Solved dllhost.exe, powershell stopped working, COM Surrogate, slow operating system

Allison · Dec 5, 2014

The pop-ups from AVAST and Malwayre Bytes list searchnet.blinxccore.com, go.wyvdeo.com, and fff5ee.com as the three main websites trying to attack my computer.

When opening task manager, in addition to dllhost.exe, fixmapi.exe and dvplayer.exe are also causing problems.

Thank you for your help!

TwinHeadedEagle · Dec 6, 2014

Hello,

They call me TwinHeadedEagle around here, and I'll be working with you.

Before we start please read and note the following:

At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
Please attach all report using

button below. Doing this, you make it easier for me to analyze and fix your problem.
Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

Download

Malwarebytes Anti-Rootkit to your desktop.

Double-click the icon to start the tool.
It will ask you where to extract it, then it will start.
Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
Click in the introduction screen "next" to continue.
Click in the following screen "Update" to obtain the latest malware definitions.
Once the update is complete select "Next" and click "Scan".
When the scan is finished and no malware has been found select "Exit".
If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
Open the MBAR folder and paste the content of the following files in your next reply:
- "mbar-log-{date} (xx-xx-xx).txt"
- "system-log.txt"

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

Right-click on

icon and select

Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

Allison · Dec 6, 2014

Malwarebytes Anti-Rootkit BETA 1.08.2.1001
www.malwarebytes.org
Database version: v2014.12.06.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17420
owner :: OWNER-PC [administrator]
12/6/2014 6:57:48 AM
mbar-log-2014-12-06 (06-57-48).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 339653
Time elapsed: 38 minute(s), 20 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKU\S-1-5-21-51682695-2428261589-2065693235-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} (Trojan.Poweliks.B) -> Delete on reboot. [d1cc9ac5cdafb3838bdd34ceb947f709]
HKU\S-1-5-21-51682695-2428261589-2065693235-1000_Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\LOCALSERVER32\^ (Trojan.Poweliks) -> Delete on reboot. [7924392686f61125bcafc042df21f808]
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 246
C:\Windows\SysWOW64\00000143.tmp (Trojan.ClickBot) -> Delete on reboot. [f7a63a251369d660fda321d1ee138779]
C:\Windows\SysWOW64\00000228.tmp (Trojan.ClickBot) -> Delete on reboot. [bfde6cf324588caa336d7a7851b08b75]
C:\Windows\SysWOW64\00000720.tmp (Trojan.ClickBot) -> Delete on reboot. [1f7e7be403793df9148ca54dba47ae52]
C:\Windows\SysWOW64\00000783.tmp (Trojan.ClickBot) -> Delete on reboot. [86175e01f78569cd0f916d85eb16f10f]
C:\Windows\SysWOW64\00001088.tmp (Trojan.ClickBot) -> Delete on reboot. [afee243bb2cae74fbfe131c150b149b7]
C:\Windows\SysWOW64\00001090.tmp (Trojan.ClickBot) -> Delete on reboot. [821b86d9ed8f2c0a6f3102f003fe847c]
C:\Windows\SysWOW64\00001319.tmp (Trojan.ClickBot) -> Delete on reboot. [5d40f26d0379e3530799f20016ebe020]
C:\Windows\SysWOW64\00001494.tmp (Trojan.ClickBot) -> Delete on reboot. [514c530cbebe66d0128e629039c88c74]
C:\Windows\SysWOW64\00001594.tmp (Trojan.ClickBot) -> Delete on reboot. [55483926c3b9ea4c514f48aa0001df21]
C:\Windows\SysWOW64\00001869.tmp (Trojan.ClickBot) -> Delete on reboot. [673686d9bac2ff37138dd81a32cf936d]
C:\Windows\SysWOW64\00002036.tmp (Trojan.ClickBot) -> Delete on reboot. [524b5906552762d4c6da49a96b96d32d]
C:\Windows\SysWOW64\00002084.tmp (Trojan.ClickBot) -> Delete on reboot. [16878ad5e79565d1fea290628a77eb15]
C:\Windows\SysWOW64\00002255.tmp (Trojan.ClickBot) -> Delete on reboot. [a0fd58075923f73ff1af52a028d99967]
C:\Windows\SysWOW64\00002395.tmp (Trojan.ClickBot) -> Delete on reboot. [297485da1a6238fe5b45fef4d72a40c0]
C:\Windows\SysWOW64\00002490.tmp (Trojan.ClickBot) -> Delete on reboot. [cad3d38cbfbdf83e7a268f6305fc649c]
C:\Windows\SysWOW64\00002596.tmp (Trojan.ClickBot) -> Delete on reboot. [118c85da8bf18ea89b05b141d72a39c7]
C:\Windows\SysWOW64\00002651.tmp (Trojan.ClickBot) -> Delete on reboot. [1d80aeb15c202b0b356bc62c7d843fc1]
C:\Windows\SysWOW64\00002760.tmp (Trojan.ClickBot) -> Delete on reboot. [b5e86ff00676f0465c4408eacb364fb1]
C:\Windows\SysWOW64\00002768.tmp (Trojan.ClickBot) -> Delete on reboot. [afee88d7324a6dc9118f41b1827f4bb5]
C:\Windows\SysWOW64\00002782.tmp (Trojan.ClickBot) -> Delete on reboot. [e8b5451af785ef47069a4ba7f908c937]
C:\Windows\SysWOW64\00002995.tmp (Trojan.ClickBot) -> Delete on reboot. [920be9765725a690ebb50ee4a45d0df3]
C:\Windows\SysWOW64\00002999.tmp (Trojan.ClickBot) -> Delete on reboot. [a5f85609c7b57abcd7c9b63cee1315eb]
