1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

bad virus not sure how to remove it

Discussion in 'Windows - Virus and spyware problems' started by xboxdvl2, Mar 15, 2014.

  1. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    the other day i got a virus called "flash pop up virus" i've been trying to remove it and nothing seems to work.
    symptoms it hijacks website pages with a popup saying you need to update flash and takes you to a dodgey site,it also lets trogens on to the pc and renames files or deletes them.
    I've tried various scanners,i reset my router and changed the password, today i reformatted.

    i've had some luck in the fact firefox is stopping my pages from being redirected, but the virus is still on my system and i have no idea how to get rid of,virus scanners don't pick it up.tried adware,junkware,malwarebytes,avast 2014 free version,hitman,

    also had another issues ,i have an external hard drive with a few thousand video and music files on it and after reformatting i wasn't able to access the music and video files i had to manually change ownership and permission on the files and i can use them,any quick ways to change them all instead of doing it 1 by 1 which will take hours.
     
  2. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    You have a lot of stuff on your computer that can cause problems, xboxdvl2...
    Let's see if we can find something causing this problem with a deep scan using OTL:

    b]--OTL--[/b]

    Please download OTL by OldTimer to your Desktop.

    If you already have a copy of OTL, delete it and use this version.

    Double click OTL.exe to launch the program.

    Check the following.
    Scan all users.
    Standard Output.
    Lop check.
    Purity check.
    Under Extra Registry section, select Use SafeList
    Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).

    When finished it will produce two logs.
    OTL.txt (open on your desktop).
    Extras.txt (minimized in your taskbar)

    Please post me both logs

    2oG
     
  3. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    OTL log
    OTL logfile created on: 3/16/2014 9:57:26 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\GREG\Downloads
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.89% Memory free
    8.00 Gb Paging File | 5.92 Gb Available in Paging File | 74.02% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 465.66 Gb Total Space | 425.58 Gb Free Space | 91.39% Space Free | Partition Type: NTFS
    Drive D: | 3.00 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
    Drive E: | 100.00 Mb Total Space | 61.85 Mb Free Space | 61.85% Space Free | Partition Type: NTFS
    Drive F: | 1863.01 Gb Total Space | 909.12 Gb Free Space | 48.80% Space Free | Partition Type: NTFS

    Computer Name: GREG-PC | User Name: GREG | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2014/03/16 09:55:14 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\GREG\Downloads\OTL.exe
    PRC - [2014/03/16 06:00:18 | 003,767,096 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
    PRC - [2014/03/16 06:00:18 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    PRC - [2014/03/16 03:23:51 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
    PRC - [2014/02/13 11:06:25 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe


    ========== Modules (No Company Name) ==========

    MOD - [2014/03/16 06:00:20 | 019,336,120 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
    MOD - [2014/03/16 03:23:50 | 016,276,872 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
    MOD - [2014/02/13 11:06:40 | 003,578,992 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll


    ========== Services (SafeList) ==========

    SRV:64bit: - [2014/03/16 06:00:18 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
    SRV:64bit: - [2009/07/14 12:11:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2014/02/13 11:06:33 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
    SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
    SRV - [2009/06/11 07:53:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - [2014/03/16 06:00:26 | 001,038,072 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
    DRV:64bit: - [2014/03/16 06:00:26 | 000,421,704 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
    DRV:64bit: - [2014/03/16 06:00:26 | 000,207,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
    DRV:64bit: - [2014/03/16 06:00:26 | 000,080,184 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
    DRV:64bit: - [2014/03/16 06:00:26 | 000,078,648 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV:64bit: - [2014/03/16 06:00:26 | 000,065,776 | ---- | M] () [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
    DRV:64bit: - [2014/03/16 06:00:25 | 000,092,544 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
    DRV:64bit: - [2009/07/14 12:22:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2009/07/14 12:22:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2009/07/14 12:22:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2009/07/14 12:18:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2009/07/14 12:17:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2009/07/14 12:17:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
    DRV:64bit: - [2009/07/14 12:15:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2009/07/14 08:29:33 | 005,020,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
    DRV:64bit: - [2009/06/20 12:39:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
    DRV:64bit: - [2009/06/20 12:39:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E)
    DRV:64bit: - [2009/06/11 07:04:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2009/06/11 07:04:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2009/06/11 07:04:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
    DRV:64bit: - [2009/06/11 07:01:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
    DRV:64bit: - [2005/03/29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
    DRV - [2009/07/14 11:49:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.ninemsn.com.au/?ocid=iehp
    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 5E C8 39 68 40 CF 01 [binary data]
    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-165555205-1945987488-1438750615-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:9.0.2013.75
    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
    FF - user.js - File not found

