More powelik and others #?

pattyvdb
New Helpee

Posts: 16

More powelik and others #? Sept 28, 2014 23:01:23 GMT -8

Post by pattyvdb on Sept 28, 2014 23:01:23 GMT -8

Hello,

I also found this forum after reading the Norton forums, and I have similar issues to several of the last few posters.
I am posting from a non-infected computer, btw, because the infected computer runs slowly.

Infected computer is a Sony Vaio T-series running Windows 8 64-bit.

Norton Security Suite (version offered by isp Comcast cable) is installed, and doesn't find anything when scanning, but is popping up saying it blocked attacks by Trojan.Powelik, Trojan.Adclicker, Exploit toolkit website 32. When I look at task manager I see lots (10-15) of instances of "COM Surrogate (32 bit)". Also having the issue of a popup saying Powershell has stopped working, do I want to search for a solution, but when I say yes it never finds anything. Also Malwarebytes trial version is installed, and is constantly popping up saying it has blocked malicious websites.

This has been going on for about a week now. I tried scanning with Norton Power Eraser, nothing found. I have tried to use Norton's bootable recovery tool, as suggested by the Norton info on removing Powelik if Power Eraser doesn't work, but I haven't been able to get that to work, not sure if it's the infection or something else I'm doing wrong, that tool seems to be tricky to get to work.

I'm not totally computer literate but will follow instructions very closely. Thanks so much for any help!

Patricia

Last Edit: Oct 3, 2014 18:51:47 GMT -8 by Quads

dbrisen
Malware Removalists

Posts: 3,688

More powelik and others #? Sept 28, 2014 23:24:28 GMT -8 Krusty likes this

Post by dbrisen on Sept 28, 2014 23:24:28 GMT -8

Hi, you can call me dbrisen and I will be helping you out with this problem. I am still in training so some of my work will be reviewed by others but we will try and be as prompt as possible in helping you.

Do Not use advanced tools or any tools used on this board without supervision.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than other tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems. Bottom line is, if you are not sure about something, STOP and ASK until you are sure.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

>>>>>> Reply stating you have read the post fully. <<<<<<<

Also, please confirm that the system is running 64 bit Windows 8 or Windows 8.1 . Thank you.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

pattyvdb New Helpee Posts: 16	More powelik and others #? Sept 28, 2014 23:59:09 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by pattyvdb on Sept 28, 2014 23:59:09 GMT -8 I've read it fully. When I look at system information it just says "Windows 8". And yes it is 64 bit. Thanks-

dbrisen
Malware Removalists

Posts: 3,688

More powelik and others #? Sept 29, 2014 6:15:33 GMT -8

Post by dbrisen on Sept 29, 2014 6:15:33 GMT -8

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 64 bit version.

Place FRST64.exe onto your desktop from where ever it downloaded to. IF IT IS NOT ON THE DESKTOP (YOU DID NOT DOWNLOAD DIRECTLY TO DESKTOP), THEN RIGHT CLICK ON THE DOWNLOADED FILE AND SELECT CUT. FIND A BLANK SPOT ON YOUR DESKTOP AND RIGHT CLICK ON IT, SELECT PASTE AND THE FILE WILL BE ON THE DESKTOP. Thank You (this is very important later on)!

Start FRST64 that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)
Press Scan button.

It will make two logs (FRST.txt and Addition.txt) on your Desktop. Please attach the logs in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply. (Ask if you don't know how to do either of these).

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

pattyvdb
New Helpee

Posts: 16

More powelik and others #? Sept 29, 2014 17:19:35 GMT -8

Post by pattyvdb on Sept 29, 2014 17:19:35 GMT -8

FRST.txt is attached. It says "error: forbidden" when I try to attach frst.txt, so pasting below.
Thanks
Attachment Deleted

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-09-2014

Ran by Toni (administrator) on MINE on 29-09-2014 20:01:46

Running from C:\Users\Toni\Desktop

Loaded Profile: Toni (Available profiles: Toni)

Platform: Windows 8 (X64) OS Language: English (United States)

Internet Explorer Version 10

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

( ) C:\Windows\System32\lxebcoms.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\n360.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe

(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe

(Microsoft Corporation) C:\Windows\System32\vds.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

() C:\Program Files\Sony\VAIO Care\VCPerfService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\n360.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

() C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe

() C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe

() C:\Users\Toni\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

(Apple Inc.) C:\Program Files (x86)\Apple Software Update\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Apple Software Update\ApplePhotoStreams.exe

() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe

(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

() C:\Program Files\Sony\VAIO Care\listener.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe

(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Apple Inc.) C:\Program Files (x86)\Apple Software Update\APSDaemon.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Users\Toni\AppData\Local\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-09-20] (Realtek Semiconductor)

HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-11-05] (Qualcomm Atheros)

HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-11-05] (Qualcomm Atheros Commnucations)

HKLM\...\Run: [lxebmon.exe] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe [772712 2013-01-23] ()

HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe [150264 2013-01-23] ()

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [68776 2012-08-18] (Sony Corporation)

HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [ATLauncher] => "C:\Program Files\McAfeeEx\McAfeeAntiTheft\ATLauncher.exe" /createshortcuts:1

HKLM-x32\...\Run: [ATUninstallIcon] => "C:\Program Files\McAfeeEx\McAfeeAntiTheft\ATLauncher.exe" /createuninstallentry:1

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-430900155-2078002147-2229020080-1001\...\Run: [Google Update] => C:\Users\Toni\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-09-22] (Google Inc.)

HKU\S-1-5-21-430900155-2078002147-2229020080-1001\...\Run: [Amazon Cloud Player] => C:\Users\Toni\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3140608 2014-01-14] ()

HKU\S-1-5-21-430900155-2078002147-2229020080-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Apple Software Update\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-430900155-2078002147-2229020080-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Apple Software Update\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)

HKU\S-1-5-21-430900155-2078002147-2229020080-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!

Startup: C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk

ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

Startup: C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Toni\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = sony13.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM-x32 - DefaultScope value is missing.

SearchScopes: HKCU - {4B6D1FBF-C8A2-4536-8F93-6A9735F9817C} URL = start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dnldstr0101&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0F0FyCtD0A0CtBzztC0BtCtN0D0Tzu0CyByDtCtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1Czu1Q1G1I1Q1B2Z1CtDtCtDtC&cr=544139203&ir=

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)

DPF: HKLM-x32 {D3CCEFAF-8EE1-40FE-BE25-366E2B016DAB} lod.ttsc.net/ActiveX/VMRCActiveXClient.cab

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @sony.com/ReaderDesktop -> C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Toni\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Toni\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Toni\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-09-29]

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2013-11-29]

Chrome:

=======

CHR HomePage: Default -> 690FE1D8C6E0692DA2FBD813AE9FA01ECAAC1E4E7638B09FFC7F0E22591D14CE

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}

CHR Plugin: (Shockwave Flash) - C:\Users\Toni\AppData\Local\Google\Chrome\Application\37.0.2062.124\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Toni\AppData\Local\Google\Chrome\Application\37.0.2062.124\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Toni\AppData\Local\Google\Chrome\Application\37.0.2062.124\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File

CHR Plugin: (Reader Application Detector) - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)

CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Users\Toni\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Profile: C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-22]

CHR Extension: (Google Drive) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-22]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-26]

CHR Extension: (YouTube) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-22]

CHR Extension: (Google Cast) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2013-09-22]

CHR Extension: (Google Search) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-22]

CHR Extension: (Norton Security Toolbar) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-09-22]

CHR Extension: (Google Wallet) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-22]

CHR Extension: (Gmail) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-22]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-07-13] (Adobe Systems) [File not signed]

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-11-05] (Qualcomm Atheros Commnucations)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2428088 2014-08-12] (Microsoft Corporation)

R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [102224 2012-08-17] (Condusiv Technologies)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)

S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [43520 2012-07-25] (Microsoft Corporation)

S2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)

R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [1052328 2010-04-14] ( )

R2 lxeb_device; C:\Windows\SysWOW64\lxebcoms.exe [598696 2010-04-14] ( )

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)