C:\Windows\SysWOW64\00003827.tmp (Trojan.ClickBot) -> Delete on reboot. [a5f872ed5923d165544c82704cb5bf41]
C:\Windows\SysWOW64\00003834.tmp (Trojan.ClickBot) -> Delete on reboot. [f8a5134c403cf343f2aed71b936e5fa1]
C:\Windows\SysWOW64\00003902.tmp (Trojan.ClickBot) -> Delete on reboot. [7a23134c661663d38a161ed413ee956b]
C:\Windows\SysWOW64\00007232.tmp (Trojan.ClickBot) -> Delete on reboot. [b2ebe778ea9270c69d03f2007091af51]
C:\Windows\SysWOW64\00009894.tmp (Trojan.ClickBot) -> Delete on reboot. [afee510ecab2191dd2cefbf7669b6d93]
C:\Windows\SysWOW64\00010618.tmp (Trojan.ClickBot) -> Delete on reboot. [eab3bba4126a82b4148c6c86936e9967]
C:\Windows\SysWOW64\00015141.tmp (Trojan.ClickBot) -> Delete on reboot. [d7c65d0248341224a7f97d75867b6898]
C:\Windows\SysWOW64\00017726.tmp (Trojan.ClickBot) -> Delete on reboot. [3667520dc5b772c4712fc62c966b44bc]
C:\Windows\SysWOW64\00020945.tmp (Trojan.ClickBot) -> Delete on reboot. [6e2f104fa4d81f171f81747ecb36f10f]
C:\Windows\SysWOW64\00024613.tmp (Trojan.ClickBot) -> Delete on reboot. [dac36ef1f18bb0862b756191ca3716ea]
C:\Windows\SysWOW64\00026299.tmp (Trojan.ClickBot) -> Delete on reboot. [6835b5aabdbf51e5574951a1956cec14]
C:\Windows\SysWOW64\00030333.tmp (Trojan.ClickBot) -> Delete on reboot. [8c11bea1ee8e4ee8b2ee5999b05122de]
C:\Windows\SysWOW64\00020973.tmp (Trojan.ClickBot) -> Delete on reboot. [4b5248175527191d049c02f0936e4fb1]
C:\Windows\SysWOW64\00021027.tmp (Trojan.ClickBot) -> Delete on reboot. [5845223d23597bbbcbd5b1417a87a55b]
C:\Windows\SysWOW64\00021173.tmp (Trojan.ClickBot) -> Delete on reboot. [b2eb6af5acd0f343c0e0f9f9c041bb45]
C:\Windows\SysWOW64\00021222.tmp (Trojan.ClickBot) -> Delete on reboot. [831a6df2720a3204e9b76290cb36d927]
C:\Windows\SysWOW64\00021263.tmp (Trojan.ClickBot) -> Delete on reboot. [4e4f3f208cf01422386825cd0bf61ee2]
C:\Windows\SysWOW64\00021424.tmp (Trojan.ClickBot) -> Delete on reboot. [d4c9b5aa57256bcb099725cdd22f9f61]
C:\Windows\SysWOW64\00021425.tmp (Trojan.ClickBot) -> Delete on reboot. [297470ef156747efecb4935fa45d02fe]
C:\Windows\SysWOW64\00021490.tmp (Trojan.ClickBot) -> Delete on reboot. [801d1d427c00d95dbde39d55649d29d7]
C:\Windows\SysWOW64\00021575.tmp (Trojan.ClickBot) -> Delete on reboot. [702d3a2557256acc386842b0e21f3fc1]
C:\Windows\SysWOW64\00021585.tmp (Trojan.ClickBot) -> Delete on reboot. [8c11afb0314b0b2b326ef5fde12008f8]
C:\Windows\SysWOW64\00021693.tmp (Trojan.ClickBot) -> Delete on reboot. [0d90550a64182214821ed919ba476c94]
C:\Windows\SysWOW64\00021726.tmp (Trojan.ClickBot) -> Delete on reboot. [f6a7520da9d343f3b4ec9f5306fb32ce]
C:\Windows\SysWOW64\00022684.tmp (Trojan.ClickBot) -> Delete on reboot. [2974540b3f3d75c1cad652a020e1f20e]
C:\Windows\SysWOW64\00022760.tmp (Trojan.ClickBot) -> Delete on reboot. [8a1362fd502ca096633df7fb4cb5c63a]
C:\Windows\SysWOW64\00022793.tmp (Trojan.ClickBot) -> Delete on reboot. [cdd0015ee79595a16f317d75d32e1ee2]
C:\Windows\SysWOW64\00022866.tmp (Trojan.ClickBot) -> Delete on reboot. [2e6fbea10874f3439e02c32f14ede51b]
C:\Windows\SysWOW64\00022983.tmp (Trojan.ClickBot) -> Delete on reboot. [34692f30bdbfa096346c6d85728f6b95]
C:\Windows\SysWOW64\00023076.tmp (Trojan.ClickBot) -> Delete on reboot. [0796ce91384494a2ebb58270827fca36]
C:\Windows\SysWOW64\00023148.tmp (Trojan.ClickBot) -> Delete on reboot. [ccd1114e225ada5c1d8303ef7f82be42]
C:\Windows\SysWOW64\00023515.tmp (Trojan.ClickBot) -> Delete on reboot. [7e1fe17eaad21026356bdf131ae79967]
C:\Windows\SysWOW64\00023711.tmp (Trojan.ClickBot) -> Delete on reboot. [75288cd36319092d0e9204ee4fb2847c]
C:\Windows\SysWOW64\00023811.tmp (Trojan.ClickBot) -> Delete on reboot. [8d10015eb2ca3afc7b25ba38d829f60a]
C:\Windows\SysWOW64\00023926.tmp (Trojan.ClickBot) -> Delete on reboot. [1687540bccb071c5712fd51d8180738d]
C:\Windows\SysWOW64\00023941.tmp (Trojan.ClickBot) -> Delete on reboot. [2479233cff7dd363930da15120e160a0]
C:\Windows\SysWOW64\00024154.tmp (Trojan.ClickBot) -> Delete on reboot. [3b62c49b2a52e353a9f79d5503fe6997]
C:\Windows\SysWOW64\00024399.tmp (Trojan.ClickBot) -> Delete on reboot. [376681dec3b9d4622779f4fe23de649c]
C:\Windows\SysWOW64\00010984.tmp (Trojan.ClickBot) -> Delete on reboot. [306d59066b11a096851ba44e976a6d93]
C:\Windows\SysWOW64\00011213.tmp (Trojan.ClickBot) -> Delete on reboot. [6d305f00720a1224198735bddf22a55b]
C:\Windows\SysWOW64\00011236.tmp (Trojan.ClickBot) -> Delete on reboot. [b8e5154adf9d81b50e92d919b05154ac]
C:\Windows\SysWOW64\00011434.tmp (Trojan.ClickBot) -> Delete on reboot. [3b62ff6098e489ad217f589a26db4db3]
C:\Windows\SysWOW64\00011538.tmp (Trojan.ClickBot) -> Delete on reboot. [1c81451a3e3e2b0b9f016a88c23f59a7]
C:\Windows\SysWOW64\00011563.tmp (Trojan.ClickBot) -> Delete on reboot. [3964a7b8cdaf1b1bcbd59b5719e803fd]
C:\Windows\SysWOW64\00011648.tmp (Trojan.ClickBot) -> Delete on reboot. [9607d887e993d75f9e02757d738ec040]
