Am getting tired of it.... for couple weeks or so alot of times internet wouldn't work due can not connect to proxy server so I always uncheck the box "auto connect to proxy settings" or something like that and it always have a check on it.... how can I leave it off? It getting so annoying. Thanks in advance!
Proxy settings
- Thread starter bigdog33
- Start date
Scan your system for malware. That shouldn't be getting auto-checked.
Firstly, run a scan with Malwarebytes Antimalware (the Free version is fine, you don't need to activate the Pro trial). Scan with it, delete whatever it finds, reboot and post the log here. Download it from here:
https://www.malwarebytes.org/mwb-download/
Secondly, run a scan with AdwCleaner. Same as above, scan with it, delete what it finds, post the log file here. Download from here:
AdwCleaner Download
Thirdly, run a scan with HiJackThis. Run it as Admin, pick the "scan and generate log" option, and then post the logfile here. Do NOT remove ANYTHING unless told to do so, as removing the wrong entry can damage your system. Download it from here:
HiJackThis | SourceForge.net
Firstly, run a scan with Malwarebytes Antimalware (the Free version is fine, you don't need to activate the Pro trial). Scan with it, delete whatever it finds, reboot and post the log here. Download it from here:
https://www.malwarebytes.org/mwb-download/
Secondly, run a scan with AdwCleaner. Same as above, scan with it, delete what it finds, post the log file here. Download from here:
AdwCleaner Download
Thirdly, run a scan with HiJackThis. Run it as Admin, pick the "scan and generate log" option, and then post the logfile here. Do NOT remove ANYTHING unless told to do so, as removing the wrong entry can damage your system. Download it from here:
HiJackThis | SourceForge.net
I'm using firefox aince chrome doesn't work after the restart... and it's very very slow anyways here's the log.
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Scan Date: 6/3/2015
Scan Time: 1:07:08 PM
Logfile:
Administrator: Yes
Version: 2.01.6.1022
Malware Database: v2015.06.03.04
Rootkit Database: v2015.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 397397
Time Elapsed: 41 min, 58 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 10
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
Registry Keys: 12
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1930e38a-deef-4cf4-9bfb-9c4ea3689a9d}, Quarantined, [a2aea214ee9cb77f48e65111c53e9f61],
PUP.Optional.AskPartnerNetwork.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\AAAAKABCGHBHLOHJJNONBAADLHLKHAOB, Quarantined, [78d81a9cbdcd4de93ea27d04679e42be],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\FGKBMEDCKHCIBHKDHAOKEBNLLOKEOKEK, Quarantined, [b19f684ee6a44aec94e906e0dd26867a],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211181102}, Quarantined, [89c7f6c098f2a09695ae186681847b85],
PUP.Optional.ConduitTB.Gen.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{333AB261-9BE4-45E2-8ADF-F814D184C766}, Quarantined, [f35d8135fe8c34024f04611f976e1de3],
PUP.Optional.Spigot.A, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A579E79E-DA89-48A4-9549-BFEA666E26A3}, Quarantined, [e66ad9dddcae7eb806116d7bf112728e],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
Registry Values: 8
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{1930E38A-DEEF-4CF4-9BFB-9C4EA3689A9D}, Quarantined, [a2aea214ee9cb77f48e65111c53e9f61],
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{1930e38a-deef-4cf4-9bfb-9c4ea3689a9d}, Quarantined, [5df3cceab3d751e5c06e90d2e221cf31],
PUP.Optional.AskPartnerNetwork.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\aaaakabcghbhlohjjnonbaadlhlkhaob|path, C:\ProgramData\AskPartnerNetwork\Toolbar\EPNV64\CRX\ToolbarCR.crx, Quarantined, [78d81a9cbdcd4de93ea27d04679e42be]
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\fgkbmedckhcibhkdhaokebnllokeokek|path, C:\Users\radioshack\AppData\Local\CRE\fgkbmedckhcibhkdhaokebnllokeokek.crx, Quarantined, [b19f684ee6a44aec94e906e0dd26867a]
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211181102}|AppName, Shopping Sidekick Plugin-bg.exe, Quarantined, [89c7f6c098f2a09695ae186681847b85]
PUP.Optional.ConduitTB.Gen.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{333AB261-9BE4-45E2-8ADF-F814D184C766}|AppPath, C:\Users\radioshack\AppData\Local\Conduit\CT3247201, Quarantined, [f35d8135fe8c34024f04611f976e1de3]
PUP.Optional.Spigot.A, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A579E79E-DA89-48A4-9549-BFEA666E26A3}|URL, https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=282369&p={searchTerms}, Quarantined, [e66ad9dddcae7eb806116d7bf112728e]
