Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Computer was hijacked by "File Recovery" program  (Read 14549 times)

0 Members and 1 Guest are viewing this topic.

ZGK

    Topic Starter


    Starter

    • Experience: Familiar
    • OS: Windows XP
    Computer was hijacked by "File Recovery" program
    « on: December 30, 2012, 08:29:55 AM »
    Hello,

    From reading a previous posting on this site, It looks like I have been hijacked by the "File Recovery" program. It started when I was searching for images using Firefox. While searching for images, I believe that I clicked on an image then the Firefox browser closed itself. I did not think too much of that but after it closed I noticed that computer was not able to find any wireless signals. I know there was a wireless signal coming from my router that other computers were picking up. My desktop was normal looking for a minute after the browser closed and then the desktop went black with only about 2 icons visible and then the "File Recovery" program automatically started and error messages suddenly appeared. The program started "scanning" my C drive automatically and said that the drive was damaged and I would need to upgrade this program in order to recover the "lost" files. Well I could not upgrade anything since I could not connect to the internet through wi-fi and I was not going to use an Ethernet connection. I am using another computer to get on the internet and transferring the log files from the hijacked computer with an USB drive.

    Hopefully you can help me fix my problem and I thank you in advance.

    I have posted the logs below:

    # AdwCleaner v2.008 - Logfile created 11/21/2012 at 10:06:30
    # Updated 17/11/2012 by Xplode
    # Operating system : Windows 7 Professional Service Pack 1 (64 bits)
    # User : Omari - OMARI-VAIO
    # Boot Mode : Normal
    # Running from : J:\malware removal\adwcleaner.exe
    # Option [Search]


    ***** [Services] *****


    ***** [Files / Folders] *****

    Folder Found : C:\ProgramData\Partner

    ***** [Registry] *****

    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
    Key Found : HKU\S-1-5-21-289070737-494845056-2650726073-1004\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Registry is clean.

    -\\ Mozilla Firefox v13.0 (en-US)

    Profile name : default [Profil par défaut]
    File : C:\Users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\b1i0i7qg.default\prefs.js

    [OK] File is clean.

    Profile name : bvd
    File : C:\Users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\d1t55rty.bvd\prefs.js

    [OK] File is clean.

    -\\ Google Chrome v [Unable to get version]

    File : C:\Users\Omari\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [1617 octets] - [21/11/2012 10:06:30]

    ########## EOF - C:\AdwCleaner[R1].txt - [1677 octets] ##########


    Malwarebytes Anti-Malware 1.65.1.1000
    www.malwarebytes.org

    Database version: v2012.09.29.05

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Omari :: OMARI-VAIO [administrator]

    11/21/2012 10:09:48 AM
    mbam-log-2012-11-21 (10-09-48).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 203225
    Time elapsed: 2 minute(s), 41 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 2
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)