C:\Windows\SysWOW64\00011680.tmp (Trojan.ClickBot) -> Delete on reboot. [2c71f669c6b6e452aef2c230fd04c937]
C:\Windows\SysWOW64\00011859.tmp (Trojan.ClickBot) -> Delete on reboot. [e2bbafb0ef8df93d930d33bffd04fb05]
C:\Windows\SysWOW64\00011942.tmp (Trojan.ClickBot) -> Delete on reboot. [950867f85e1ec76fb2eec9295ba6bf41]
C:\Windows\SysWOW64\00012044.tmp (Trojan.ClickBot) -> Delete on reboot. [acf1e47bd5a776c0d8c8c62c60a1639d]
C:\Windows\SysWOW64\00012070.tmp (Trojan.ClickBot) -> Delete on reboot. [9b02d38c611b8fa7920e01f119e847b9]
C:\Windows\SysWOW64\00012134.tmp (Trojan.ClickBot) -> Delete on reboot. [762757086517fd39653bba38778a7f81]
C:\Windows\SysWOW64\00012382.tmp (Trojan.ClickBot) -> Delete on reboot. [8419f669c6b63cfa19875f93e21f13ed]
C:\Windows\SysWOW64\00012459.tmp (Trojan.ClickBot) -> Delete on reboot. [5b428dd295e754e29e0222d054ad6c94]
C:\Windows\SysWOW64\00012487.tmp (Trojan.ClickBot) -> Delete on reboot. [5c4169f60676a59157492dc57988649c]
C:\Windows\SysWOW64\00012501.tmp (Trojan.ClickBot) -> Delete on reboot. [67361c43bbc194a2920ef101b44d2fd1]
C:\Windows\SysWOW64\00012624.tmp (Trojan.ClickBot) -> Delete on reboot. [8e0fee71e99375c1dbc5bc364eb321df]
C:\Windows\SysWOW64\00030335.tmp (Trojan.ClickBot) -> Delete on reboot. [f1acda85f28a7bbb762acc2634cd6a96]
C:\Windows\SysWOW64\00030365.tmp (Trojan.ClickBot) -> Delete on reboot. [98051d42a6d68da9c3dd7b777b867888]
C:\Windows\SysWOW64\00030791.tmp (Trojan.ClickBot) -> Delete on reboot. [dac392cd8feda98dffa1965cad546898]
C:\Windows\SysWOW64\00030795.tmp (Trojan.ClickBot) -> Delete on reboot. [dbc22d322854fd39b9e7eb074cb544bc]
C:\Windows\SysWOW64\00031272.tmp (Trojan.ClickBot) -> Delete on reboot. [326bff608eee9b9b514f26cc21e0f10f]
C:\Windows\SysWOW64\00031322.tmp (Trojan.ClickBot) -> Delete on reboot. [08954817c0bce353c5dbc13152afa060]
C:\Windows\SysWOW64\00031418.tmp (Trojan.ClickBot) -> Delete on reboot. [3a63bfa02e4ebd79a3fd36bc7d8436ca]
C:\Windows\SysWOW64\00031460.tmp (Trojan.ClickBot) -> Delete on reboot. [732ab5aad9a3a88e920efcf6b34e669a]
C:\Windows\SysWOW64\00031503.tmp (Trojan.ClickBot) -> Delete on reboot. [a9f495ca94e878be019f648e0df426da]
C:\Windows\SysWOW64\00031505.tmp (Trojan.ClickBot) -> Delete on reboot. [a0fd025d384461d5bee225cd926f42be]
C:\Windows\SysWOW64\00031582.tmp (Trojan.ClickBot) -> Delete on reboot. [e9b4adb26d0f5ed8851b8f63e71ad12f]
C:\Windows\SysWOW64\00032082.tmp (Trojan.ClickBot) -> Delete on reboot. [c2db64fb6a125ed82a76e50d68996898]
C:\Windows\SysWOW64\00032173.tmp (Trojan.ClickBot) -> Delete on reboot. [3568352afc8090a62977d31fdb26c838]
C:\Windows\SysWOW64\00032391.tmp (Trojan.ClickBot) -> Delete on reboot. [039a2e319ae2eb4bebb55c96f70adb25]
C:\Windows\SysWOW64\00032494.tmp (Trojan.ClickBot) -> Delete on reboot. [bedf0758720aba7c3e6215ddab567987]
C:\Windows\SysWOW64\00015310.tmp (Trojan.ClickBot) -> Delete on reboot. [4b52df801a62181e138d9a589b66fd03]
C:\Windows\SysWOW64\00015492.tmp (Trojan.ClickBot) -> Delete on reboot. [623b62fd9fdd63d35947579b5ea3b749]
C:\Windows\SysWOW64\00015653.tmp (Trojan.ClickBot) -> Delete on reboot. [a1fc312eafcdfe385947d220639e8d73]
C:\Windows\SysWOW64\00015826.tmp (Trojan.ClickBot) -> Delete on reboot. [0f8e1d427dff24126739c032946d14ec]
C:\Windows\SysWOW64\00015920.tmp (Trojan.ClickBot) -> Delete on reboot. [2776f06fe09c3ef878280ce6748dd12f]
C:\Windows\SysWOW64\00016099.tmp (Trojan.ClickBot) -> Delete on reboot. [6e2f510e9ddfd066c7d91cd64db401ff]
C:\Windows\SysWOW64\00016173.tmp (Trojan.ClickBot) -> Delete on reboot. [7a2388d71c60989e7e2207eb8180c937]
C:\Windows\SysWOW64\00016288.tmp (Trojan.ClickBot) -> Delete on reboot. [debf4e113c40ed49c3ddd919da279868]
C:\Windows\SysWOW64\00016350.tmp (Trojan.ClickBot) -> Delete on reboot. [178675eaa1db77bfb7e9fcf6c23f02fe]
C:\Windows\SysWOW64\00016471.tmp (Trojan.ClickBot) -> Delete on reboot. [1984d58a4a3280b6cbd5d31fab5625db]
C:\Windows\SysWOW64\00016485.tmp (Trojan.ClickBot) -> Delete on reboot. [abf2f768fe7e2214d1cf5999649d9f61]
C:\Windows\SysWOW64\00016526.tmp (Trojan.ClickBot) -> Delete on reboot. [6835243b8af20432bde3846ed03122de]
C:\Windows\SysWOW64\00016738.tmp (Trojan.ClickBot) -> Delete on reboot. [47566cf32b5190a67b2511e1f11012ee]
C:\Windows\SysWOW64\00016823.tmp (Trojan.ClickBot) -> Delete on reboot. [900d9fc0b4c81125d7c9be34936edd23]
C:\Windows\SysWOW64\00016939.tmp (Trojan.ClickBot) -> Delete on reboot. [7e1fea75027ad066cdd346acab56758b]
C:\Windows\SysWOW64\00017022.tmp (Trojan.ClickBot) -> Delete on reboot. [a2fb8ed10874c373b9e744ae8b76b54b]
C:\Windows\SysWOW64\00017035.tmp (Trojan.ClickBot) -> Delete on reboot. [44592738a7d5db5bf0b0fbf730d15ca4]
C:\Windows\SysWOW64\00017115.tmp (Trojan.ClickBot) -> Delete on reboot. [6e2fe778ef8dd066683816dc2dd40af6]
C:\Windows\SysWOW64\00017173.tmp (Trojan.ClickBot) -> Delete on reboot. [3469411ea8d40a2cdac64fa324dd8878]
