014-10-11 05:56 - 00002050 _____ () C:\Users\Thomas Paine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2014-12-12 07:40 - 2014-10-02 10:12 - 00000000 ____D () C:\Program Files (x86)\FileHippo.com
2014-12-11 16:48 - 2014-08-02 08:37 - 00000000 ____D () C:\Users\Thomas Paine\Documents\SEAFAIR 2014
2014-12-11 07:10 - 2014-03-04 06:21 - 00000000 ____D () C:\Users\Thomas Paine\Documents\GOOD
2014-12-11 06:24 - 2014-04-20 06:05 - 00000000 ____D () C:\Users\Thomas Paine\Documents\easter bunny

Some content of TEMP:
====================
C:\Users\Thomas Paine\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas Paine\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-01-04 00:05

==================== End Of Log ============================

learninmypc · Jan 10, 2015

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-01-2015
Ran by Thomas Paine at 2015-01-10 18:15:28 Run:1
Running from C:\Users\Thomas Paine\Pictures\OTHER FOLDERS\Desktop
Loaded Profile: Thomas Paine (Available profiles: Thomas Paine)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CustomCLSID: HKU\S-1-5-21-555829191-1849574639-2068614983-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Thomas Paine\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-555829191-1849574639-2068614983-1001 -> {3412F329-7A6D-49A7-9296-1D66AB3B03F2} URL =
BHO: No Name -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> No File
BHO: VuaUdixx -> {ec0d6a6b-b8b5-4cdb-80a5-f2dedfe6d589} -> C:\Program Files (x86)\VuaUdixx\cR4Nbe9VpxZP4b.x64.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
FF Plugin-x32: @ei.RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\NP4jEISB.dll No File
CHR Extension: (VuaUdixx) - C:\ProgramData\mfglbkohmegifdjhhfjcedkmblfbphko\ [2014-06-19]
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 FSUSBCAM; system32\drivers\fsUsbCam.sys [X]
S3 PcdrNdisuio; syswow64\drivers\pcdrndisuio.sys [X]
C:\Users\Thomas Paine\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas Paine\AppData\Local\Temp\sqlite3.dll

*****************

"HKU\S-1-5-21-555829191-1849574639-2068614983-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => Key deleted successfully.
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GDriveSharedOverlay" => Key deleted successfully.
HKCR\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => Key not found.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-555829191-1849574639-2068614983-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3412F329-7A6D-49A7-9296-1D66AB3B03F2}" => Key deleted successfully.
HKCR\CLSID\{3412F329-7A6D-49A7-9296-1D66AB3B03F2} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}" => Key deleted successfully.
HKCR\CLSID\{27B4851A-3207-45A2-B947-BE8AFE6163AB} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ec0d6a6b-b8b5-4cdb-80a5-f2dedfe6d589}" => Key deleted successfully.
"HKCR\CLSID\{ec0d6a6b-b8b5-4cdb-80a5-f2dedfe6d589}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} => value deleted successfully.
"HKCR\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => value deleted successfully.
HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
"HKLM\Software\Wow6432Node\MozillaPlugins\@ei.RadioRage_4j.com/Plugin" => Key deleted successfully.
C:\ProgramData\mfglbkohmegifdjhhfjcedkmblfbphko\ => Moved successfully.
McAfee SiteAdvisor Service => Service deleted successfully.
catchme => Service deleted successfully.
FSUSBCAM => Service deleted successfully.
PcdrNdisuio => Service deleted successfully.
C:\Users\Thomas Paine\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Thomas Paine\AppData\Local\Temp\sqlite3.dll => Moved successfully.

==== End of Fixlog 18:15:28 ====

Broni · Jan 10, 2015

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Other Services
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

Download Sophos Free Virus Removal Tool and save it to your desktop.

Double click the icon and select Run
Click Next
Select I accept the terms in this license agreement, then click Next twice
Click Install
Click Finish to launch the program
Once the virus database has been updated click Start Scanning
If any threats are found click Details, then View log file... (bottom left hand corner)
Copy and paste the results in your reply
Close the Notepad document, close the Threat Details screen, then click Start cleanup
Click Exit to close the program

learninmypc · Jan 10, 2015

Doing the security check I got a page saying Unsupported operating system! aborted!

learninmypc · Jan 10, 2015

Farbar Service Scanner Version: 21-07-2014
Ran by Thomas Paine (administrator) on 10-01-2015 at 18:23:38
Running from "C:\Users\Thomas Paine\Pictures\OTHER FOLDERS\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

Broni · Jan 10, 2015

You're not reading my replies carefully!!

NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

learninmypc · Jan 10, 2015

Ok, sorry

learninmypc · Jan 10, 2015

Rebooting to do security check

learninmypc · Jan 10, 2015

Results of screen317's Security Check version 0.99.93
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SpywareBlaster 5.0
HostsMan 3.2.73
Adobe Flash Player 16.0.0.235
Mozilla Firefox (34.0)
Google Chrome (39.0.2171.71)
Google Chrome (39.0.2171.95)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
AVAST Software Avast AvastEmUpdate.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

learninmypc · Jan 10, 2015

Trying to run the sophos virus removal tool it says Error 1606 Could not access network location data

Broni · Jan 10, 2015

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Click on "Run ESET Online Scanner" button.
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

learninmypc · Jan 10, 2015

Am running Eset right now.

learninmypc · Jan 11, 2015

Broni · Jan 11, 2015

Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download

DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

Activate UAC (optional; some users prefer to keep it off)
Remove disinfection tools
Create registry backup
Purge System Restore
Reset system settings

Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.

learninmypc · Jan 11, 2015

Ok, a quick comment/question about filehippo. I've been using it for numerous years but I think it was on the last update when I click the icon it does its thing but it not only tells me I need to update my already updated FF, but worse there are two instances of it. One is still in the background while the results show in the other one. Yes, real confusing. I even used revo to uniinstall it but after reinstalling it,its still duplicating its self.

Broni · Jan 11, 2015

In Firefox go Tools>Options>Tabs tab, make sure that you have "Open links....." set to "New tab" instead of "New window".

learninmypc · Jan 11, 2015

Check,uncheck which? I tried what you said but it didn't. I'm still experimenting,

learninmypc · Jan 11, 2015

The little box on the left is normally under the webpage on the right.

Broni · Jan 11, 2015

I'm not sure if I understand your issue.

learninmypc · Jan 11, 2015

I'm not going to make a big deal out of it but when I click the filehippo shortcut, that little box on the left starts its scanning & then the filehippo website shows up showing the updates. Once I X out of the website, that little box is still sitting there saying scan is finished.
There may be nothing that can be done about it, it could be filehippos problem, I just wanted you to know. Thank you for your patience & help.

Broni · Jan 11, 2015

You're very welcome

Solved Am I still infected?

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 9,679 +724

Posts: 56,041 +516

Posts: 9,679 +724

Posts: 56,041 +516

Similar threads