Security Center can't be started

[gotodal]

In case you needed that I also attached logs by FSRT64.
Thank you!!

 

[Fiery]

Hi and welcome to MalwareTips!

I'm Fiery and I would gladly assist you in removing the malware on your computer.

PLEASE NOTE: The first 3 posts of ALL new members require approval by mods/admins. Please be patient if you don't see your post immediately after submitting it.

Before we start:

• Note that the removal process is not immediate. Depending on the severity of your infection, it could take a long time.
• Malware removal can be dangerous. I cannot guarantee the safety of your system as malware can be unpredictable. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system. Therefore, I would advise you to backup all your important files before we start.
• Please be patient and stay with me until I give you the green lights and inform you that your PC is clean.
• Some tools may be flagged by your antivirus as harmful. Rest assure that ALL the tools we use are safe, the detections are false positives.
• The absence of symptoms does not mean your PC is fully disinfected.
• If you are unclear about the instructions, please stop and ask. Following the steps in the order that I post them in is vital.
• Lastly, if you have requested help on other sites, that will delay and hinder the removal process. Please only stick to one site.

<hr>
On your clean PC, download the following file by right-clicking it and select save as

[attachment=5406]

and save it onto your flash drive.

Then plug in your flash drive, open FRST and click fix. Post the generated log.

Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool(For Vista or Windows 7, right-click and select Run as Administrator to start)
• Click delete
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt

Download & SAVE to your Desktop RogueKiller or from here

• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select Run as Administrator to start
• Wait until Prescan has finished, then click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• Click delete and wait until it saids deleting finished
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
  Exit/Close RogueKiller+

 

[gotodal]

Thank you Fiery! Will do it later today.

 

[gotodal]

Thank you, Fiery,

Please see Attachments you have requested. AdvCleaner came up with two logs so I attached them both.

 

[Fiery]

Hi,

I noticed you have used Combofix before, can you post the log for that? It should be in C:\qoobox\

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
[2013/06/25 08:09:10 | 000,000,000 | ---D | M] -- C:\Users\IGOR\AppData\Roaming\Ydylax

:files
C:\Users\IGOR\AppData\Local\Temp\jjhmklxvbdiwqhyfn.exe
C:\windows\system32\drivers\gkfbemjh.sys

:Commands
[EMPTYTEMP]

Then click Run Fix. Let your PC reboot to normal mode. A new log will be created automatically, post the content in the next reply.

Download TDSSkiller from here

• Double-Click on TDSSKiller.exe to run the application
• When TDSSkiller opens, click change parameters , check the box next to Loaded modules . A reboot will be required.
• After reboot, TDSSKiller will run again. Click Change parameters again and make sure everything is checked.
  
  
• click Start scan .
  
• If a suspicious object is detected, the default action will be Skip, click on Continue. (If it saids TDL4/TDSS file system, select delete)
• If malicious objects are found, ensure Cure (default) is selected, then click Continue and Reboot now to finish the cleaning process.

Post the log after (usually C:\ folder in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt

Lastly, please update Malwarebytes antimalware and do a quick scan

 

[gotodal]

Sorry, I think I accidently atteched older mbar logs. These are the last ones.

 

[gotodal]

OK, done everything.
Yes,, i did use Combofix last spring but I do not remember what the reason was. I found two txt files in that folder so I attached them both. Also, I found and attached two TDSSKiller logs.
What I was not able to do after all was I could not run Malwarebytes Antimalware. The one I have installed on my laptop kept stoping working right away and the Windows warning came up saying that the program has stoped working and will be closed. Yesterday I was able to use it with no problems. I tryed to download and reinstall it but the installation did not even start and warning came up: Setup was unable to create directory C:\Users\IGOR\AppData\Local\Temp\is-VIQ67.tmp
Error 5: Access is denied.

Thank you.

 

[gotodal]

By the way, before I got ICE Ransom virus I had Microsoft Security Essentials on my laptop. after I cleaned laptop from that virus a few days ago I installed Anvi Smart Defender and Anvi AdBlocker as they both claimed they are great. What I see now is Security Essentials is not monitoring my computer anymore. Could these Anvi programs turn my Secutiry Center off or this was a result of ICE Ransom virus removal process?

 

[Fiery]

It is probably due the the ICE Ransom virus. I don't recommend Anvi products.