    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/03/16 06:00:31 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

    [2014/03/16 03:07:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\GREG\AppData\Roaming\Mozilla\Extensions
    [2014/03/16 03:06:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
    [2014/03/16 03:06:52 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    [2014/03/16 06:00:31 | 000,000,000 | ---D | M] (avast! Online Security) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

    O1 HOSTS File: ([2009/06/11 07:30:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
    O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
    O3 - HKLM\..\Toolbar: (avast! Online Security) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
    O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
    O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O1364bit: - gopher Prefix: missing
    O13 - gopher Prefix: missing
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 74.82.207.26 8.8.8.8
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{458EB26C-1747-4442-8B80-2CD7EE32E57A}: DhcpNameServer = 74.82.207.26 8.8.8.8
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/07/14 19:59:38 | 000,000,122 | R--- | M] () - D:\autorun.inf -- [ UDF ]
    O32 - AutoRun File - [2011/04/06 20:01:59 | 000,000,000 | RH-D | M] - F:\autorun -- [ NTFS ]
    O32 - AutoRun File - [2002/10/16 23:26:50 | 000,000,036 | RH-- | M] () - F:\autorun.inf -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

    ========== Files/Folders - Created Within 30 Days ==========

    [2014/03/16 20:08:02 | 000,000,000 | ---D | C] -- C:\Windows\Panther
    [2014/03/16 19:12:57 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
    [2014/03/16 19:10:33 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
    [2014/03/16 06:14:03 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Electronic_Arts_Inc
    [2014/03/16 06:11:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
    [2014/03/16 06:11:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts
    [2014/03/16 06:01:35 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\AVAST Software
    [2014/03/16 06:01:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
    [2014/03/16 06:00:54 | 000,080,184 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswStm.sys
    [2014/03/16 06:00:51 | 001,038,072 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
    [2014/03/16 06:00:51 | 000,421,704 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
    [2014/03/16 06:00:48 | 000,078,648 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
    [2014/03/16 06:00:46 | 000,092,544 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
    [2014/03/16 06:00:40 | 000,334,136 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
    [2014/03/16 06:00:24 | 000,043,152 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
    [2014/03/16 05:59:52 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
    [2014/03/16 05:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
    [2014/03/16 05:26:13 | 000,000,000 | ---D | C] -- C:\Users\GREG\.swt
    [2014/03/16 05:25:53 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Azureus
    [2014/03/16 05:25:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Vuze
    [2014/03/16 05:25:51 | 000,000,000 | ---D | C] -- C:\Users\GREG\Documents\Vuze Downloads
    [2014/03/16 03:25:31 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Macromedia
    [2014/03/16 03:25:31 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Macromedia
    [2014/03/16 03:25:31 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Adobe
    [2014/03/16 03:23:51 | 000,692,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
    [2014/03/16 03:23:51 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    [2014/03/16 03:23:50 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
    [2014/03/16 03:23:48 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
    [2014/03/16 03:21:30 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Adobe
    [2014/03/16 03:13:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
    [2014/03/16 03:13:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
    [2014/03/16 03:13:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
    [2014/03/16 03:13:15 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
    [2014/03/16 03:13:10 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
    [2014/03/16 03:13:10 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
    [2014/03/16 03:13:10 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    [2014/03/16 03:13:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    [2014/03/16 03:13:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
    [2014/03/16 03:07:09 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Mozilla
    [2014/03/16 03:07:09 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Mozilla
    [2014/03/16 03:06:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
    [2014/03/16 03:06:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
    [2014/03/16 03:06:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
    [2014/03/16 02:58:41 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Skype
    [2014/03/16 02:58:22 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Skype
    [2014/03/16 02:58:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    [2014/03/16 02:58:15 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
    [2014/03/16 02:58:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
    [2014/03/16 02:58:09 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
    [2014/03/16 02:58:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
    [2014/03/16 02:54:50 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Diagnostics
    [2014/03/16 02:28:33 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
    [2014/03/16 02:28:32 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
    [2014/03/16 02:28:32 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