    DDS (Ver_2012-11-07.01) - NTFS_AMD64
    Internet Explorer: 9.0.8112.16450  BrowserJavaVersion: 1.6.0_29
    Run by Omari at 10:16:39 on 2012-11-21
    Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.3758.1966 [GMT -5:00]
    .
    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
    C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
    C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
    C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\SysWOW64\DllHost.exe
    C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k HPService
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Sony\VAIO Power Management\SPMService.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Windows\WindowsMobile\wmdc.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Windows\system32\svchost.exe -k WindowsMobile
    C:\ProgramData\GameXN\GameXNGO.exe
    C:\ProgramData\GameXN\GameXNGO.exe
    C:\Program Files\Apoint\ApMsgFwd.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\ProgramData\paRKkVxIRKQMg.exe
    C:\ProgramData\sRa4Zx5GM91jhZ.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
    C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
    C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    C:\Program Files (x86)\Real\realplayer\Update\realsched.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
    C:\Program Files\Apoint\Apvfb.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Sony\VAIO Care\VCPerfService.exe
    C:\Program Files\Sony\VAIO Care\VCsystray.exe
    C:\Program Files\Sony\VAIO Care\listener.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Sony\VAIO Care\VCService.exe
    C:\Program Files\Sony\VAIO Care\VCAgent.exe
    C:\Windows\System32\vds.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
    mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
    mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
    uURLSearchHooks: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    mWinlogon: Userinit = userinit.exe,
    BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
    BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll
    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    uRun: [GameXN GO] "C:\ProgramData\GameXN\GameXNGO.exe" /startup
    uRun: [RealNetworks] Rundll32.exe C:\Users\Omari\AppData\Local\RealNetworks\nwbjcxgj.dll,IZDSP_Init
    uRun: [paRKkVxIRKQMg.exe] C:\ProgramData\paRKkVxIRKQMg.exe
    uRun: [sRa4Zx5GM91jhZ] C:\ProgramData\sRa4Zx5GM91jhZ.exe
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    mRun: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup
    mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
    mRun: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
    mRun: [ContentTransferWMDetector.exe] C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
    mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
    mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
    mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    StartupFolder: C:\Users\Omari\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: &D&ownload &with BitComet - C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all with BitComet - C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
    IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    TCP: NameServer = 192.168.1.1
    TCP: Interfaces\{6DD0B22D-C026-4940-9700-1362E8BA5673} : DHCPNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B} : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\D4966496233373230273439303 : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\E4544574541425 : DHCPNameServer = 192.168.1.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    Notify: VESWinlogon - VESWinlogon.dll
    SSODL: WebCheck - <orphaned>
    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
    x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    x64-Run: [Apoint] C:\Program Files (x86)\Apoint\Apoint.exe
    x64-Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe
    x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
    x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
    x64-DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    x64-DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
    x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\b1i0i7qg.default\
    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&sourceid=navclient&gfns=1&q=
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll
    FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll
    FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\components\IPSFFPl.dll
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll
    FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
    FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
    FF - plugin: C:\Windows\System32\Wat\npWatWeb.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-5-25 55280]
    R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1207020.003\symds64.sys [2012-6-11 450680]
    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1207020.003\symefa64.sys [2012-6-11 912504]
    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110114.001\BHDrvx64.sys [2011-1-19 953904]
    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110128.003\IDSviA64.sys [2011-1-28 476792]
    R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1207020.003\ironx64.sys [2012-6-11 171128]
    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1207020.003\symnets.sys [2012-6-11 386168]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-25 13336]
    R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe [2012-6-11 130008]
    R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
    R2 regi;regi;C:\Windows\System32\drivers\regi.sys [2010-5-25 14112]
    R2 rimspci;rimspci;C:\Windows\System32\drivers\rimssne64.sys [2009-12-25 93696]
    R2 risdsnpe;risdsnpe;C:\Windows\System32\drivers\risdsne64.sys [2009-12-25 75776]
    R2 SampleCollector;VAIO Care Performance Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2011-6-14 259192]
    R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2010-5-25 104960]
    R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-25 2320920]
    R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-2-19 529776]
    R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2010-5-25 19968]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-6-3 132656]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-12-25 56344]
    R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2012-4-30 158976]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-4-30 317440]
    R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2009-12-25 11392]
    R3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2010-5-25 571248]
    R3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2011-6-14 44736]
    R3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update Common\VUAgent.exe [2012-1-13 1256040]
    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-12-25 395264]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 Roxio Upnp Server 10;Roxio Upnp Server 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-8-31 362992]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
    S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;C:\Program Files\BitComet\tools\BitCometService.exe -service --> C:\Program Files\BitComet\tools\BitCometService.exe -service [?]
    S3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2009-12-25 52264]
    S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2009-12-25 35104]
    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-23 48488]
    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-22 1493352]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-8-31 313840]
    S3 SOHCImp;VAIO Media plus Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-9-10 108400]
    S3 SOHDms;VAIO Media plus Digital Media Server;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-10-12 423280]
    S3 SOHDs;VAIO Media plus Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-9-10 67952]
    S3 SpfService;VAIO Entertainment Common Service;C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2010-9-27 303872]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-4-30 59392]
    S3 TVICHW64;TVICHW64;C:\Windows\System32\drivers\TVicHW64.sys [2010-8-4 21200]
    S3 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-9-27 864000]
    S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-2-19 115568]
    S3 vpcuxd;USB Virtualization Stub Service;C:\Windows\System32\drivers\vpcuxd.sys [2011-4-30 16384]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-3 1255736]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2012-11-21 15:09:05   --------   d-----w-   C:\Users\Omari\AppData\Roaming\Malwarebytes
    2012-11-21 15:08:46   --------   d-----w-   C:\ProgramData\Malwarebytes
    2012-11-21 15:08:44   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
    2012-11-21 15:08:44   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-11-21 14:56:43   --------   d-----w-   C:\Program Files\CCleaner
    2012-10-27 17:46:07   246272   ---ha-w-   C:\ProgramData\sRa4Zx5GM91jhZ.exe
    2012-10-27 17:35:16   339456   ---ha-w-   C:\ProgramData\paRKkVxIRKQMg.exe
    .
    ==================== Find3M  ====================
    .
    2012-10-08 22:32:16   73656   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-10-08 22:32:16   696760   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
    2012-10-08 22:32:11   10220472   ----a-w-   C:\Windows\SysWow64\FlashPlayerInstaller.exe
    2012-09-30 12:49:58   499712   ----a-w-   C:\Windows\SysWow64\msvcp71.dll
    2012-09-30 12:49:58   348160   ----a-w-   C:\Windows\SysWow64\msvcr71.dll
    2012-09-14 19:19:29   2048   ----a-w-   C:\Windows\System32\tzres.dll
    2012-09-14 18:28:53   2048   ----a-w-   C:\Windows\SysWow64\tzres.dll
    2012-08-31 18:19:35   1659760   ----a-w-   C:\Windows\System32\drivers\ntfs.sys
    2012-08-30 18:03:45   5559664   ----a-w-   C:\Windows\System32\ntoskrnl.exe
    2012-08-30 17:12:02   3968880   ----a-w-   C:\Windows\SysWow64\ntkrnlpa.exe
    2012-08-30 17:12:02   3914096   ----a-w-   C:\Windows\SysWow64\ntoskrnl.exe
    2012-08-24 18:05:07   220160   ----a-w-   C:\Windows\System32\wintrust(58).dll
    2012-08-24 16:57:48   172544   ----a-w-   C:\Windows\SysWow64\wintrust(66).dll
    2012-08-24 10:31:32   2312704   ----a-w-   C:\Windows\System32\jscript9.dll
    2012-08-24 10:21:18   1392128   ----a-w-   C:\Windows\System32\wininet.dll
    2012-08-24 10:20:11   1494528   ----a-w-   C:\Windows\System32\inetcpl.cpl
    2012-08-24 10:14:45   173056   ----a-w-   C:\Windows\System32\ieUnatt.exe
    2012-08-24 10:13:29   599040   ----a-w-   C:\Windows\System32\vbscript.dll
    2012-08-24 10:09:42   2382848   ----a-w-   C:\Windows\System32\mshtml.tlb
    2012-08-24 06:59:17   1800704   ----a-w-   C:\Windows\SysWow64\jscript9.dll
    2012-08-24 06:51:27   1129472   ----a-w-   C:\Windows\SysWow64\wininet.dll
    2012-08-24 06:51:02   1427968   ----a-w-   C:\Windows\SysWow64\inetcpl.cpl
    2012-08-24 06:47:26   142848   ----a-w-   C:\Windows\SysWow64\ieUnatt.exe
    2012-08-24 06:47:12   420864   ----a-w-   C:\Windows\SysWow64\vbscript.dll
    2012-08-24 06:43:58   2382848   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
    .
    ============= FINISH: 10:19:46.95 ===============