S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [634368 2012-07-25] (Microsoft Corporation)

S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-10-18] (Sony Corporation)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)

R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] () [File not signed]

S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2012-09-19] (Sony Corporation) [File not signed]

S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18432 2012-07-25] (Microsoft Corporation)

S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [964608 2012-09-28] (Sony Corporation) [File not signed]

R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-27] (Sony Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-01] (Microsoft Corporation)

R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-11-05] (Atheros) [File not signed]

S2 0247671397864266mcinstcleanup; C:\Windows\TEMP\024767~1.EXE -cleanup -nolog [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-12] (Symantec Corporation)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-11-05] (Qualcomm Atheros)

R3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-11-05] (Qualcomm Atheros)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)

R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23376 2012-08-17] (Condusiv Technologies)

R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [103248 2012-08-17] (Condusiv Technologies)

R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140926.003\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-29] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140928.002\ENG64.SYS [129752 2014-09-28] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140928.002\EX64.SYS [2137304 2014-09-28] (Symantec Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-11-08] (Synaptics Incorporated)

R3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-10] (Sony Corporation)

R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-07-22] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-09-09] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-07-23] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\N360x64\1505000.013\SymELAM.sys [23568 2013-09-09] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-17] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-09-26] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-07-23] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-29 20:01 - 2014-09-29 20:02 - 00027007 _____ () C:\Users\Toni\Desktop\FRST.txt

2014-09-29 20:01 - 2014-09-29 20:01 - 00000000 ____D () C:\FRST

2014-09-29 19:58 - 2014-09-29 19:58 - 02108928 _____ (Farbar) C:\Users\Toni\Desktop\FRST64.exe

2014-09-18 01:19 - 2014-09-18 01:19 - 00000000 _____ () C:\Users\Toni\AppData\Roaming\djvvelt.dll

2014-09-16 03:34 - 2014-09-16 03:35 - 00404712 _____ () C:\Windows\Minidump\091614-59484-01.dmp

2014-09-16 03:34 - 2014-09-16 03:34 - 767665012 _____ () C:\Windows\MEMORY.DMP

2014-09-16 03:34 - 2014-09-16 03:34 - 00000000 ____D () C:\Windows\Minidump

2014-09-16 00:57 - 2014-09-27 01:35 - 00000000 ____D () C:\NPE

2014-09-16 00:54 - 2014-09-27 01:43 - 00000000 ____D () C:\Users\Toni\AppData\Local\NPE

2014-09-16 00:53 - 2014-09-16 00:53 - 03060320 ____N (Symantec Corporation) C:\Users\Toni\Downloads\NPE.exe

2014-09-15 23:56 - 2014-09-29 02:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-09-15 23:55 - 2014-09-21 00:48 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-09-15 23:55 - 2014-09-15 23:55 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-09-15 23:55 - 2014-09-15 23:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-09-15 23:55 - 2014-09-15 23:55 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-09-15 23:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-09-15 23:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-09-15 23:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-09-14 12:01 - 2014-09-14 12:01 - 00000000 ____D () C:\N360_BACKUP

2014-09-11 21:02 - 2014-09-11 21:02 - 00000982 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk

2014-09-11 21:00 - 2014-09-13 16:59 - 00000000 ____D () C:\Update

2014-09-11 19:44 - 2014-09-11 19:44 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-09-11 19:44 - 2014-09-11 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-09-11 19:44 - 2014-09-11 19:44 - 00000000 ____D () C:\Program Files\iPod

2014-09-11 19:43 - 2014-09-11 19:44 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-09-11 19:43 - 2014-09-11 19:44 - 00000000 ____D () C:\Program Files\iTunes

2014-09-11 19:43 - 2014-09-11 19:44 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-08-31 02:06 - 2014-08-31 02:06 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Security Suite

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-29 20:03 - 2013-08-31 10:47 - 00000000 ____D () C:\Users\Toni\AppData\Local\CrashDumps

2014-09-29 20:00 - 2012-07-26 03:12 - 00000000 ____D () C:\Windows\system32\sru

2014-09-29 19:58 - 2012-07-26 02:28 - 00005384 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-09-29 19:55 - 2013-09-22 13:17 - 00000914 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-430900155-2078002147-2229020080-1001UA.job