    [2014/03/16 02:28:08 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
    [2014/03/16 02:28:08 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
    [2014/03/16 02:23:39 | 000,000,000 | R--D | C] -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    [2014/03/16 02:23:39 | 000,000,000 | R--D | C] -- C:\Users\GREG\Searches
    [2014/03/16 02:23:39 | 000,000,000 | R--D | C] -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    [2014/03/16 02:23:39 | 000,000,000 | -H-D | C] -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
    [2014/03/16 02:23:29 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Identities
    [2014/03/16 02:23:26 | 000,000,000 | R--D | C] -- C:\Users\GREG\Contacts
    [2014/03/16 02:23:24 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\VirtualStore
    [2014/03/16 02:22:57 | 000,000,000 | --SD | C] -- C:\Users\GREG\AppData\Roaming\Microsoft
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Videos
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Saved Games
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Pictures
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Music
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Links
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Favorites
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Downloads
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Documents
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\Desktop
    [2014/03/16 02:22:57 | 000,000,000 | R--D | C] -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\AppData\Local\Temporary Internet Files
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Templates
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Start Menu
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\SendTo
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Recent
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\PrintHood
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\NetHood
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Documents\My Videos
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Documents\My Pictures
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Documents\My Music
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\My Documents
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Local Settings
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\AppData\Local\History
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Cookies
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\Application Data
    [2014/03/16 02:22:57 | 000,000,000 | -HSD | C] -- C:\Users\GREG\AppData\Local\Application Data
    [2014/03/16 02:22:57 | 000,000,000 | -H-D | C] -- C:\Users\GREG\AppData
    [2014/03/16 02:22:57 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Temp
    [2014/03/16 02:22:57 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Local\Microsoft
    [2014/03/16 02:22:57 | 000,000,000 | ---D | C] -- C:\Users\GREG\AppData\Roaming\Media Center Programs

    ========== Files - Modified Within 30 Days ==========

    [2014/03/16 19:42:52 | 000,274,320 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
    [2014/03/16 19:15:20 | 000,039,252 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
    [2014/03/16 19:15:20 | 000,039,252 | ---- | M] () -- C:\Windows\SysNative\license.rtf
    [2014/03/16 19:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
    [2014/03/16 19:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\atiicdxx.dat
    [2014/03/16 09:55:54 | 000,013,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2014/03/16 09:55:54 | 000,013,600 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2014/03/16 06:27:13 | 000,713,888 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2014/03/16 06:27:13 | 000,619,206 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2014/03/16 06:27:13 | 000,107,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2014/03/16 06:11:13 | 000,002,217 | ---- | M] () -- C:\Users\Public\Desktop\Need For Speed World.lnk
    [2014/03/16 06:01:31 | 000,001,966 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
    [2014/03/16 06:00:26 | 001,038,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
    [2014/03/16 06:00:26 | 000,421,704 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
    [2014/03/16 06:00:26 | 000,334,136 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
    [2014/03/16 06:00:26 | 000,207,904 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
    [2014/03/16 06:00:26 | 000,080,184 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswStm.sys
    [2014/03/16 06:00:26 | 000,078,648 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
    [2014/03/16 06:00:26 | 000,065,776 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
    [2014/03/16 06:00:25 | 000,092,544 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
    [2014/03/16 06:00:24 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
    [2014/03/16 05:26:02 | 000,001,848 | ---- | M] () -- C:\Users\Public\Desktop\Vuze.lnk
    [2014/03/16 05:26:02 | 000,001,848 | ---- | M] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
    [2014/03/16 03:23:51 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
    [2014/03/16 03:23:51 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    [2014/03/16 03:13:06 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
    [2014/03/16 03:13:06 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
    [2014/03/16 03:13:06 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    [2014/03/16 03:13:05 | 000,174,504 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
    [2014/03/16 03:07:00 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
    [2014/03/16 02:58:16 | 000,002,697 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
    [2014/03/16 02:34:15 | 000,001,437 | ---- | M] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2014/03/16 02:22:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2014/03/16 02:21:56 | 3220,480,000 | -HS- | M] () -- C:\hiberfil.sys