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-07.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 6/2/2010 11:03:34 PM
    System Uptime: 11/21/2012 9:51:41 AM (1 hours ago)
    .
    Motherboard: Sony Corporation |  | VAIO
    Processor: Intel(R) Core(TM) i5 CPU       M 520  @ 2.40GHz | N/A | 2400/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 289 GiB total, 57.503 GiB free.
    D: is CDROM ()
    G: is Removable
    H: is Removable
    J: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Atheros AR9285 Wireless Network Adapter
    Device ID: PCI\VEN_168C&DEV_002B&SUBSYS_E017105B&REV_01\4&1EE949F9&0&00E0
    Manufacturer: Atheros Communications Inc.
    Name: Atheros AR9285 Wireless Network Adapter
    PNP Device ID: PCI\VEN_168C&DEV_002B&SUBSYS_E017105B&REV_01\4&1EE949F9&0&00E0
    Service: athr
    .
    ==== System Restore Points ===================
    .
    RP251: 8/15/2012 11:32:06 PM - Scheduled Checkpoint
    RP252: 9/2/2012 9:51:16 PM - Scheduled Checkpoint
    RP253: 9/26/2012 8:19:06 AM - Windows Update
    RP254: 9/26/2012 8:49:34 AM - Windows Update
    RP255: 10/7/2012 9:14:33 PM - Scheduled Checkpoint
    RP256: 10/20/2012 10:34:11 AM - Scheduled Checkpoint
    RP257: 10/27/2012 12:45:16 PM - Windows Update
    RP258: 10/29/2012 7:58:47 PM - Restore Operation
    .
    ==== Installed Programs ======================
    .
     Update for Microsoft Office 2007 (KB2508958)
    64 Bit HP CIO Components Installer
    Adobe AIR
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.4)
    AIO_CDA_ProductContext
    AIO_CDA_Software
    AIO_Scan
    Alps Pointing-device for VAIO
    ArcSoft Magic-i Visual Effects 2
    ArcSoft WebCam Companion 3
    BitComet 1.32 64-bit
    BufferChm
    Business Contact Manager for Outlook 2007 SP2
    C3100
    c3100_Help
    CCleaner
    Click to Disc MergeModules x64
    CometBird 11.0 (x86 en-US)
    Compatibility Pack for the 2007 Office system
    Content Transfer
    Copy
    Corel WinDVD
    D3DX10
    Destinations
    DeviceDiscovery
    DocProc
    Evernote
    Fax
    GameXN GO
    Google Chrome
    Google Toolbar for Internet Explorer
    Google Update Helper
    GPBaseService2
    Hewlett-Packard ACLM.NET v1.1.0.0
    HP Customer Participation Program 13.0
    HP Imaging Device Functions 13.0
    HP Photosmart All-In-One Driver Software 13.0 Rel. A
    HP Photosmart Essential 3.5
    HP Product Detection
    HP Smart Web Printing 4.51
    HP Solution Center 13.0
    HP Update
    HPDiagnosticAlert
    HPPhotoGadget
    HPPhotoSmartDiscLabelContent1
    HPPhotosmartEssential
    HPProductAssistant
    HPSSupply
    Intel(R) Control Center
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology
    Java Auto Updater
    Java(TM) 6 Update 17 (64-bit)
    Java(TM) 6 Update 20
    Java(TM) 6 Update 22
    Java(TM) 6 Update 29
    Java(TM) 7 Update 1 (64-bit)
    Java(TM) SE Development Kit 7 Update 1 (64-bit)
    Junk Mail filter update
    Malwarebytes Anti-Malware version 1.65.1.1000
    MarketResearch
    McAfee Security Scan Plus
    Media Gallery
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Primary Interop Assemblies
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Office 64-bit Components 2007
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared 64-bit MUI (English) 2007
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Small Business 2007
    Microsoft Office Small Business Connectivity Components
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    mIRC
    Mozilla Firefox (3.0.19)
    Mozilla Firefox (3.6)
    Mozilla Firefox 13.0 (x86 en-US)
    Mozilla Maintenance Service
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Network64
    Norton Internet Security
    NWZ-S540 WALKMAN Guide
    OCR Software by I.R.I.S. 13.0
    OpenOffice.org 3.3
    PlayReady PC Runtime amd64
    PMB
    PMB VAIO Edition Guide
    PMB VAIO Edition plug-in (Click to Disc)
    PMB VAIO Edition plug-in (VAIO Image Optimizer)
    PMB VAIO Edition plug-in (VAIO Movie Story)
    QuickBooks Financial Center
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    Realtek High Definition Audio Driver
    RealUpgrade 1.1
    Remote Keyboard
    Remote Play with PlayStation 3
    Roxio Central Audio
    Roxio Central Copy
    Roxio Central Core
    Roxio Central Data
    Roxio Central Tools
    Roxio Easy Media Creator 10 LJ
    Roxio Easy Media Creator Home
    Scan
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
    Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
    Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
    Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
    Setting Utility Series
    Setup_msm_VCMS_x64
    Setup_msm_VOFS_x64
    Setup_VEP_x64
    SharkPort 2
    Shop for HP Supplies
    Skype Toolbars
    Skype™ 5.10
    SmartWebPrinting
    SmartWi Connection Utility
    SOHLib Merge Module
    SolutionCenter
    Sony Home Network Library
    Status
    Toolbox
    TrayApp
    UnloadSupport
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Publisher 2007 Help (KB963667)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    VAIO - Remote Keyboard
    VAIO - Remote Play with PlayStation®3
    VAIO Care
    VAIO Care Update
    VAIO Content Monitoring Settings
    VAIO Control Center
    VAIO Data Restore Tool
    VAIO DVD Menu Data
    VAIO Entertainment Platform
    VAIO Event Service
    VAIO Hardware Diagnostics
    VAIO Help and Support
    VAIO Media plus
    VAIO Media plus Opening Movie
    VAIO Movie Story MergeModules x64
    VAIO Movie Story Template Data
    VAIO OOBE and Startup Assistant
    VAIO Original Function Settings
    VAIO Personalization Manager
    VAIO Power Management
    VAIO Quick Web Access
    VAIO Survey
    VAIO Transfer Support
    VAIO Update
    VAIO Update Merge Module x64
    VAIO Wallpaper Contents
    VD64Inst
    VU5x64
    VU5x86
    WebReg
    WIDCOMM Bluetooth Software
    Windows Driver Package - Broadcom Bluetooth  (09/09/2009 6.2.0.9405)
    Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Language Selector
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Mobile Device Center
    Windows XP Mode
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/21/2012 9:57:22 AM, Error: Service Control Manager [7022]  - The VAIO Care Performance Service service hung on starting.
    11/21/2012 9:52:13 AM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Roxio Upnp Server 10 service to connect.
    .
    ==== End Of File ===========================