C:\Windows\SysWOW64\00017421.tmp (Trojan.ClickBot) -> Delete on reboot. [128b90cfd0acb581e8b8faf84eb3718f]
C:\Windows\SysWOW64\00017500.tmp (Trojan.ClickBot) -> Delete on reboot. [2974055abfbd49eda9f7678b5fa2dd23]
C:\Windows\SysWOW64\00017673.tmp (Trojan.ClickBot) -> Delete on reboot. [5e3f76e9abd14aec059b9161aa5750b0]
C:\Windows\SysWOW64\00004018.tmp (Trojan.ClickBot) -> Delete on reboot. [abf25a05522a5adc0f9105ed1ae7de22]
C:\Windows\SysWOW64\00004371.tmp (Trojan.ClickBot) -> Delete on reboot. [5548f669b8c4d85eeab6ba38bf4259a7]
C:\Windows\SysWOW64\00004529.tmp (Trojan.ClickBot) -> Delete on reboot. [fda03728d1abd85ea3fde50df50c867a]
C:\Windows\SysWOW64\00004645.tmp (Trojan.ClickBot) -> Delete on reboot. [633a322da1db9b9b5f41c72b5da4b749]
C:\Windows\SysWOW64\00004664.tmp (Trojan.ClickBot) -> Delete on reboot. [d9c497c8ccb08bab9a0648aaaa57a957]
C:\Windows\SysWOW64\00004810.tmp (Trojan.ClickBot) -> Delete on reboot. [e8b5203f720a2610c1dfb53dbb46649c]
C:\Windows\SysWOW64\00004827.tmp (Trojan.ClickBot) -> Delete on reboot. [108d9bc4f587fe38564af7fba35ee51b]
C:\Windows\SysWOW64\00005192.tmp (Trojan.ClickBot) -> Delete on reboot. [a5f8c09fb4c87bbbadf326cc31d06799]
C:\Windows\SysWOW64\00005436.tmp (Trojan.ClickBot) -> Delete on reboot. [fca14b14c3b97eb8663a1fd38b766f91]
C:\Windows\SysWOW64\00005447.tmp (Trojan.ClickBot) -> Delete on reboot. [f0ad005f90ec73c3e5bb777b867bdb25]
C:\Windows\SysWOW64\00005679.tmp (Trojan.ClickBot) -> Delete on reboot. [425b5e017dff63d3445cc032e61b58a8]
C:\Windows\SysWOW64\00005807.tmp (Trojan.ClickBot) -> Delete on reboot. [e2bb243bc5b74de96937708288795ca4]
C:\Windows\SysWOW64\00005848.tmp (Trojan.ClickBot) -> Delete on reboot. [702d6ff00478b77fced29b5733ce0bf5]
C:\Windows\SysWOW64\00005977.tmp (Trojan.ClickBot) -> Delete on reboot. [4a53f16e700ca690dfc1985a3ac7a957]
C:\Windows\SysWOW64\00006005.tmp (Trojan.ClickBot) -> Delete on reboot. [d1cc58070b711323d0d06f834eb348b8]
C:\Windows\SysWOW64\00006039.tmp (Trojan.ClickBot) -> Delete on reboot. [1b82302f29535dd9920e4ea45aa7cb35]
C:\Windows\SysWOW64\00006059.tmp (Trojan.ClickBot) -> Delete on reboot. [8716f669fa82cf67d6cae70b699852ae]
C:\Windows\SysWOW64\00006296.tmp (Trojan.ClickBot) -> Delete on reboot. [2a73f46b710b1d19831d9d5524dd9967]
C:\Windows\SysWOW64\00006517.tmp (Trojan.ClickBot) -> Delete on reboot. [069786d99ce0db5b940c7b7708f9926e]
C:\Windows\SysWOW64\00006724.tmp (Trojan.ClickBot) -> Delete on reboot. [2a73f46b84f854e2e7b9b33fe41d669a]
C:\Windows\SysWOW64\00006777.tmp (Trojan.ClickBot) -> Delete on reboot. [8e0f6df21765cf671987c32f679a748c]
C:\Windows\SysWOW64\00006868.tmp (Trojan.ClickBot) -> Delete on reboot. [e8b5b4ab4735bf77e9b7f101c23f32ce]
C:\Windows\SysWOW64\00006985.tmp (Trojan.ClickBot) -> Delete on reboot. [c4d95e011f5d16202d7303ef68994bb5]
C:\Windows\SysWOW64\00006991.tmp (Trojan.ClickBot) -> Delete on reboot. [7924afb0235974c2f6aa9062758c15eb]
C:\Windows\SysWOW64\00007031.tmp (Trojan.ClickBot) -> Delete on reboot. [d7c6550a9ce0e1550a96da18d22f3cc4]
C:\Windows\SysWOW64\00007065.tmp (Trojan.ClickBot) -> Delete on reboot. [a5f80e51f3899c9a445cc82a24dd34cc]
C:\Windows\SysWOW64\00007074.tmp (Trojan.ClickBot) -> Delete on reboot. [831adf80c5b72b0babf526ccbe4327d9]
C:\Windows\SysWOW64\00024750.tmp (Trojan.ClickBot) -> Delete on reboot. [633a4718a9d372c49a069c565da4e917]
C:\Windows\SysWOW64\00024797.tmp (Trojan.ClickBot) -> Delete on reboot. [e9b4302fa4d8d6607e225a98b24f01ff]
C:\Windows\SysWOW64\00024834.tmp (Trojan.ClickBot) -> Delete on reboot. [9c01c8970c70c76f4f5113df2ed3f40c]
C:\Windows\SysWOW64\00024875.tmp (Trojan.ClickBot) -> Delete on reboot. [c6d765fa76069e98069a7d7517eaeb15]
C:\Windows\SysWOW64\00024897.tmp (Trojan.ClickBot) -> Delete on reboot. [8e0fb3ac17650234ebb5b33fcd34d62a]
C:\Windows\SysWOW64\00025018.tmp (Trojan.ClickBot) -> Delete on reboot. [4756e37cb0cc280e831deb077b86a15f]
C:\Windows\SysWOW64\00025547.tmp (Trojan.ClickBot) -> Delete on reboot. [15885d02df9dee4837694ea441c0f907]
C:\Windows\SysWOW64\00025578.tmp (Trojan.ClickBot) -> Delete on reboot. [a1fc213ee894f6401a8640b2a25fca36]
C:\Windows\SysWOW64\00025582.tmp (Trojan.ClickBot) -> Delete on reboot. [722b85da1a6233036b3525cd32cf867a]
C:\Windows\SysWOW64\00025597.tmp (Trojan.ClickBot) -> Delete on reboot. [6f2ebaa5b6c680b6dcc48270c33e03fd]
C:\Windows\SysWOW64\00025661.tmp (Trojan.ClickBot) -> Delete on reboot. [7d20fe61b1cb2d09e7b97f73956c56aa]
C:\Windows\SysWOW64\00025667.tmp (Trojan.ClickBot) -> Delete on reboot. [118c7ee1f488c6703769688af40d6a96]
C:\Windows\SysWOW64\00025675.tmp (Trojan.ClickBot) -> Delete on reboot. [3667ed7238449d99960a7979748d7888]
C:\Windows\SysWOW64\00025761.tmp (Trojan.ClickBot) -> Delete on reboot. [aeef1d425d1ff73f5947cb27f1102bd5]
C:\Windows\SysWOW64\00025789.tmp (Trojan.ClickBot) -> Delete on reboot. [e9b4c798b7c535018a1634be0af7dd23]