    ========== Files Created - No Company Name ==========

    [2014/03/16 19:14:56 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
    [2014/03/16 19:14:46 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
    [2014/03/16 19:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
    [2014/03/16 19:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat
    [2014/03/16 19:09:15 | 3220,480,000 | -HS- | C] () -- C:\hiberfil.sys
    [2014/03/16 06:11:13 | 000,002,217 | ---- | C] () -- C:\Users\Public\Desktop\Need For Speed World.lnk
    [2014/03/16 06:01:31 | 000,001,966 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
    [2014/03/16 06:00:52 | 000,207,904 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
    [2014/03/16 06:00:52 | 000,065,776 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
    [2014/03/16 05:26:02 | 000,001,848 | ---- | C] () -- C:\Users\Public\Desktop\Vuze.lnk
    [2014/03/16 05:26:02 | 000,001,848 | ---- | C] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
    [2014/03/16 05:26:02 | 000,001,848 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk
    [2014/03/16 03:07:00 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2014/03/16 03:07:00 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
    [2014/03/16 02:58:16 | 000,002,697 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
    [2014/03/16 02:34:15 | 000,001,437 | ---- | C] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2014/03/16 02:23:50 | 000,001,409 | ---- | C] () -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
    [2014/03/16 02:23:44 | 000,001,443 | ---- | C] () -- C:\Users\GREG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    [2014/03/16 02:22:57 | 000,000,290 | ---- | C] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
    [2014/03/16 02:22:57 | 000,000,272 | ---- | C] () -- C:\Users\GREG\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

    ========== ZeroAccess Check ==========

    [2009/07/14 15:25:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "" = C:\Windows\SysNative\shell32.dll -- [2009/07/14 12:11:54 | 014,161,920 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shell32.dll -- [2009/07/14 11:46:14 | 012,866,560 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 12:10:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 11:45:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 12:11:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2014/03/16 06:01:35 | 000,000,000 | ---D | M] -- C:\Users\GREG\AppData\Roaming\AVAST Software
    [2014/03/16 07:47:36 | 000,000,000 | ---D | M] -- C:\Users\GREG\AppData\Roaming\Azureus

    ========== Purity Check ==========



    < End of report >

    ext

    OTL Extras logfile created on: 3/16/2014 9:57:26 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\GREG\Downloads
    64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.89% Memory free
    8.00 Gb Paging File | 5.92 Gb Available in Paging File | 74.02% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 465.66 Gb Total Space | 425.58 Gb Free Space | 91.39% Space Free | Partition Type: NTFS
    Drive D: | 3.00 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
    Drive E: | 100.00 Mb Total Space | 61.85 Mb Free Space | 61.85% Space Free | Partition Type: NTFS
    Drive F: | 1863.01 Gb Total Space | 909.12 Gb Free Space | 48.80% Space Free | Partition Type: NTFS