We are almost done cleaning your PC, there were still rootkits left over even though you didn't see the ICE virus. We will use combofix again followed by ESET scan. Then we will fix the security center issue once we remove all the bad files first.

Please download ComboFix from one of these locations:

<a title="External link" href="http://download.bleepingcomputer.com/sUBs/ComboFix.exe" rel="external"><>Link 1</></a>
<a title="External link" href="http://www.infospyware.net/antimalware/combofix/" rel="external"><>Link 2</></a>
<ul>
<li>Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See <a title="External link" href="http://www.bleepingcomputer.com/forums/topic114351.html" rel="external">HERE</a> for help</li>
<li>Double click on Combo-Fix & follow the prompts.</li>
</ul>

When finished, ComboFix will produce a log.

<>Note:</>
1. Do not mouseclick combofix's window while it's running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Run Eset NOD32 Online AntiVirus here

Note: You will need to use Internet Explorer for this scan.
Vista / 7 users: You will need to to right-click on the Internet Explorer icon and select Run as Administrator

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your current antivirus software. You can usually do this with its Notfication Tray icon near the clock.
• Make sure that the option "Remove found threats" is Un-checked, and the following Advance Settings are Checked
  • Scan unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
• Save that text file on your desktop. Copy and paste the contents of that log in your next reply to this topic.
• The log can also be found in logfile located at C:\Program Files\ESET\Eset Online Scanner\log.txt

[/list]

• Update Malwarebytes' Anti-Malware.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

 

[gotodal]

Hello, Fiery,
Unfortunately, I was not able to run Combofix till the end. It stoped working after stage 33 and did not do a thing during entire night. Now I can't even close the Combofix window manually or with Task manager. My laptop seems working OK. Should I run Combofix again? Do I need to reboot PC?

 

[Fiery]

Ok, skip combofix for now, reboot your PC and run Malwarebytes and ESET

 

[gotodal]

Ok, skip combofix for now, reboot your PC and run Malwarebytes and ESET

ESET log is attached. But again I was not able to run Malwarebytes Antimalware. It starts as normal but Update is impossible. When I press Scan it's initializing but stops in a second. Windows warning came up saying that the program has stoped working and will be closed. I tried it several times with no luck. Just in case I tried to run Malwarebytes Anti-Rootkit and it worked fine. No malware was found. Both logs attached.
Thank you.

 

[gotodal]

Funny, since you did not recommend Anvi products I decided uninstall them both. As soon as I done it the warning about Security Center gone. )) I did not want to leave PC unprotected and installed Microsoft Security Essentials. Security center is working.

 

[gotodal]

New issue found (( Microsoft games from Games folder are not working. Message says it might be moved or deleted.

 

[Fiery]

Please download ComboFix from one of these locations:

<a title="External link" href="http://download.bleepingcomputer.com/sUBs/ComboFix.exe" rel="external"><>Link 1</></a>
<a title="External link" href="http://www.infospyware.net/antimalware/combofix/" rel="external"><>Link 2</></a>

Save it to your Desktop. Then, start your PC in safe mode and try to run combofix and scan with malwarebytes.

 

[gotodal]

Nope. Now Combofix can't be even started. Message came up: Error writing temporary file. Make sure your temp folder is valid.
Malwarebytes could not run either. If you remember when I was not able to run Malwarebytes first time yesterday I tried to reinstall it and received a message about this temp folder. Before I asked you for help it worked. So maybe during this cleaning process something happened with temp folder??

 

[gotodal]

You would never believe... I just tried to run Combofix one more time and suddenly it worked!! Not in a safe mode but in normal mode. Malwarebytes still stops working in a second.

 

[Fiery]

Hi,

We need to restore some files that combofix removed.