C:\Windows\SysWOW64\00025810.tmp (Trojan.ClickBot) -> Delete on reboot. [8716b7a8e795da5c5a460ce6936eaf51]
C:\Windows\SysWOW64\00026112.tmp (Trojan.ClickBot) -> Delete on reboot. [4c51b7a83d3f4beb267a50a24cb556aa]
C:\Windows\SysWOW64\00026136.tmp (Trojan.ClickBot) -> Delete on reboot. [4d501d42e29acd69742caa487c8530d0]
C:\Windows\SysWOW64\00026150.tmp (Trojan.ClickBot) -> Delete on reboot. [8d106df27b0180b6f4aceb0771907789]
C:\Windows\SysWOW64\00007476.tmp (Trojan.ClickBot) -> Delete on reboot. [504d2e31e4989f978e128171f20fb050]
C:\Windows\SysWOW64\00007711.tmp (Trojan.ClickBot) -> Delete on reboot. [b9e4332cceaeef470c94678be0211be5]
C:\Windows\SysWOW64\00008050.tmp (Trojan.ClickBot) -> Delete on reboot. [6a33a3bc4339f541524e2ac8b84956aa]
C:\Windows\SysWOW64\00008428.tmp (Trojan.ClickBot) -> Delete on reboot. [346969f66c1082b45f41f0024cb53cc4]
C:\Windows\SysWOW64\00008471.tmp (Trojan.ClickBot) -> Delete on reboot. [fba21d42b3c96bcba7f98969cb36fc04]
C:\Windows\SysWOW64\00008475.tmp (Trojan.ClickBot) -> Delete on reboot. [7f1ee976ceae6bcbf5ab5d954db4e21e]
C:\Windows\SysWOW64\00008728.tmp (Trojan.ClickBot) -> Delete on reboot. [0e8f72ed9ce055e1f2aeb73b738e9e62]
C:\Windows\SysWOW64\00008746.tmp (Trojan.ClickBot) -> Delete on reboot. [77266af503791a1cb7e93fb308f95da3]
C:\Windows\SysWOW64\00008930.tmp (Trojan.ClickBot) -> Delete on reboot. [7726f06f15677cba2d7319d97e839e62]
C:\Windows\SysWOW64\00009253.tmp (Trojan.ClickBot) -> Delete on reboot. [67360b54502c4de96a36985a1ee3718f]
C:\Windows\SysWOW64\00009308.tmp (Trojan.ClickBot) -> Delete on reboot. [3e5fc8979ce03303712f549eab5612ee]
C:\Windows\SysWOW64\00009377.tmp (Trojan.ClickBot) -> Delete on reboot. [514c63fcd6a6a096dfc1d022c43d7c84]
C:\Windows\SysWOW64\00009410.tmp (Trojan.ClickBot) -> Delete on reboot. [9d00c59a85f7de58b5ebaf4320e101ff]
C:\Windows\SysWOW64\00009441.tmp (Trojan.ClickBot) -> Delete on reboot. [6f2e243b0a72ab8b7f21e0123cc5cf31]
C:\Windows\SysWOW64\00009498.tmp (Trojan.ClickBot) -> Delete on reboot. [425b9bc4a0dcf4421a8627cb0af7a35d]
C:\Windows\SysWOW64\00009525.tmp (Trojan.ClickBot) -> Delete on reboot. [3c61e17ed7a5bb7be0c043af709128d8]
C:\Windows\SysWOW64\00009876.tmp (Trojan.ClickBot) -> Delete on reboot. [faa3e9768bf1c175e1bfb83aa9585aa6]
C:\Windows\SysWOW64\00018022.tmp (Trojan.ClickBot) -> Delete on reboot. [613c63fc9ce01b1b881837bbea176997]
C:\Windows\SysWOW64\00018343.tmp (Trojan.ClickBot) -> Delete on reboot. [d2cbc798d7a5c274326eaa48827f04fc]
C:\Windows\SysWOW64\00018439.tmp (Trojan.ClickBot) -> Delete on reboot. [a4f9c49b6e0e211500a0dd15a45d4cb4]
C:\Windows\SysWOW64\00018440.tmp (Trojan.ClickBot) -> Delete on reboot. [a6f7dd827903da5c8d13b1419f6215eb]
C:\Windows\SysWOW64\00018441.tmp (Trojan.ClickBot) -> Delete on reboot. [8f0e015efd7f9a9c4f51ca285ba625db]
C:\Windows\SysWOW64\00018633.tmp (Trojan.ClickBot) -> Delete on reboot. [821b5b042755a195bee2bd352ad7ff01]
C:\Windows\SysWOW64\00018716.tmp (Trojan.ClickBot) -> Delete on reboot. [fda019463f3dab8b247c589af908936d]
C:\Windows\SysWOW64\00018753.tmp (Trojan.ClickBot) -> Delete on reboot. [05980d5297e56ec8aaf68d656998e41c]
C:\Windows\SysWOW64\00018802.tmp (Trojan.ClickBot) -> Delete on reboot. [7d20e47b3c4065d1742c708244bd7c84]
C:\Windows\SysWOW64\00018973.tmp (Trojan.ClickBot) -> Delete on reboot. [376685dac1bbb680d0d021d144bddc24]
C:\Windows\SysWOW64\00019030.tmp (Trojan.ClickBot) -> Delete on reboot. [3667bca3a5d7b77f237d99599071c937]
C:\Windows\SysWOW64\00019049.tmp (Trojan.ClickBot) -> Delete on reboot. [712c19465725e5513769955d17ea3cc4]
C:\Windows\SysWOW64\00019121.tmp (Trojan.ClickBot) -> Delete on reboot. [f9a4bea1413b8fa7a9f726cce71a956b]
C:\Windows\SysWOW64\00019718.tmp (Trojan.ClickBot) -> Delete on reboot. [821bb7a8aecea78f3868c52d02ffee12]
C:\Windows\SysWOW64\00019809.tmp (Trojan.ClickBot) -> Delete on reboot. [e2bbd18e2557ff37217f5c96c73a8f71]
C:\Windows\SysWOW64\00019895.tmp (Trojan.ClickBot) -> Delete on reboot. [2e6f401fa2da2412633d886a23de7a86]
C:\Windows\SysWOW64\00019912.tmp (Trojan.ClickBot) -> Delete on reboot. [1f7ec29da4d83402f1af36bc4ab725db]
C:\Windows\SysWOW64\00020073.tmp (Trojan.ClickBot) -> Delete on reboot. [b1ec8fd089f3191d643cc929946d37c9]
C:\Windows\SysWOW64\00020338.tmp (Trojan.ClickBot) -> Delete on reboot. [9eff510e3349e650b2eef6fc31d07888]
C:\Windows\SysWOW64\00020506.tmp (Trojan.ClickBot) -> Delete on reboot. [d2cbafb0eb918bab712f08ea13ee2dd3]
C:\Windows\SysWOW64\00020607.tmp (Trojan.ClickBot) -> Delete on reboot. [9d002f30b7c5f93dd6cae21012effe02]
C:\Windows\SysWOW64\00020753.tmp (Trojan.ClickBot) -> Delete on reboot. [ccd173ec9ddf162067393ab8de23cb35]
C:\Windows\SysWOW64\00020853.tmp (Trojan.ClickBot) -> Delete on reboot. [08959dc299e371c549577d758c7515eb]
C:\Windows\SysWOW64\00026305.tmp (Trojan.ClickBot) -> Delete on reboot. [4558411e0379c076d6cacc26d52c7987]