    Computer Name: GREG-PC | User Name: GREG | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-165555205-1945987488-1438750615-1001\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [edit] -- Reg Error: Key error.
    htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{1224871C-9FFB-4AC5-9123-0D3483C2271C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{139D793D-5DD0-4063-B903-3BB5722852D7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{140D4ABE-15A4-4F48-A7F8-3BA0E62758B9}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{218389F5-F97C-49F9-B1F1-55808E4B4A9D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{2187001D-73D6-4AC1-9842-522C3FDBBEB4}" = rport=445 | protocol=6 | dir=out | app=system |
    "{2A1291F3-270D-4C9C-8EAE-0488D6E1C5F5}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{3B04E1D2-7C9F-48DE-88E3-AEE065ED2B54}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{4BDC89C4-476C-4D66-92A3-B5279A0C1EC0}" = lport=139 | protocol=6 | dir=in | app=system |
    "{6757B8E4-AF32-4C39-AA63-DCB3FA7A9B1C}" = lport=445 | protocol=6 | dir=in | app=system |
    "{7E8F8F46-51FB-466E-A81A-3FC2A50C0695}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{8ADB047F-B5F6-4B7D-82CD-9820E848DE68}" = lport=138 | protocol=17 | dir=in | app=system |
    "{8FB50C3A-1DDE-4128-A7F4-64256A50737E}" = rport=138 | protocol=17 | dir=out | app=system |
    "{AD860E60-9A27-412F-8E7A-346A16455949}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{C64202FE-0E09-46E6-A689-4099D86A3C78}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{C7079728-C8BF-4489-9857-BDCB1372A3D6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{D1D4D501-AB7E-4709-8011-CB9474AC8167}" = rport=139 | protocol=6 | dir=out | app=system |
    "{D5750E85-1CE8-433A-8FA3-B8B9C3EC1721}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{D7C56C1E-3FE6-4008-96BC-FCA8E8A895E0}" = rport=137 | protocol=17 | dir=out | app=system |
    "{DB9C4F23-0549-413D-889A-DBBC15568200}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{E659376C-9306-4067-97AD-62D01BF1C395}" = lport=137 | protocol=17 | dir=in | app=system |
    "{F9205B27-B664-4EFE-8615-86727FEB7E04}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{03E738E9-7709-4BD1-BF71-C5B2BBAC7F32}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{09633074-0CAC-4ABB-A8B9-0AFD446FF539}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{09F22F14-9817-4C25-9826-3CE56DA59E71}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{114FAF18-C7A6-463B-B6F9-C3D6283760F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{23CEC35A-822E-4AA7-82F1-1D713CF56DD6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
    "{2A2B3792-CAC4-4DE2-A390-548D150D7546}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{36AE6735-75F6-49C5-A309-6991851F97D1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{4BC0F34E-EAA3-4E84-9E5D-27164796308B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{75855B4E-1221-4D2A-8AF9-9601CB85F83B}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
    "{7A5CDB91-C11E-4CD0-B7DC-1CF8CFDF670E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{866B9F03-74A5-485F-A18A-7B962205D263}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{96643F53-7B05-4BF7-9096-669057B050AD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{9E0E8550-C9B8-4EF3-A88D-0E865F8A6A47}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{A447AAB0-8E53-4EFF-B188-0EFA82D152CC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{AFDE9220-4C68-46D1-AD34-EFD931262D60}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{BFEBF711-B6EC-4AC1-BA25-4A1C6E9934AB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{D4975D17-5E5D-4E56-809B-8F20A151312D}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe |
    "{D7AB5B9F-D54E-4832-B577-6ABB33A646E5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{DEC67DF4-DF03-401E-9512-9F6E640B7249}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{EBAD8F40-E92D-4240-88A5-DE1EDA33B032}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{F07C71A8-1ED9-4451-A5A9-311BDA80A952}" = protocol=6 | dir=out | app=system |
    "{F81716C6-E090-4D49-BAC2-0965FA4800A8}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{26A24AE4-039D-4CA4-87B4-2F83217051FF}" = Java 7 Update 51
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.14
    "{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "8461-7759-5462-8226" = Vuze
    "Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
    "Avast" = avast! Free Antivirus
    "Mozilla Firefox 27.0.1 (x86 en-US)" = Mozilla Firefox 27.0.1 (x86 en-US)
    "MozillaMaintenanceService" = Mozilla Maintenance Service

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]
    Error - 3/15/2014 3:29:44 PM | Computer Name = GREG-PC | Source = Microsoft-Windows-CAPI2 | ID = 513
    Description = Cryptographic Services failed while processing the OnIdentity() call
    in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image
    of binary syolthep. System Error: The system cannot find the file specified. .