    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: Computer was hijacked by "File Recovery" program
    « Reply #1 on: December 30, 2012, 11:33:49 AM »
    Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
    *************************************************************************
    Remove the Adware:
    • Please close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Delete.
    • Confirm each time with OK
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the content of that logfile in your reply.
    • You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
    *********************************************************
    P2P - I see you have P2P software installed on your machine. (BitComet)We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

    I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
    ****************************************************
    Download Security Check by screen317 from one of the following links and save it to your desktop.

    Link 1
    Link 2

    * Double-click Security Check.bat
    * Follow the on-screen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt
    * Post the contents of that document in your next reply.

    Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
    ****************************************************
    Download Combofix from any of the links below, and save it to your DESKTOP

    Link 1
    Link 2
    Link 3

    To prevent your anti-virus application interfering with  ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.
    • Close any open windows and double click ComboFix.exe to run it.

      You will see the following image:


    Click I Agree to start the program.

    ComboFix will then extract the necessary files and you will see this:



    As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to  have this pre-installed on your machine before doing any malware  removal. This will not occur in Windows Vista and 7

    It will allow you to boot up into a special recovery/repair  mode that will allow us to more easily help you should your computer  have a problem after an attempted removal of malware.

    If you did not have it installed, you will see the prompt below. Choose YES.



    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



    Click on Yes, to continue scanning for malware.

    When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

    Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

    Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
    Windows 8 and Windows 10 dual boot with two SSD's

    ZGK

      Topic Starter


      Starter

      • Experience: Familiar
      • OS: Windows XP
      Re: Computer was hijacked by "File Recovery" program
      « Reply #2 on: February 14, 2013, 03:14:56 PM »
      Here is some more info that I forgot to mention in my first posting:

      The name of the "File Recovery" program that I mentioned previously is called File Restore. I noticed that in the Start Menu in the Programs section there is folder for File Restore which did not exist before this incident. Also, in the Programs sections there are folders for programs that either were preinstalled or installed by me that are missing programs or are completely empty. In the Start menu. the area is on the rightmost side only contains the Shut down button and my login user picture. It used to have links on that side which are now missing. This was not the case before File Restore appeared. So, either those missing objects are being hidden and have been deleted. These are just the things that I noticed that are missing who knows what else File Restore has done.