PUM.Bad.Proxy, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, 127.0.0.1:8118, Quarantined, [034dd7dfc0ca0f27225d5c198f76af51]
Registry Data: 0
(No malicious items detected)
Folders: 1
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
Files: 26
PUP.Optional.Mypcbackup, C:\Users\Owner\AppData\Local\Temp\BackupSetup.exe, Quarantined, [98b86452c6c451e5619c432c0ff7ef11],
Backdoor.Agent.WD, C:\Users\Owner\AppData\Local\Temp\ACC3.tmp.exe, Quarantined, [2a26e9cd8ffb60d6ab037afaf808bc44],
Trojan.Dropper, C:\Users\Owner\AppData\Local\Temp\6769.tmp.exe, Quarantined, [e868ab0bb6d48fa78cdfdc995aa6669a],
PUP.Optional.Spigot.SID, C:\Users\Owner\AppData\Local\Temp\~sp391E.tmp, Quarantined, [123e328443478ea8a340a4cbe52119e7],
PUP.Optional.APNToolBar.A, C:\Users\Owner\Documents\APNSetup1.exe, Quarantined, [66ea199d4941ee489c23224124de29d7],
PUP.Optional.Softonic, C:\Users\Owner\Downloads\SoftonicDownloader_for_noiseware-community-edition.exe, Quarantined, [28285c5a33574beb83ce875517eac63a],
PUP.Optional.Jelbrus.A, C:\Users\Owner\Downloads\Corel_Paint_Shop_Pro_X6_[ENG]_[Portable].exe, Quarantined, [4808249293f749ed86db2f4121e5f709],
PUP.Optional.Montiera, C:\Users\Owner\Downloads\HD_Player__CD5MTCD15092_79ea098ccffcda9fa96aa0d9051913bd.exe, Quarantined, [7ad64472008ab0863950cb73689b03fd],
PUP.Optional.APNToolBar.A, C:\Windows\Installer\8cf04.msi, Quarantined, [3c14f4c2a1e96acc6b54da89f111ff01],
PUP.Optional.ChromeHitory.A, C:\Users\Owner\AppData\Local\ChromeHitoryDB, Quarantined, [e66ae5d145455ed82a1842b9d42f3ec2],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\ tmjob.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\amff.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\amie.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\checkproxy.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\config.txt, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\default.action, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\default.filter, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint64.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\jpchromium.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\jpchromium64.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\mgwz(180).dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\mgwz.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy(179).exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy.log, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
Physical Sectors: 0
(No malicious items detected)
(end)
Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software
Scan Date: 6/3/2015
Scan Time: 1:07:08 PM
Logfile:
Administrator: Yes
Version: 2.01.6.1022
Malware Database: v2015.06.03.04
Rootkit Database: v2015.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 397397
Time Elapsed: 41 min, 58 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 10
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
Registry Keys: 12
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1930e38a-deef-4cf4-9bfb-9c4ea3689a9d}, Quarantined, [a2aea214ee9cb77f48e65111c53e9f61],
PUP.Optional.AskPartnerNetwork.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\AAAAKABCGHBHLOHJJNONBAADLHLKHAOB, Quarantined, [78d81a9cbdcd4de93ea27d04679e42be],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\FGKBMEDCKHCIBHKDHAOKEBNLLOKEOKEK, Quarantined, [b19f684ee6a44aec94e906e0dd26867a],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211181102}, Quarantined, [89c7f6c098f2a09695ae186681847b85],
PUP.Optional.ConduitTB.Gen.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{333AB261-9BE4-45E2-8ADF-F814D184C766}, Quarantined, [f35d8135fe8c34024f04611f976e1de3],
PUP.Optional.Spigot.A, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A579E79E-DA89-48A4-9549-BFEA666E26A3}, Quarantined, [e66ad9dddcae7eb806116d7bf112728e],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A1E7709A-3AFB-49B8-8719-CCBF3F73CCB1}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{2F137995-4D26-44AD-9C4E-91055090A817}, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
Registry Values: 8
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{1930E38A-DEEF-4CF4-9BFB-9C4EA3689A9D}, Quarantined, [a2aea214ee9cb77f48e65111c53e9f61],
PUP.Optional.InternetHelper.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{1930e38a-deef-4cf4-9bfb-9c4ea3689a9d}, Quarantined, [5df3cceab3d751e5c06e90d2e221cf31],