2014-09-29 19:54 - 2013-06-02 05:23 - 01983160 _____ () C:\Windows\WindowsUpdate.log

2014-09-29 02:56 - 2013-09-29 17:13 - 00308222 _____ () C:\ProgramData\lxebscan.log

2014-09-29 02:51 - 2012-07-26 02:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-09-29 02:51 - 2012-07-26 00:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-09-29 02:50 - 2012-07-26 00:26 - 00262144 ___SH () C:\Windows\system32\config\BBI

2014-09-29 02:12 - 2014-07-29 23:09 - 00003906 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{42038B24-6F2C-497F-A25C-52DE1A0671D1}

2014-09-27 23:56 - 2012-07-26 02:21 - 00032724 _____ () C:\Windows\setupact.log

2014-09-27 17:22 - 2013-09-22 13:19 - 00002355 _____ () C:\Users\Toni\Desktop\Google Chrome.lnk

2014-09-27 16:42 - 2012-07-26 03:12 - 00000000 ____D () C:\Windows\AUInstallAgent

2014-09-27 16:38 - 2012-08-02 21:22 - 00189456 _____ () C:\Windows\PFRO.log

2014-09-27 01:46 - 2013-09-19 12:55 - 00105984 ___SH () C:\Users\Toni\Desktop\Thumbs.db

2014-09-27 01:05 - 2013-09-03 22:03 - 00000000 ____D () C:\Program Files\Microsoft Office 15

2014-09-27 00:53 - 2014-03-01 11:45 - 00005211 _____ () C:\Users\Toni\Desktop\kats pics - Shortcut.lnk

2014-09-21 15:56 - 2013-09-29 17:12 - 00000000 ____D () C:\Program Files (x86)\Lexmark Pro200-S500 Series

2014-09-21 00:19 - 2013-11-15 00:15 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update

2014-09-18 01:18 - 2012-07-26 00:38 - 00000000 ____D () C:\Windows\system32\Sysprep

2014-09-16 03:21 - 2012-07-26 03:12 - 00000000 ____D () C:\Windows\system32\NDF

2014-09-16 00:54 - 2013-09-19 12:55 - 00000000 ____D () C:\ProgramData\Norton

2014-09-14 12:55 - 2013-09-22 13:17 - 00000862 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-430900155-2078002147-2229020080-1001Core.job

2014-09-13 15:31 - 2012-07-26 03:12 - 00000000 ____D () C:\Windows\rescache

2014-09-11 21:10 - 2013-08-21 21:26 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-430900155-2078002147-2229020080-1001

2014-09-11 21:02 - 2013-06-02 06:04 - 00000000 ____D () C:\ProgramData\Sony Corporation

2014-09-11 21:02 - 2013-06-02 05:28 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation

2014-09-11 21:01 - 2013-06-02 05:06 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-09-11 20:20 - 2012-07-26 03:12 - 00000000 ___HD () C:\Windows\ELAMBKUP

2014-09-11 20:19 - 2014-08-22 23:15 - 03286528 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 01623040 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00773632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-09-11 20:19 - 2014-08-22 23:15 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-09-11 20:19 - 2014-08-22 23:15 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-09-11 20:19 - 2014-08-22 23:14 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-09-11 20:19 - 2014-08-22 23:14 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-09-11 20:19 - 2014-08-22 23:14 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-09-11 20:19 - 2014-08-22 23:14 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-09-11 20:19 - 2012-07-26 02:59 - 00000000 ____D () C:\Windows\CbsTemp

2014-09-11 20:18 - 2013-11-09 11:14 - 00079794 _____ () C:\ProgramData\lxeb.log

2014-09-02 19:36 - 2013-09-29 17:15 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-09-02 01:23 - 2013-09-29 17:16 - 00038686 _____ () C:\ProgramData\lxebJSW.log

2014-08-31 21:20 - 2013-08-21 21:19 - 00000000 ____D () C:\Users\Toni\AppData\Local\Packages