C:\Windows\SysWOW64\00026350.tmp (Trojan.ClickBot) -> Delete on reboot. [9d002837bebe22146a36b83a976afb05]
C:\Windows\SysWOW64\00026544.tmp (Trojan.ClickBot) -> Delete on reboot. [8c1161fe99e367cf148cc52dbe433ac6]
C:\Windows\SysWOW64\00027262.tmp (Trojan.ClickBot) -> Delete on reboot. [debf3b24fc80bb7bf5abe80a46bb7d83]
C:\Windows\SysWOW64\00028253.tmp (Trojan.ClickBot) -> Delete on reboot. [6c3163fc5626ea4c217fe80a0ef3c23e]
C:\Windows\SysWOW64\00028497.tmp (Trojan.ClickBot) -> Delete on reboot. [b1ecbda24a324fe7554bc72bbe43639d]
C:\Windows\SysWOW64\00028703.tmp (Trojan.ClickBot) -> Delete on reboot. [7c21ef70235960d6524e1cd65ca517e9]
C:\Windows\SysWOW64\00028877.tmp (Trojan.ClickBot) -> Delete on reboot. [fe9f342b0c70ac8a6d33876b10f1cd33]
C:\Windows\SysWOW64\00029060.tmp (Trojan.ClickBot) -> Delete on reboot. [5b4276e95e1edd597f2103ef728f619f]
C:\Windows\SysWOW64\00029230.tmp (Trojan.ClickBot) -> Delete on reboot. [a7f6e57a3e3e5bdb3769b53d11f0db25]
C:\Windows\SysWOW64\00029287.tmp (Trojan.ClickBot) -> Delete on reboot. [d7c6b3ac027aae88f2aedf13ca378e72]
C:\Windows\SysWOW64\00029398.tmp (Trojan.ClickBot) -> Delete on reboot. [920b352a86f630069a06975baa57c33d]
C:\Windows\SysWOW64\00029457.tmp (Trojan.ClickBot) -> Delete on reboot. [5c41213e43393ef847598c66f9087e82]
C:\Windows\SysWOW64\00030156.tmp (Trojan.ClickBot) -> Delete on reboot. [ecb17ce335472511cbd57f7320e15fa1]
C:\Windows\SysWOW64\00012799.tmp (Trojan.ClickBot) -> Delete on reboot. [405d84db720ac472029ead45b54c40c0]
C:\Windows\SysWOW64\00012879.tmp (Trojan.ClickBot) -> Delete on reboot. [1e7f2c3396e61b1bc9d7747e897843bd]
C:\Windows\SysWOW64\00013155.tmp (Trojan.ClickBot) -> Delete on reboot. [9b02104f5d1fb97d5a46579b659cb44c]
C:\Windows\SysWOW64\00013282.tmp (Trojan.ClickBot) -> Delete on reboot. [dcc16cf388f40135ecb4c72bbd447c84]
C:\Windows\SysWOW64\00013792.tmp (Trojan.ClickBot) -> Delete on reboot. [a7f6421d522aa492f0b049a9629fb050]
C:\Windows\SysWOW64\00014058.tmp (Trojan.ClickBot) -> Delete on reboot. [b2ebc59aed8f1422bfe18b6705fc43bd]
C:\Windows\SysWOW64\00014072.tmp (Trojan.ClickBot) -> Delete on reboot. [3964540b9ae2ee48366abf331de435cb]
C:\Windows\SysWOW64\00014455.tmp (Trojan.ClickBot) -> Delete on reboot. [f3aa3d22bbc10135ffa115ddd8294bb5]
C:\Windows\SysWOW64\00014604.tmp (Trojan.ClickBot) -> Delete on reboot. [38657fe00775fd39bbe56d8524dd1ce4]
C:\Windows\SysWOW64\00014771.tmp (Trojan.ClickBot) -> Delete on reboot. [c7d62f30e7951a1c346c0be71ee3fe02]
C:\Windows\SysWOW64\00014846.tmp (Trojan.ClickBot) -> Delete on reboot. [efaeee710d6f67cfdbc5935f847dec14]
C:\Windows\SysWOW64\00014871.tmp (Trojan.ClickBot) -> Delete on reboot. [b4e9cc937309b383653bec06ec1536ca]
C:\Windows\SysWOW64\00015007.tmp (Trojan.ClickBot) -> Delete on reboot. [1d80a1bef9831620f1afd919966b09f7]
C:\Windows\SysWOW64\00015025.tmp (Trojan.ClickBot) -> Delete on reboot. [d4c9104f80fca98d0d93549e0ef35fa1]
C:\Windows\SysWOW64\00015042.tmp (Trojan.ClickBot) -> Delete on reboot. [0796253af785f442aff16c861be63cc4]
C:\Windows\SysWOW64\00015084.tmp (Trojan.ClickBot) -> Delete on reboot. [b3ea3d22f983c0763e6229c95ba607f9]
C:\Windows\SysWOW64\00009962.tmp (Trojan.ClickBot) -> Delete on reboot. [5e3f58077a02cd69b9e7658d5ea312ee]
C:\Windows\SysWOW64\00010026.tmp (Trojan.ClickBot) -> Delete on reboot. [1b8276e99ce037ff168a747e2bd619e7]
C:\Windows\SysWOW64\00010098.tmp (Trojan.ClickBot) -> Delete on reboot. [415ce57afb819b9b5050678b8180f709]
C:\Windows\SysWOW64\00010106.tmp (Trojan.ClickBot) -> Delete on reboot. [3e5f79e6106c75c1a2fe1ed46a97ae52]
C:\Windows\SysWOW64\00010107.tmp (Trojan.ClickBot) -> Delete on reboot. [9d00ca95314b81b5b1ef09e912effe02]
C:\Windows\SysWOW64\00010147.tmp (Trojan.ClickBot) -> Delete on reboot. [2f6ec39cbfbd5dd9bbe523cf629f0ff1]
C:\Windows\SysWOW64\00010190.tmp (Trojan.ClickBot) -> Delete on reboot. [405dc6998cf0c4729c04886a60a1926e]
C:\Windows\SysWOW64\00010211.tmp (Trojan.ClickBot) -> Delete on reboot. [732abca3215b57df752bca2850b17987]
C:\Windows\SysWOW64\00010220.tmp (Trojan.ClickBot) -> Delete on reboot. [d7c6e47b85f75adcdac67f73a35e7c84]
C:\Windows\SysWOW64\00010263.tmp (Trojan.ClickBot) -> Delete on reboot. [2e6f3c23cab285b1217f10e2b051ab55]
C:\Windows\SysWOW64\00010414.tmp (Trojan.ClickBot) -> Delete on reboot. [a9f4c897a9d3d462950b47ab10f1bd43]
C:\Windows\SysWOW64\00010446.tmp (Trojan.ClickBot) -> Delete on reboot. [e6b7adb23b4168ce168a32c005fca55b]
C:\Windows\SysWOW64\00010479.tmp (Trojan.ClickBot) -> Delete on reboot. [128b65fa3f3d6fc7c8d89a584bb68e72]
C:\Windows\SysWOW64\00010494.tmp (Trojan.ClickBot) -> Delete on reboot. [3d60d9864c300e2828785a988e730df3]
C:\Windows\SysWOW64\00010588.tmp (Trojan.ClickBot) -> Delete on reboot. [e6b79fc0df9de94d1b852bc7a45d9f61]
Physical Sectors Detected: 0
(No malicious items detected)
(end)