PUP.Optional.AskPartnerNetwork.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\aaaakabcghbhlohjjnonbaadlhlkhaob|path, C:\ProgramData\AskPartnerNetwork\Toolbar\EPNV64\CRX\ToolbarCR.crx, Quarantined, [78d81a9cbdcd4de93ea27d04679e42be]
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\fgkbmedckhcibhkdhaokebnllokeokek|path, C:\Users\radioshack\AppData\Local\CRE\fgkbmedckhcibhkdhaokebnllokeokek.crx, Quarantined, [b19f684ee6a44aec94e906e0dd26867a]
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211181102}|AppName, Shopping Sidekick Plugin-bg.exe, Quarantined, [89c7f6c098f2a09695ae186681847b85]
PUP.Optional.ConduitTB.Gen.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{333AB261-9BE4-45E2-8ADF-F814D184C766}|AppPath, C:\Users\radioshack\AppData\Local\Conduit\CT3247201, Quarantined, [f35d8135fe8c34024f04611f976e1de3]
PUP.Optional.Spigot.A, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A579E79E-DA89-48A4-9549-BFEA666E26A3}|URL, https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=282369&p={searchTerms}, Quarantined, [e66ad9dddcae7eb806116d7bf112728e]
PUM.Bad.Proxy, HKU\S-1-5-21-497509698-1438478727-12444243-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, 127.0.0.1:8118, Quarantined, [034dd7dfc0ca0f27225d5c198f76af51]
Registry Data: 0
(No malicious items detected)
Folders: 1
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
Files: 26
PUP.Optional.Mypcbackup, C:\Users\Owner\AppData\Local\Temp\BackupSetup.exe, Quarantined, [98b86452c6c451e5619c432c0ff7ef11],
Backdoor.Agent.WD, C:\Users\Owner\AppData\Local\Temp\ACC3.tmp.exe, Quarantined, [2a26e9cd8ffb60d6ab037afaf808bc44],
Trojan.Dropper, C:\Users\Owner\AppData\Local\Temp\6769.tmp.exe, Quarantined, [e868ab0bb6d48fa78cdfdc995aa6669a],
PUP.Optional.Spigot.SID, C:\Users\Owner\AppData\Local\Temp\~sp391E.tmp, Quarantined, [123e328443478ea8a340a4cbe52119e7],
PUP.Optional.APNToolBar.A, C:\Users\Owner\Documents\APNSetup1.exe, Quarantined, [66ea199d4941ee489c23224124de29d7],
PUP.Optional.Softonic, C:\Users\Owner\Downloads\SoftonicDownloader_for_noiseware-community-edition.exe, Quarantined, [28285c5a33574beb83ce875517eac63a],
PUP.Optional.Jelbrus.A, C:\Users\Owner\Downloads\Corel_Paint_Shop_Pro_X6_[ENG]_[Portable].exe, Quarantined, [4808249293f749ed86db2f4121e5f709],
PUP.Optional.Montiera, C:\Users\Owner\Downloads\HD_Player__CD5MTCD15092_79ea098ccffcda9fa96aa0d9051913bd.exe, Quarantined, [7ad64472008ab0863950cb73689b03fd],
PUP.Optional.APNToolBar.A, C:\Windows\Installer\8cf04.msi, Quarantined, [3c14f4c2a1e96acc6b54da89f111ff01],
PUP.Optional.ChromeHitory.A, C:\Users\Owner\AppData\Local\ChromeHitoryDB, Quarantined, [e66ae5d145455ed82a1842b9d42f3ec2],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\ tmjob.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\amff.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\amie.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\checkproxy.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\config.txt, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\default.action, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\default.filter, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint.dll, Delete-on-Reboot, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\gmint64.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\jpchromium.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\jpchromium64.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\mgwz(180).dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\mgwz.dll, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy(179).exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy.exe, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
PUP.Optional.Privoxy.A, C:\Program Files (x86)\Alfasistem Memory\privoxy.log, Quarantined, [1a36377f7e0c94a2a8975f847c87be42],
Physical Sectors: 0
(No malicious items detected)
(end)
# AdwCleaner v4.206 - Logfile created 03/06/2015 at 14:22:14
# Updated 01/06/2015 by Xplode
# Database : 2015-06-01.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Owner - COMPUTER
# Running from : C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2A9H00C5\AdwCleaner (1).exe
# Option : Cleaning
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Scheduled tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Web browsers ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v26.0 (en-US)
-\\ Google Chrome v43.0.2357.81
*************************
AdwCleaner[R0].txt - [9711 bytes] - [17/12/2013 09:41:07]
AdwCleaner[R1].txt - [7221 bytes] - [19/03/2014 21:53:30]
AdwCleaner[R2].txt - [11204 bytes] - [09/05/2015 13:28:06]
AdwCleaner[R3].txt - [1215 bytes] - [03/06/2015 14:19:27]
AdwCleaner[S0].txt - [8625 bytes] - [17/12/2013 09:43:11]