2014-08-31 02:05 - 2013-11-29 16:41 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite

2014-08-31 02:05 - 2013-11-17 12:37 - 00002440 _____ () C:\Users\Public\Desktop\Norton Security Suite.lnk

2014-08-31 02:05 - 2013-09-19 13:00 - 00003228 _____ () C:\Windows\System32\Tasks\Norton WSC Integration

2014-08-31 02:05 - 2013-09-19 12:59 - 00000000 ____D () C:\Windows\system32\Drivers\N360x64

Some content of TEMP:

====================

C:\Users\Toni\AppData\Local\Temp\ctoqogo.dll

C:\Users\Toni\AppData\Local\Temp\hsnmdqz.dll

C:\Users\Toni\AppData\Local\Temp\hxhrvvf.dll

C:\Users\Toni\AppData\Local\Temp\kjokcpe.dll

C:\Users\Toni\AppData\Local\Temp\OfficeSetup.exe

C:\Users\Toni\AppData\Local\Temp\qsromly.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-09-27 18:34

==================== End Of Log ============================

pattyvdb New Helpee Posts: 16	More powelik and others #? Sept 29, 2014 17:28:01 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by pattyvdb on Sept 29, 2014 17:28:01 GMT -8 Sorry, I meant it's additions.txt that won't attach. I tried pasting and it won't let me post if I paste it, says freeforum is blocking it and says to report this: CloudFlare Ray ID: 171ca07ebca0094a Patricia

Quads Malware Removalists In New Zealand Posts: 9,387	More powelik and others #? Sept 29, 2014 17:38:39 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Quads on Sept 29, 2014 17:38:39 GMT -8 So it is ready for dbrisen go to Wikisend, wikisend.com/ and upload the addition.txt there, then post the download link back in a message Quads
	Last Edit: Sept 29, 2014 17:39:29 GMT -8 by Quads

pattyvdb New Helpee Posts: 16	More powelik and others #? Sept 29, 2014 19:08:51 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by pattyvdb on Sept 29, 2014 19:08:51 GMT -8 Here is the download link for addition.txt. wikisend.com/download/146410/Addition.txt Thx

dbrisen
Malware Removalists

Posts: 3,688

More powelik and others #? Sept 29, 2014 20:37:32 GMT -8

Post by dbrisen on Sept 29, 2014 20:37:32 GMT -8

Thank you, pattyvdb, for the logs. They were done just fine. And thank you, Quads, for directing the user to post the file so it is ready for my use.

I will review the logs and get a script to begin the repairs with shortly.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

dbrisen
Malware Removalists

Posts: 3,688

More powelik and others #? Sept 29, 2014 21:34:15 GMT -8

Post by dbrisen on Sept 29, 2014 21:34:15 GMT -8

You may want to read carefully all of this message first before starting the steps.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attachment Deleted

Download the script attached, needs to be the same file name as well (fixlist.txt), have it on the Desktop, so that fixlist.txt is next to FRST64.exe,

DO NOT DRAG AND DROP to download the script, it won't work for FRST (Right click on the attachment link (not the normal left click) and from the menu choose Save As or Save Link as.)

The script tells FRST what to do.

Start FRST that is on the desktop
When the tool opens click Yes to disclaimer. (if it still does)

Press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) please post it to your reply (attach or paste)

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

Post by pattyvdb on Sept 28, 2014 23:01:23 GMT -8

Post by dbrisen on Sept 28, 2014 23:24:28 GMT -8

Post by pattyvdb on Sept 28, 2014 23:59:09 GMT -8

Post by dbrisen on Sept 29, 2014 6:15:33 GMT -8

Post by pattyvdb on Sept 29, 2014 17:19:35 GMT -8

Post by pattyvdb on Sept 29, 2014 17:28:01 GMT -8

Post by Quads on Sept 29, 2014 17:38:39 GMT -8

Post by pattyvdb on Sept 29, 2014 19:08:51 GMT -8

Post by dbrisen on Sept 29, 2014 20:37:32 GMT -8

Post by dbrisen on Sept 29, 2014 21:34:15 GMT -8