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.08.2.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.17420
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.261000 GHz
Memory total: 4081623040, free: 973701120
Downloaded database version: v2014.12.06.05
Downloaded database version: v2014.12.03.01
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
Initializing...
=======================================
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
Initializing...
------------ Kernel report ------------
12/06/2014 06:57:34
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHlpa64.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\aswNdisFlt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\drivers\aswKbd.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\bcmwl664.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\Apfiltr.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\Impcd.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\aswStm.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\TurboB.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\aswHwid.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\drivers\BCM42RLY.sys
\SystemRoot\system32\drivers\hidusb.sys
\SystemRoot\system32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\wininet.dll
\Windows\System32\advapi32.dll
\Windows\System32\shell32.dll
\Windows\System32\lpk.dll
\Windows\System32\normaliz.dll
\Windows\System32\setupapi.dll
\Windows\System32\sechost.dll
\Windows\System32\user32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\msctf.dll
\Windows\System32\usp10.dll
\Windows\System32\imagehlp.dll
\Windows\System32\urlmon.dll
\Windows\System32\msvcrt.dll
\Windows\System32\nsi.dll
\Windows\System32\gdi32.dll
\Windows\System32\iertutil.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\difxapi.dll
\Windows\System32\clbcatq.dll
\Windows\System32\ws2_32.dll
\Windows\System32\imm32.dll
\Windows\System32\psapi.dll
\Windows\System32\shlwapi.dll
\Windows\System32\kernel32.dll
\Windows\System32\ole32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\wintrust.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\devobj.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\crypt32.dll
\Windows\System32\userenv.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\comctl32.dll
\Windows\System32\msasn1.dll
\Windows\System32\profapi.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004bc2060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa80048fc680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004bc2060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004a6e950, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004bc2060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80048fc680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: EA1BE7A4
Partition information:
Partition 0 type is Other (0xde)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 206848 Numsec = 20480000
Partition file system is NTFS
Partition is bootable
Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 20686848 Numsec = 367693824
Partition 3 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 449241025 Numsec = 527530047
Disk Size: 500107862016 bytes
Sector size: 512 bytes
Done!
Infected: C:\Windows\SysWOW64\00000143.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00000228.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00000720.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00000783.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001088.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001090.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001319.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001494.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001594.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00001869.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002036.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002084.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002255.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002395.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002490.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002596.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002651.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002760.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002768.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002782.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002995.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00002999.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00003827.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00003834.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00003902.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007232.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009894.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010618.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015141.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017726.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020945.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024613.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026299.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030333.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020973.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021027.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021173.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021222.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021263.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021424.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021425.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021490.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021575.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021585.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021693.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00021726.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00022684.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00022760.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00022793.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00022866.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00022983.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023076.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023148.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023515.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023711.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023811.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023926.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00023941.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024154.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024399.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010984.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011213.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011236.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011434.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011538.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011563.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011648.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011680.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011859.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00011942.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012044.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012070.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012134.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012382.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012459.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012487.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012501.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012624.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030335.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030365.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030791.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030795.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031272.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031322.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031418.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031460.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031503.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031505.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00031582.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00032082.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00032173.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00032391.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00032494.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015310.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015492.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015653.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015826.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015920.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016099.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016173.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016288.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016350.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016471.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016485.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016526.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016738.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016823.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00016939.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017022.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017035.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017115.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017173.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017421.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017500.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00017673.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004018.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004371.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004529.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004645.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004664.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004810.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00004827.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005192.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005436.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005447.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005679.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005807.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005848.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00005977.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006005.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006039.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006059.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006296.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006517.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006724.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006777.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006868.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006985.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00006991.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007031.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007065.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007074.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024750.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024797.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024834.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024875.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00024897.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025018.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025547.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025578.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025582.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025597.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025661.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025667.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025675.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025761.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025789.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00025810.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026112.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026136.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026150.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007476.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00007711.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008050.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008428.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008471.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008475.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008728.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008746.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00008930.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009253.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009308.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009377.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009410.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009441.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009498.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009525.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009876.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018022.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018343.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018439.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018440.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018441.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018633.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018716.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018753.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018802.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00018973.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019030.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019049.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019121.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019718.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019809.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019895.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00019912.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020073.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020338.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020506.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020607.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020753.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00020853.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026305.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026350.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00026544.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00027262.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00028253.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00028497.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00028703.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00028877.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00029060.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00029230.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00029287.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00029398.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00029457.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00030156.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012799.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00012879.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00013155.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00013282.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00013792.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014058.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014072.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014455.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014604.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014771.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014846.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00014871.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015007.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015025.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015042.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00015084.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00009962.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010026.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010098.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010106.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010107.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010147.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010190.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010211.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010220.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010263.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010414.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010446.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010479.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010494.tmp --> [Trojan.ClickBot]
Infected: C:\Windows\SysWOW64\00010588.tmp --> [Trojan.ClickBot]
Infected: HKU\S-1-5-21-51682695-2428261589-2065693235-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} --> [Trojan.Poweliks.B]
Infected: HKU\S-1-5-21-51682695-2428261589-2065693235-1000_Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\LOCALSERVER32\^ --> [Trojan.Poweliks]
Scan finished
Creating System Restore point...
Cleaning up...
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================