    [ System Events ]
    Error - 3/16/2014 5:11:10 AM | Computer Name = GREG-PC | Source = Service Control Manager | ID = 7024
    Description = The Windows Search service terminated with service-specific error
    %%-2147467243.

    Error - 3/15/2014 12:36:13 PM | Computer Name = GREG-PC | Source = Schannel | ID = 36888
    Description = The following fatal alert was generated: 10. The internal error state
    is 10.


    < End of report >
     
  4. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    This log is clean ?? You say you ran scanners and reformatted, did you reinstall your operating system?
     
  5. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    yes i used windows 7 home premium disc and reinstall it (used setting custom install).
    The pop up still pops up sometimes also getting ssl error (mainly on facebook and youtube). Also had a few sites try to redirect me (firefox blocked it).

    if its not an actually virus or spyware what could it be?????even with add-ons disabled get same pop up sometimes.
     
  6. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    At this point in time, I have no idea.....

    Let’s try Combofix to see if it can turn something up….

    Before you run Combofix you will need you to turn off any security software you have running.

    Combofix may need to reboot your computer more than once to do its job this is normal.

    You can download Combofix from one of these links. Please save it to the desktop and run it from there.

    Link 1
    Link 2
    Link 3

    1. Close any open browsers or any other programs that are open.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    Double click on combofix.exe & follow the prompts.
    When finished, it will produce a report for you.

    Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

    Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer.

    "information and logs"