      I have posted the logs below and ComboFix did not restart my computer when it finished:

      # AdwCleaner v2.008 - Logfile created 12/30/2012 at 17:36:13
      # Updated 17/11/2012 by Xplode
      # Operating system : Windows 7 Professional Service Pack 1 (64 bits)
      # User : Omari - OMARI-VAIO
      # Boot Mode : Normal
      # Running from : E:\malware removal\adwcleaner.exe
      # Option [Delete]


      ***** [Services] *****


      ***** [Files / Folders] *****

      Folder Deleted : C:\ProgramData\Partner

      ***** [Registry] *****

      Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
      Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
      Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
      Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

      ***** [Internet Browsers] *****

      -\\ Internet Explorer v9.0.8112.16421

      [OK] Registry is clean.

      -\\ Mozilla Firefox v13.0 (en-US)

      Profile name : default [Profil par défaut]
      File : C:\Users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\b1i0i7qg.default\prefs.js

      [OK] File is clean.

      Profile name : bvd
      File : C:\Users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\d1t55rty.bvd\prefs.js

      [OK] File is clean.

      -\\ Google Chrome v [Unable to get version]

      File : C:\Users\Omari\AppData\Local\Google\Chrome\User Data\Default\Preferences

      [OK] File is clean.

      *************************

      AdwCleaner[R1].txt - [1742 octets] - [21/11/2012 10:06:30]
      AdwCleaner[S1].txt - [1536 octets] - [30/12/2012 17:36:13]

      ########## EOF - C:\AdwCleaner[S1].txt - [1596 octets] ##########



       Results of screen317's Security Check version 0.99.56 
       Windows 7 Service Pack 1 x64 (UAC is enabled) 
       Internet Explorer 9 
      ``````````````Antivirus/Firewall Check:``````````````[/u]
       Windows Security Center service is not running! This report may not be accurate!
       Windows Firewall Enabled! 
      Norton Internet Security   
       WMI entry may not exist for antivirus; attempting automatic update.
      `````````Anti-malware/Other Utilities Check:`````````[/u]
       Malwarebytes Anti-Malware version 1.65.1.1000 
       Java(TM) 6 Update 20 
       Java(TM) 6 Update 22 
       Java(TM) 6 Update 29 
       Java version out of Date!
        Adobe Flash Player 11.4.402.287 Flash Player out of Date! 
       Adobe Reader 10.1.4 Adobe Reader out of Date! 
       Mozilla Firefox (13.0)
       Google Chrome 21.0.1180.83 
       Google Chrome 21.0.1180.89 
       Google Chrome 22.0.1229.79 
       Google Chrome 22.0.1229.94 
      ````````Process Check: objlist.exe by Laurent````````[/u] 
       Norton ccSvcHst.exe
       Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe 
      `````````````````System Health check`````````````````[/u]
       Total Fragmentation on Drive C: 4%
      ````````````````````End of Log``````````````````````[/u]