TwinHeadedEagle · Dec 6, 2014

Very good. Any progress? Let's run one more tool:

Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on

icon and select

Run as Administrator to start the tool.
Accept the disclaimer and agree if prompted to install Recovery Console.
Do not take any actions while ComboFix goes through your System - it may cause it to stall!
This scan may take some time!
When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.

If you'll encounter any issues with internet connection after running ComboFix, please visit this link.

If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

Allison · Dec 6, 2014

It's running so much better-- thank you!!!!!

Here is the ComboFix log:

ComboFix 14-12-04.01 - owner 12/06/2014 12:40:00.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3893.1935 [GMT -8:00]
Running from: c:\users\owner\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\00000793.tmp
c:\windows\SysWow64\00001716.tmp
c:\windows\SysWow64\00002063.tmp
c:\windows\SysWow64\00002159.tmp
c:\windows\SysWow64\00002307.tmp
c:\windows\SysWow64\00005103.tmp
c:\windows\SysWow64\00009961.tmp
c:\windows\SysWow64\00010221.tmp
c:\windows\SysWow64\00012668.tmp
c:\windows\SysWow64\00014392.tmp
c:\windows\SysWow64\00014478.tmp
c:\windows\SysWow64\00015285.tmp
c:\windows\SysWow64\00016734.tmp
c:\windows\SysWow64\00016827.tmp
c:\windows\SysWow64\00019180.tmp
c:\windows\SysWow64\00021078.tmp
c:\windows\SysWow64\00021760.tmp
c:\windows\SysWow64\00023428.tmp
c:\windows\SysWow64\00023712.tmp
c:\windows\SysWow64\00025378.tmp
c:\windows\SysWow64\00029638.tmp
c:\windows\SysWow64\00031429.tmp
c:\windows\SysWow64\00031675.tmp
.
.
((((((((((((((((((((((((( Files Created from 2014-11-06 to 2014-12-06 )))))))))))))))))))))))))))))))
.
.
2014-12-06 21:53 . 2014-12-06 21:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-12-06 14:57 . 2014-12-06 15:46 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-12-06 01:47 . 2014-12-06 15:53 -------- d-----w- C:\FRST
2014-12-01 03:45 . 2012-10-04 00:14 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-12-01 03:45 . 2014-12-01 03:45 -------- d-----w- c:\program files\iPod
2014-12-01 03:44 . 2014-12-01 03:45 -------- d-----w- c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-01 03:44 . 2014-12-01 03:45 -------- d-----w- c:\program files\iTunes
2014-12-01 03:31 . 2014-12-01 03:31 -------- d-----w- c:\windows\SysWow64\vbox
2014-12-01 03:31 . 2014-12-01 03:31 -------- d-----w- c:\windows\system32\vbox
2014-11-30 22:52 . 2014-11-30 22:43 28184 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-11-30 22:49 . 2014-11-29 17:29 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-30 22:38 . 2014-11-30 22:38 449936 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
2014-11-29 18:05 . 2014-12-06 18:42 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-11-29 18:05 . 2014-12-06 14:51 96472 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-29 18:05 . 2014-11-21 14:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-11-29 18:05 . 2014-11-21 14:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-11-29 18:04 . 2014-12-05 00:50 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-11-29 17:32 . 2014-11-29 17:32 -------- d-----w- c:\users\owner\AppData\Roaming\AVAST Software
2014-11-29 17:30 . 2014-11-29 17:30 -------- d-----w- c:\program files\Google
2014-11-29 17:30 . 2014-11-29 17:29 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-11-29 17:30 . 2014-11-29 17:29 436624 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-11-29 17:30 . 2014-11-29 17:29 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-29 17:30 . 2014-11-29 17:29 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-29 17:30 . 2014-11-29 17:29 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-11-29 17:30 . 2014-11-29 17:29 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-29 17:30 . 2014-11-29 17:29 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-11-29 17:30 . 2014-11-29 17:31 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-29 17:29 . 2014-11-29 17:29 43152 ----a-w- c:\windows\avastSS.scr
2014-11-29 17:28 . 2014-11-29 17:28 -------- d-----w- c:\program files\AVAST Software
2014-11-26 15:23 . 2014-11-29 17:28 -------- d-----w- c:\programdata\AVAST Software
2014-11-18 19:07 . 2014-11-11 03:08 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-18 19:07 . 2014-11-11 03:08 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-18 19:07 . 2014-11-11 02:44 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-18 19:07 . 2014-11-11 02:44 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-14 01:18 . 2014-11-14 01:18 -------- d-sh--w- c:\users\owner\AppData\Local\EmieBrowserModeList
2014-11-11 20:29 . 2014-10-18 02:05 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-11-11 20:29 . 2014-10-18 01:33 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-11-09 02:55 . 2014-11-09 02:56 -------- d-----w- c:\programdata\SMR430
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-30 17:51 . 2012-04-28 17:39 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-30 17:51 . 2012-04-28 17:39 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-12 15:21 . 2010-09-03 01:05 103374192 ----a-w- c:\windows\system32\MRT.exe
2014-10-25 02:54 . 2014-10-25 02:54 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-09-25 02:08 . 2014-10-01 02:35 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-09-25 01:40 . 2014-10-01 02:35 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-09 22:11 . 2014-09-24 01:00 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-09 21:47 . 2014-09-24 01:00 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2014-08-15 43816]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-08-08 43816]
"AppleIEDAV"="c:\program files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe" [2014-08-05 1080104]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-10-01 22065760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-27 271744]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-11-29 5226600]
"iTunesHelper"="d:\itunes\iTunesHelper.exe" [2014-10-15 157480]
.
c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-12-15 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ACTIVhidmini;Promethean USB Board Driver;c:\windows\system32\DRIVERS\ACTIVhidmini.sys;c:\windows\SYSNATIVE\DRIVERS\ACTIVhidmini.sys [x]
R3 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R3 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 prmvmouse;Promethean HID Mouse Service;c:\windows\system32\DRIVERS\activmouse.sys;c:\windows\SYSNATIVE\DRIVERS\activmouse.sys [x]
R3 PTUMWBus;PANTECH USB Modem V2 Composite Device Driver;c:\windows\system32\DRIVERS\PTUMWBus.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWBus.sys [x]
R3 PTUMWCDF;PANTECH USB Modem V2 Installation CD;c:\windows\system32\DRIVERS\PTUMWCDF.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWCDF.sys [x]
R3 PTUMWCSP;PANTECH USB Modem V2 Connection Port;c:\windows\system32\DRIVERS\PTUMWCSP.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWCSP.sys [x]
R3 PTUMWFLT;PTUMWNET Filter Driver;c:\windows\system32\DRIVERS\PTUMWFLT.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWFLT.sys [x]
R3 PTUMWMdm;PANTECH USB Modem V2 Modem Driver;c:\windows\system32\DRIVERS\PTUMWMdm.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWMdm.sys [x]
R3 PTUMWNET;PANTECH USB Modem V2 WWAN Driver;c:\windows\system32\DRIVERS\PTUMWNET.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWNET.sys [x]
R3 PTUMWNSP;PANTECH USB Modem V2 NMEA Port;c:\windows\system32\DRIVERS\PTUMWNSP.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWNSP.sys [x]
R3 PTUMWVsp;PANTECH USB Modem V2 Diagnostic Port;c:\windows\system32\DRIVERS\PTUMWVsp.sys;c:\windows\SYSNATIVE\DRIVERS\PTUMWVsp.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys;c:\windows\SYSNATIVE\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
S0 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys;c:\windows\SYSNATIVE\DRIVERS\aswNdisFlt.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe;c:\program files\AVAST Software\Avast\afwServ.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
S2 IHA_MessageCenter;IHA_MessageCenter;c:\program files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe;c:\program files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe;c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [x]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
*Deregistered* - mbamchameleon
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-11-30 17:55 1087304 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.71\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-12-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 17:51]
.
2014-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-25 00:44]
.
2014-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-25 00:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-29 17:29 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-01-25 369152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-03 10038304]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-04 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-04 390168]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-04 408600]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>;*.local
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-WildTangentGameProvider-dell-genres - c:\program files (x86)\WildTangent\Dell Games\Game Explorer Categories - genres\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,de,0b,53,85,98,ec,46,84,14,ba,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ac,de,0b,53,85,98,ec,46,84,14,ba,\
.
[HKEY_USERS\S-1-5-21-51682695-2428261589-2065693235-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-51682695-2428261589-2065693235-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-12-06 13:59:00
ComboFix-quarantined-files.txt 2014-12-06 21:59
.
Pre-Run: 116,619,513,856 bytes free
Post-Run: 134,911,926,272 bytes free
.
- - End Of File - - E4A993AE11A039D9C96B5F4E2F9F971B
A36C5E4F47E84449FF07ED3517B43A31

TwinHeadedEagle · Dec 7, 2014

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself

Recommended reading:

MUST READ - security tips:

MUST READ - general maintenance:

What to do if your Computer is running slowly?

The Importance of Software Updating:

In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.

Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

Recommended additional software:

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

FiheHippo.com Update Checker - to keep your programs up-to-date.

Adblock - to surf the web without annoying ads!

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

Run the tool by right click on the

icon and Run as administrator option.
Make sure that these ones are checked:
- Remove disinfection tools
- Purge system restore
- Reset system settings
Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

My help is free for everybody.
If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:

Thank you!

Stay safe,
TwinHeadedEagle

Allison · Dec 8, 2014

Thank you so much for all of your help. You are a lifesaver!

Search

Solved dllhost.exe, powershell stopped working, COM Surrogate, slow operating system

Allison

New Member

Attachments

TwinHeadedEagle

Level 41

Allison

New Member

Attachments

TwinHeadedEagle

Level 41

Allison

New Member

TwinHeadedEagle

Level 41

Allison

New Member

Similar threads