    In your next post I need the following
    Log from Combofix

    2oG
     
  7. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    ComboFix 14-03-13.01 - GREG 16/03/2014 16:44:07.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.61.1033.18.4095.2982 [GMT 10.5:30]
    Running from: c:\users\GREG\Downloads\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\CFLog
    c:\cflog\EPLog.txt
    F:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-02-16 to 2014-03-16 )))))))))))))))))))))))))))))))
    .
    .
    2014-03-16 09:38 . 2014-03-15 15:50 -------- d-----w- c:\windows\Panther
    2014-03-16 08:42 . 2014-03-16 08:42 0 ----a-w- c:\windows\ativpsrm.bin
    2014-03-16 06:20 . 2014-03-16 06:20 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-03-16 04:59 . 2014-03-16 04:59 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
    2014-03-16 04:59 . 2014-03-16 04:59 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
    2014-03-16 02:58 . 2014-03-16 02:58 -------- d-----w- c:\program files (x86)\ImgBurn
    2014-03-16 02:33 . 2014-03-16 02:33 -------- d-----w- c:\program files\Movie Maker
    2014-03-16 02:30 . 2014-03-16 02:30 -------- d-----w- c:\program files (x86)\Bejeweled 3
    2014-03-16 02:25 . 2014-03-16 02:25 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
    2014-03-16 02:24 . 2014-03-16 02:24 -------- d-----w- C:\gameplay
    2014-03-16 01:23 . 2014-03-16 01:23 -------- d-----w- c:\program files (x86)\Chuzzle Deluxe
    2014-03-16 00:17 . 2014-03-16 00:17 -------- d-----w- c:\program files (x86)\EA Games
    2014-03-15 19:41 . 2014-03-15 19:41 -------- d-----w- c:\programdata\Electronic Arts
    2014-03-15 19:41 . 2014-03-15 19:41 -------- d-----w- c:\program files (x86)\Electronic Arts
    2014-03-15 19:30 . 2014-03-15 19:30 80184 ----a-w- c:\windows\system32\drivers\aswStm.sys
    2014-03-15 19:30 . 2014-03-15 19:30 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
    2014-03-15 19:30 . 2014-03-15 19:30 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys
    2014-03-15 19:30 . 2014-03-15 19:30 421704 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2014-03-15 19:30 . 2014-03-15 19:30 1038072 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2014-03-15 19:30 . 2014-03-15 19:30 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2014-03-15 19:30 . 2014-03-15 19:30 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
    2014-03-15 19:30 . 2014-03-15 19:30 334136 ----a-w- c:\windows\system32\aswBoot.exe
    2014-03-15 19:30 . 2014-03-15 19:30 43152 ----a-w- c:\windows\avastSS.scr
    2014-03-15 19:29 . 2014-03-15 19:29 -------- d-----w- c:\program files\AVAST Software
    2014-03-15 19:28 . 2014-03-15 19:28 -------- d-----w- c:\programdata\AVAST Software
    2014-03-15 18:55 . 2014-03-15 18:56 -------- d-----w- c:\program files (x86)\Vuze
    2014-03-15 16:53 . 2014-03-15 16:53 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-03-15 16:53 . 2014-03-15 16:53 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-03-15 16:53 . 2014-03-15 16:53 -------- d-----w- c:\windows\SysWow64\Macromed
    2014-03-15 16:53 . 2014-03-15 16:53 -------- d-----w- c:\windows\system32\Macromed
    2014-03-15 16:43 . 2014-03-15 16:43 -------- d-----w- c:\programdata\Oracle
    2014-03-15 16:43 . 2014-03-15 16:43 -------- d-----w- c:\program files (x86)\Common Files\Java
    2014-03-15 16:43 . 2014-03-15 16:43 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2014-03-15 16:43 . 2014-03-15 16:43 -------- d-----w- c:\program files (x86)\Java
    2014-03-15 16:36 . 2014-03-15 16:37 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
    2014-03-15 16:28 . 2014-03-15 16:28 -------- d-----w- c:\program files (x86)\Common Files\Skype
    2014-03-15 16:28 . 2014-03-15 16:28 -------- d-----r- c:\program files (x86)\Skype
    2014-03-15 16:28 . 2014-03-15 19:42 -------- d-sh--w- c:\windows\Installer
    2014-03-15 16:28 . 2014-03-15 16:28 -------- d-----w- c:\programdata\Skype
    2014-03-15 16:13 . 2014-02-16 16:02 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E7D6B453-9240-49CB-BC4A-A8705CE506C1}\mpengine.dll
    2014-03-15 16:13 . 2014-02-03 02:50 270496 ------w- c:\windows\system32\MpSigStub.exe
    2014-03-15 16:08 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll
    2014-03-15 16:08 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
    2014-03-15 16:08 . 2012-02-15 06:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2014-03-15 16:08 . 2012-02-15 05:44 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2014-03-15 16:08 . 2012-02-15 04:47 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2014-03-15 16:08 . 2012-02-15 04:46 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2014-03-15 15:58 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2014-03-15 15:58 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2014-03-15 15:58 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2014-03-15 15:58 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2014-03-15 15:58 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2014-03-15 15:58 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2014-03-15 15:58 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2014-03-15 15:58 . 2012-06-02 04:49 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2014-03-15 15:58 . 2012-06-02 04:45 36864 ----a-w- c:\windows\system32\wuapp.exe
    2014-03-15 15:52 . 2014-03-15 18:56 -------- d-----w- c:\users\GREG
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-03-16 06:22 . 2014-03-16 06:22 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E7D6B453-9240-49CB-BC4A-A8705CE506C1}\offreg.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20924576]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-01 254336]
    "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-03-15 3767096]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux2"=wdmaud.drv
    .
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
    S0 aswRvrt;avast! Revert; [x]
    S0 aswVmm;avast! VM Monitor; [x]
    S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
    S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - ASWRVRT
    *NewlyCreated* - ASWSP
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2014-03-15 19:30 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 74.82.207.26 8.8.8.8
    FF - ProfilePath - c:\users\GREG\AppData\Roaming\Mozilla\Firefox\Profiles\d5pn84z0.default\
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-03-16 16:55:55
    ComboFix-quarantined-files.txt 2014-03-16 06:25
    .
    Pre-Run: 455,860,822,016 bytes free
    Post-Run: 455,768,203,264 bytes free
    .
    - - End Of File - - 46E4EC5D626560B7A976A13011E2802C
    A36C5E4F47E84449FF07ED3517B43A31
     