      ComboFix 12-12-30.01 - Omari 12/30/2012  18:01:12.1.4 - x64
      Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.3758.2120 [GMT -5:00]
      Running from: c:\users\Omari\Desktop\ComboFix.exe
      AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
      FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
      SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
       * Created a new restore point
      .
      .
      (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      C:\Install.exe
      c:\programdata\paRKkVxIRKQMg.exe
      c:\programdata\sRa4Zx5GM91jhZ.exe
      .
      .
      (((((((((((((((((((((((((   Files Created from 2012-11-28 to 2012-12-30  )))))))))))))))))))))))))))))))
      .
      .
      2012-12-30 23:31 . 2012-12-30 23:31   --------   d-----w-   c:\users\Default\AppData\Local\temp
      .
      .
      .
      ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2012-10-27 16:53 . 2010-06-03 11:01   65309168   ----a-w-   c:\windows\system32\MRT.exe
      2012-10-08 22:32 . 2012-04-29 17:59   696760   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
      2012-10-08 22:32 . 2011-05-20 04:46   73656   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
      2012-10-08 22:32 . 2012-10-08 22:32   10220472   ----a-w-   c:\windows\SysWow64\FlashPlayerInstaller.exe
      .
      .
      (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4
      .
      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-25 39408]
      "GameXN GO"="c:\programdata\GameXN\GameXNGO.exe" [2012-03-17 347008]
      "RealNetworks"="c:\users\Omari\AppData\Local\RealNetworks\nwbjcxgj.dll" [2012-04-28 823296]
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
      "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
      "SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2009-10-05 80384]
      "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-08-27 320880]
      "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-01-22 597792]
      "ContentTransferWMDetector.exe"="c:\program files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe" [2009-11-19 583016]
      "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
      "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
      "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
      "TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-09-30 296096]
      .
      c:\users\Omari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
      OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "ConsentPromptBehaviorAdmin"= 5 (0x5)
      "ConsentPromptBehaviorUser"= 3 (0x3)
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
      2009-12-02 05:03   98304   ----a-w-   c:\windows\System32\VESWinlogon.dll
      .
      R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
      R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-08-31 362992]
      R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
      R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;c:\program files\BitComet\tools\BitCometService.exe [2010-12-28 1296728]
      R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-11-18 52264]
      R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-11-18 35104]
      R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
      R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-08-31 313840]
      R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-09-10 108400]
      R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-10-12 423280]
      R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-09-10 67952]
      R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2010-09-27 303872]
      R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
      R3 TVICHW64;TVICHW64;c:\windows\system32\DRIVERS\TVICHW64.SYS [2010-08-05 21200]
      R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2010-09-27 864000]
      R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-02-19 115568]
      R3 vpcuxd;USB Virtualization Stub Service;c:\windows\system32\DRIVERS\vpcuxd.sys [2010-11-20 16384]
      R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-03 1255736]
      R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
      S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-05-20 55280]
      S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS [2011-01-27 450680]
      S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS [2011-03-15 912504]
      S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110114.001\BHDrvx64.sys [2010-11-23 953904]
      S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110128.003\IDSvia64.sys [2010-11-11 476792]
      S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [2011-01-27 171128]
      S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [2011-04-21 386168]
      S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-11-20 13336]
      S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [2011-04-17 130008]
      S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
      S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 14112]
      S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [2009-11-06 93696]
      S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [2009-09-15 75776]
      S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]
      S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
      S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-14 2320920]
      S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-02-19 529776]
      S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
      S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-06-03 132656]
      S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [2009-12-14 56344]
      S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2012-05-01 158976]
      S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2012-05-01 317440]
      S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2009-08-19 11392]
      S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2009-12-01 571248]
      S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]
      S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
      S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-11-12 395264]
      .
      .
      [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
      hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
      .
      Contents of the 'Scheduled Tasks' folder
      .
      2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job
      - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-29 22:32]
      .
      2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-25 20:33]
      .
      2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-25 20:33]
      .
      .
      --------- X64 Entries -----------
      .
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-16 9636896]
      "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
      "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-05-01 162584]
      "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-05-01 386840]
      "Persistence"="c:\windows\system32\igfxpers.exe" [2012-05-01 417560]
      .
      ------- Supplementary Scan -------
      .
      uLocal Page = c:\windows\system32\blank.htm
      uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
      mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
      mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
      mLocal Page = c:\windows\SysWOW64\blank.htm
      IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
      IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
      IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
      IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
      IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
      IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      TCP: DhcpNameServer = 192.168.1.1
      FF - ProfilePath - c:\users\Omari\AppData\Roaming\Mozilla\Firefox\Profiles\d1t55rty.bvd\
      FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
      FF - Ext: Symantec IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn
      FF - Ext: HP Smart Web Printing: [email protected] - c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
      FF - Ext: HP Smart Web Printing: [email protected] - c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
      .
      - - - - ORPHANS REMOVED - - - -
      .
      Wow6432Node-HKCU-Run-paRKkVxIRKQMg.exe - c:\programdata\paRKkVxIRKQMg.exe
      Wow6432Node-HKCU-Run-sRa4Zx5GM91jhZ - c:\programdata\sRa4Zx5GM91jhZ.exe
      Wow6432Node-HKLM-Run-<NO NAME> - (no file)
      HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
      AddRemove-Mozilla Firefox (3.0.19) - c:\program files (x86)\Mozilla Firefox\bvd\uninstall\helper.exe
      .
      .
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
      "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1"
      --
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
      "ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
      .
      --------------------- LOCKED REGISTRY KEYS ---------------------
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
      "Enabled"=dword:00000001
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
      @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker5"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
      "Enabled"=dword:00000001
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Shockwave Flash Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
      @="0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
      @="ShockwaveFlash.ShockwaveFlash.11"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
      @="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
      @="ShockwaveFlash.ShockwaveFlash"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Macromedia Flash Factory Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
      @="FlashFactory.FlashFactory.1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
      @="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
      @="FlashFactory.FlashFactory"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker5"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
      "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
         00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
      @Denied: (Full) (Everyone)
      .
      Completion time: 2012-12-30  18:53:57
      ComboFix-quarantined-files.txt  2012-12-30 23:53
      .
      Pre-Run: 61,369,925,632 bytes free
      Post-Run: 60,901,306,368 bytes free
      .
      - - End Of File - - 7D2DFE4A4245910A76F130CD4EE51DEE

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Computer was hijacked by "File Recovery" program
      « Reply #3 on: February 14, 2013, 04:34:17 PM »
      This may help with the disappearing programs.
      • Please download Unhide by Grinler from here and save it to your desktop.
      • Double click unhide.exe to run the tool.
      • It will take some time to go through all your files, so please be patient.
      • If this tool doesn´t fix the problem, please let me know.
      *************************************************
      Update Your Java (JRE)

      Old versions of Java have vulnerabilities that malware can use to infect your system.


      First Verify your Java Version

      If there are any other version(s) installed then update now.

      Get the new version (if needed)

      If your version is out of date install the newest version of the Sun Java Runtime Environment.

      Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

      Be sure to close ALL open web browsers before starting the installation.

      Remove any old versions

      1. Download JavaRa and unzip the file to your Desktop.
      2. Open JavaRA.exe and choose Remove Older Versions
      3. Once complete exit JavaRA.

      Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
      *******************************************************
      Update your Adobe Reader. get.adobe.com/reader.

      Be sure to uncheck the Free McAfee Security Scan so it isn't installed.

      **************************************************************
      Please download Rooter and Save it to your desktop.
      • Double click it to start the tool.Vista and Windows7 run as administrator.
      • Click Scan.
      • Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
      *****************************************************
      • Download RogueKiller on the desktop
      • Close all the running programs
      • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
      • Otherwise just double-click on RogueKiller.exe
      • Pre-scan will start. Let it finish.
      • Click on SCAN button.
      • A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
      • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
      Windows 8 and Windows 10 dual boot with two SSD's

      ZGK

        Topic Starter


        Starter

        • Experience: Familiar
        • OS: Windows XP
        Re: Computer was hijacked by "File Recovery" program
        « Reply #4 on: July 20, 2013, 07:30:27 AM »
        Here is some info that I need to mention:

        1.
        I ran Rooter as an administrator multiple times and it would just hang there and not really do anything when I clicked Scan. I actually left it on for over 12 hours one time. I just now was able to get it to complete a scan normally. I do not run RogueKiller until after I was able to get a report from Rooter.

        2.
        RogueKiller had a list of files that I could delete but I did not delete them since that was not mentioned in the post. Should I delete any of the files listed from the scan?

        I have posted the logs below:

        Rooter.exe (v1.0.2) by Eric_71
        .
        SeDebugPrivilege granted successfully ...
        .
        Windows 7 . (6.1.7601) Service Pack 1
        [32_bits] - Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
        .
        [wscsvc] (Security Center) RUNNING (state:4)
        [MpsSvc] RUNNING (state:4)
        Windows Firewall -> Enabled
        Windows Defender -> Enabled
        User Account Control (UAC) -> Enabled
        .
        Internet Explorer 9.10.9200.16635
        Mozilla Firefox 13.0 (en-US)
        .
        C:\  [Fixed-NTFS] .. ( Total:288 Go - Free:47 Go )
        D:\  [CD_Rom]
        G:\  [Removable]
        H:\  [Removable]
        .
        Scan : 07:22.34
        Path : C:\Users\Omari\Desktop\Rooter.exe
        User : Omari ( Administrator -> YES )
        .
        ----------------------\\ Processes
        .
        Locked [System Process] (0)
        Locked System (4)
        ______ ?????????? (336)
        ______ ?????????? (508)
        ______ ?????????? (568)
        ______ ?????????? (592)
        ______ ?????????? (632)
        ______ ?????????? (656)
        ______ ?????????? (664)
        ______ ?????????? (760)
        ______ ?????????? (836)
        ______ ?????????? (924)
        ______ ?????????? (944)
        ______ ?????????? (980)
        ______ ?????????? (1012)
        ______ ?????????? (120)
        Locked audiodg.exe (660)
        ______ ?????????? (1152)
        ______ ?????????? (1356)
        ______ ?????????? (1400)
        ______ C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1528)
        ______ ?????????? (1572)
        ______ C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (1596)
        ______ ?????????? (1640)
        ______ ?????????? (1696)
        ______ C:\Windows\SysWOW64\svchost.exe (1724)
        ______ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (1780)
        ______ C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (1832)
        ______ C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (1932)
        ______ C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (1984)
        ______ C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (404)
        ______ C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (1176)
        ______ c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe (2180)
        ______ ?????????? (2216)
        ______ ?????????? (2272)
        ______ C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (2308)
        ______ C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (2376)
        ______ C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (2412)
        ______ ?????????? (2440)
        ______ ?????????? (2532)
        ______ C:\Windows\SysWOW64\DllHost.exe (2656)
        ______ ?????????? (2692)
        ______ C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (2880)
        ______ ?????????? (3144)
        ______ ?????????? (3200)
        ______ ?????????? (3248)
        ______ ?????????? (3600)
        ______ ?????????? (3744)
        ______ C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (3776)
        ______ ?????????? (3840)
        ______ ?????????? (4040)
        ______ ?????????? (3340)
        ______ ?????????? (3588)
        ______ ?????????? (3644)
        ______ ?????????? (4064)
        ______ ?????????? (4388)
        ______ ?????????? (4396)
        ______ ?????????? (4404)
        ______ ?????????? (4476)
        ______ ?????????? (4556)
        ______ ?????????? (4604)
        ______ C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (4748)
        ______ C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (4812)
        ______ C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (4852)
        ______ C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (5016)
        ______ C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (5052)
        ______ C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (5060)
        ______ C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe (5080)
        ______ C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe (5108)
        ______ C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (4240)
        ______ ?????????? (4668)
        ______ C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe (4896)
        ______ ?????????? (4784)
        ______ ?????????? (4928)
        ______ ?????????? (3820)
        ______ C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe (5132)
        ______ C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe (5488)
        ______ C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe (5496)
        ______ ?????????? (6092)
        ______ ?????????? (6136)
        ______ ?????????? (4876)
        ______ C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (3660)
        ______ C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (5300)
        ______ ?????????? (5780)
        ______ ?????????? (2600)
        ______ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (4636)
        ______ ?????????? (5380)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (1448)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3836)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5312)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3392)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5004)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (2756)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3552)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5340)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (1768)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (1004)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5276)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3532)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3120)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3852)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6252)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6276)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6320)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6384)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6444)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6564)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6664)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6696)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6856)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6876)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6920)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6984)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7104)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7140)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6224)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6872)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7100)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7152)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7216)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7260)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7472)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7500)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7632)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7652)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7672)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7764)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7840)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7888)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (8036)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (8108)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (8124)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7648)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (7428)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (3164)
        ______ ?????????? (8340)
        ______ ?????????? (8744)
        ______ ?????????? (4740)
        ______ ?????????? (9920)
        ______ C:\ProgramData\GameXN\GameXNGO.exe (10028)
        ______ ?????????? (7732)
        ______ C:\Program Files\Sony\VAIO Care\VCService.exe (9312)
        ______ ?????????? (9272)
        ______ ?????????? (9536)
        ______ C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5772)
        ______ ?????????? (9384)
        ______ C:\Program Files (x86)\Real\realplayer\update\realsched.exe (9996)
        ______ C:\Program Files\Sony\VAIO Care\listener.exe (1668)
        ______ ?????????? (8880)
        ______ ?????????? (8828)
        ______ ?????????? (9448)
        ______ ?????????? (10752)
        ______ ?????????? (11052)
        ______ C:\Users\Omari\Desktop\Rooter.exe (9180)
        .
        ----------------------\\ Device\Harddisk0\
        .
        \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
        .
        \Device\Harddisk0\Partition1 (Start_Offset:1048576 | Length:9990832128)
        \Device\Harddisk0\Partition2 (Start_Offset:9991880704 | Length:104857600)
        \Device\Harddisk0\Partition3 (Start_Offset:10096738304 | Length:309960466432)
        \Device\Harddisk0\Partition4 --[ MBR ]-- (Start_Offset:320057901056 | Length:10485760)
        .
        ----------------------\\ Scheduled Tasks
        .
        C:\Windows\Tasks\Adobe Flash Player Updater.job
        C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
        C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
        C:\Windows\Tasks\SA.DAT
        C:\Windows\Tasks\SCHEDLGU(29).TXT
        C:\Windows\Tasks\SCHEDLGU(67).TXT
        C:\Windows\Tasks\SCHEDLGU.TXT
        .
        ----------------------\\ Registry
        .
        .
        ----------------------\\ Files & Folders
        .
        C:\Users\Omari\Desktop\hello\iro\torrents\Zac Mccracken (1988)(Lucas Arts).zip.xml
        ==> Cracks & Keygens <==
        .
        ----------------------\\ Scan completed at 07:25.48
        .
        C:\Rooter$\Rooter_3.txt - (18/07/2013 | 07:25.48).c