AdwCleaner[S1].txt - [6861 bytes] - [19/03/2014 21:55:45]
AdwCleaner[S2].txt - [10695 bytes] - [09/05/2015 13:29:38]
AdwCleaner[S3].txt - [1141 bytes] - [03/06/2015 14:22:14]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1200 bytes] ##########
# Updated 01/06/2015 by Xplode
# Database : 2015-06-01.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Owner - COMPUTER
# Running from : C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2A9H00C5\AdwCleaner (1).exe
# Option : Cleaning
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Scheduled tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Web browsers ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v26.0 (en-US)
-\\ Google Chrome v43.0.2357.81
*************************
AdwCleaner[R0].txt - [9711 bytes] - [17/12/2013 09:41:07]
AdwCleaner[R1].txt - [7221 bytes] - [19/03/2014 21:53:30]
AdwCleaner[R2].txt - [11204 bytes] - [09/05/2015 13:28:06]
AdwCleaner[R3].txt - [1215 bytes] - [03/06/2015 14:19:27]
AdwCleaner[S0].txt - [8625 bytes] - [17/12/2013 09:43:11]
AdwCleaner[S1].txt - [6861 bytes] - [19/03/2014 21:55:45]
AdwCleaner[S2].txt - [10695 bytes] - [09/05/2015 13:29:38]
AdwCleaner[S3].txt - [1141 bytes] - [03/06/2015 14:22:14]
########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1200 bytes] ##########
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 2:35:44 PM, on 6/3/2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
FIREFOX: 26.0 (en-US)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM0A48PK\HijackThis.exe
C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.yahoo.com?fr=hp-avast&type=avastbcl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)
O2 - BHO: Ask Toolbar for Epson BHO - {45504E56-3634-006A-76A7-7A786E7484D7} - (no file)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
O3 - Toolbar: (no name) - {45504E56-3634-006A-76A7-7A786E7484D7} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [ntouchPC] C:\Users\Owner\AppData\Local\Sorenson\ntouch PC\Application\ntouchPC.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Wondershare Helper Compact] "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EpsonCustomerParticipation - SEIKO EPSON CORPORATION - C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe (file missing)
O23 - Service: Microsoft Digital Experience Analytics Service (MDXAnalyticsService) - Unknown owner - C:\Program Files (x86)\Microsoft Digital Experience\Microsoft.MDX.AnalyticsService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Toshiba Laptop Checkup Application Launcher (Norton PC Checkup Application Launcher) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\SymcPCCULaunchSvc.exe
O23 - Service: Common Client Job Manager Service (PCCUJobMgr) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update service - Company - C:\Program Files (x86)\Popcorn Time\Updater.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 12080 bytes
Scan saved at 2:35:44 PM, on 6/3/2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17801)
FIREFOX: 26.0 (en-US)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RM0A48PK\HijackThis.exe
C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.yahoo.com?fr=hp-avast&type=avastbcl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)
O2 - BHO: Ask Toolbar for Epson BHO - {45504E56-3634-006A-76A7-7A786E7484D7} - (no file)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
O3 - Toolbar: (no name) - {45504E56-3634-006A-76A7-7A786E7484D7} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [ntouchPC] C:\Users\Owner\AppData\Local\Sorenson\ntouch PC\Application\ntouchPC.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Wondershare Helper Compact] "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EpsonCustomerParticipation - SEIKO EPSON CORPORATION - C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe (file missing)
O23 - Service: Microsoft Digital Experience Analytics Service (MDXAnalyticsService) - Unknown owner - C:\Program Files (x86)\Microsoft Digital Experience\Microsoft.MDX.AnalyticsService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Toshiba Laptop Checkup Application Launcher (Norton PC Checkup Application Launcher) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\SymcPCCULaunchSvc.exe
O23 - Service: Common Client Job Manager Service (PCCUJobMgr) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.3.198\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update service - Company - C:\Program Files (x86)\Popcorn Time\Updater.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 12080 bytes