  8. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    I can't tell if that did any good. Give me a run down on how it's acting and if that did anything for it.

    xboxdvl2, I just realized that you used the Custom install and not the Upgrade install so,
    you may have lost a lot of your settings. all these logs look ok so ?????
     
    Last edited: Mar 16, 2014
  9. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,071
    Likes Received:
    79
    Trophy Points:
    128
    xboxdvl2, in the custom install, i presume you deleted the partitions(100meg plus os) of win7, made new partitions, formated os partition & installed win7 into os partition?
     
  10. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    As far as I know, a custom install is not a repair install and will loose all of the installed programs and settings.. an Upgrade install is a repair install of the OS, does not loose programs or settings but only repairs the OS and does nothing for removing malware..
    A system restore or an image backup would be the way to go.. Looks like a lot of work ahead.
     
  11. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    i have never reformatted before.when i did the reformat i had 2 partions, c: and e:(system) i installed the os into c: then deleted a file called windows:eek:ld after it was done.
    I lost a lot of software but i can get it all again,all my pics & movies and music were backed up.

    atm youtube gets blocked with a message saying it tried to redirect me, everything else seems fine for now.If youtube doesn't get blocked i get the message in middle of the screen that says i need to update flash that i can't get rid of and i cant access youtube.
     
    Last edited: Mar 17, 2014
  12. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    Just guessing but maybe your Flash got messed up or exploited.
    Try uninstalling it and download a new copy.
     
  13. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,071
    Likes Received:
    79
    Trophy Points:
    128
    xboxdvl2, you didn't delete & make new partitions before you formated, did you?
     
  14. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    no i didn't i don't know how to .
     
  15. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,071
    Likes Received:
    79
    Trophy Points:
    128
    when doing custom install, click on options so can now delete partitions, make new partitions then just format the c: partition not the other one. this explains why you still have virus\malware issue.
     
  16. 2oldGeek

    2oldGeek Active member

    Joined:
    Jun 16, 2005
    Messages:
    3,691
    Likes Received:
    35
    Trophy Points:
    78
    good call, ddp
     
  17. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    ok i will remember that and try it if i reformat in future.
    apart from a few websites trying to redirect (which is blocked) and some ssl errors everything seems to be ok.

    ddp you might be able to help me with another issues i encountered.I had a bunch of locked empty folders on an external hard drive, i deleted the folders before the reformat and disconnected the drive now i dont have permission to access the files.I can go through the security takes and manually take owner ship of them and access them,is there an easier way to fix it???
     
  18. ddp

    ddp Moderator Staff Member

    Joined:
    Oct 15, 2004
    Messages:
    39,071
    Likes Received:
    79
    Trophy Points:
    128
    files are in the open part of the drive or in other folders?
     
  19. Mrguss

    Mrguss Regular member

    Joined:
    Jul 15, 2009
    Messages:
    493
    Likes Received:
    0
    Trophy Points:
    26
    @ xboxdvl2:

    Hello there.

    I had a similar situation before. when I get a new returned PC (Open box) for half the price. It took me 3 re-formations to make it work like new.

    For the Fake Flush update on YouTube:
    Using Firefox or Tor:
    Just download the add-on: YouTube Flash to HTML5 & it fix it right after. (sometimes need a refresh tho)
     
    Last edited: Mar 18, 2014
  20. xboxdvl2

    xboxdvl2 Regular member

    Joined:
    Dec 21, 2005
    Messages:
    1,186
    Likes Received:
    6
    Trophy Points:
    48
    files are in folders in open part of the drive.

    @Mrguss
    ty youtube seems to work now.
     
    Last edited: Mar 19, 2014

Share This Page