Open up Notepad and paste the following:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar

QUIT::

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  
• Follow the prompts.
• When it finishes, a log will be produced named DeQuarantine_log.txt
• I will ask for this log below

Next, Download Kaspersky Virus Removal Tool <a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow">from here</a></> <em>(Download Version 11. You'll have to enter your email address and name)</em>
<ol>
<li>Double-click the file and follow the on-screen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li><span style="color: #ff0000;">System Memory</span></li>
<li><span style="color: #ff0000;">Hidden startup objects</span></li>
<li><span style="color: #ff0000;">Disk boot sectors</span></li>
<li><span style="color: #ff0000;">Computer</span></li>
<li><span style="color: #ff0000;">Local Disk (C: )</span></li>
</ul>
</li>
<li>Click on <>Automatic Scan</></li>
<li>Now click the <>Start Scanning</> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <>Detected threats</> on the left</li>
<li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>

 

[gotodal]

Done. Kaspersky found no threats. The Save button was grey so I was not able to press it. So I pressed Automatic Scan Report and then pressed Save. It produced 95Mb log file and I can not attach it here. I did it twice with the same result.
Your site did not allow me to attach any files because i reached attachment quota of 1 MB . So I copied DeQuarantine.txt here. But how can I send you this huge kaslog.txt file?? I tried to zip it but still it's 5 Mb.

C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\audiodepthconverter.ax -> C:\Program Files (x86)\Program Files\DVD Maker\audiodepthconverter.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\bod_r.TTF -> C:\Program Files (x86)\Program Files\DVD Maker\bod_r.TTF
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\directshowtap.ax -> C:\Program Files (x86)\Program Files\DVD Maker\directshowtap.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\DVDMaker.exe -> C:\Program Files (x86)\Program Files\DVD Maker\DVDMaker.exe
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Eurosti.TTF -> C:\Program Files (x86)\Program Files\DVD Maker\Eurosti.TTF
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\fieldswitch.ax -> C:\Program Files (x86)\Program Files\DVD Maker\fieldswitch.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\offset.ax -> C:\Program Files (x86)\Program Files\DVD Maker\offset.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\OmdBase.dll -> C:\Program Files (x86)\Program Files\DVD Maker\OmdBase.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\OmdProject.dll -> C:\Program Files (x86)\Program Files\DVD Maker\OmdProject.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Pipeline.dll -> C:\Program Files (x86)\Program Files\DVD Maker\Pipeline.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\PipeTran.dll -> C:\Program Files (x86)\Program Files\DVD Maker\PipeTran.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\rtstreamsink.ax -> C:\Program Files (x86)\Program Files\DVD Maker\rtstreamsink.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\rtstreamsource.ax -> C:\Program Files (x86)\Program Files\DVD Maker\rtstreamsource.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\SecretST.TTF -> C:\Program Files (x86)\Program Files\DVD Maker\SecretST.TTF
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\soniccolorconverter.ax -> C:\Program Files (x86)\Program Files\DVD Maker\soniccolorconverter.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\sonicsptransform.ax -> C:\Program Files (x86)\Program Files\DVD Maker\sonicsptransform.ax
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\WMM2CLIP.dll -> C:\Program Files (x86)\Program Files\DVD Maker\WMM2CLIP.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\en-US\DVDMaker.exe.mui -> C:\Program Files (x86)\Program Files\DVD Maker\en-US\DVDMaker.exe.mui
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\en-US\OmdProject.dll.mui -> C:\Program Files (x86)\Program Files\DVD Maker\en-US\OmdProject.dll.mui
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui -> C:\Program Files (x86)\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Shared\Common.fxh -> C:\Program Files (x86)\Program Files\DVD Maker\Shared\Common.fxh
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Shared\DissolveAnother.png -> C:\Program Files (x86)\Program Files\DVD Maker\Shared\DissolveAnother.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Shared\DissolveNoise.png -> C:\Program Files (x86)\Program Files\DVD Maker\Shared\DissolveNoise.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Shared\Filters.xml -> C:\Program Files (x86)\Program Files\DVD Maker\Shared\Filters.xml
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\DVD Maker\Shared\Parity.fx -> C:\Program Files (x86)\Program Files\DVD Maker\Shared\Parity.fx
25 File(s) copied
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\sbdrop.dll -> C:\Program Files (x86)\Program Files\Windows Sidebar\sbdrop.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\sidebar.exe -> C:\Program Files (x86)\Program Files\Windows Sidebar\sidebar.exe
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\wlsrvc.dll -> C:\Program Files (x86)\Program Files\Windows Sidebar\wlsrvc.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseover.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseover.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseover.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseover.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Flyout_Thumbnail_Shadow.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Flyout_Thumbnail_Shadow.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js
C:\Qoobox\Quarantine\C\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js -> C:\Program Files (x86)\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js
37 File(s) copied

 

[gotodal]

PS Looks like this huge kaslog.txt listed all the files and paths I had in my PC.