        RogueKiller V8.6.3 _x64_ [Jul 17 2013] by Tigzy
        mail : tigzyRK<at>gmail<dot>com
        Feedback : http://www.adlice.com/forum/
        Website : http://www.adlice.com/softwares/roguekiller/
        Blog : http://tigzyrk.blogspot.com/

        Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
        Started in : Normal mode
        User : Omari [Admin rights]
        Mode : Scan -- Date : 07/18/2013 22:31:21
        | ARK || FAK || MBR |

        ¤¤¤ Bad processes : 0 ¤¤¤

        ¤¤¤ Registry Entries : 9 ¤¤¤
        [HJ POL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND
        [HJ POL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
        [HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
        [HJ POL] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND
        [HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
        [HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
        [HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
        [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
        [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

        ¤¤¤ Scheduled tasks : 0 ¤¤¤

        ¤¤¤ Startup Entries : 0 ¤¤¤

        ¤¤¤ Web browsers : 0 ¤¤¤

        ¤¤¤ Particular Files / Folders: ¤¤¤

        ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

        ¤¤¤ External Hives: ¤¤¤

        ¤¤¤ Infection : Root.MBR ¤¤¤

        ¤¤¤ HOSTS File: ¤¤¤
        --> %SystemRoot%\System32\drivers\etc\hosts


        127.0.0.1       localhost


        ¤¤¤ MBR Check: ¤¤¤

        +++++ PhysicalDrive0: Hitachi HTS545032B9SA00 +++++
        --- User ---
        [MBR] 78f8caaaa541968f84d89c02fecd39bb
        [BSP] d6fa0baa324f7283cd5562cbdbab808d : Windows 7/8 MBR Code
        Partition table:
        0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 9528 Mo
        1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 19515392 | Size: 100 Mo
        2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19720192 | Size: 295601 Mo
        User != LL1 ... KO!
        --- LL1 ---
        [MBR] c99a80f71cd2cb87989295b0742b8958
        [BSP] d6fa0baa324f7283cd5562cbdbab808d : Windows 7/8 MBR Code [possible maxSST in 3!]
        Partition table:
        0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 9528 Mo
        1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19515392 | Size: 100 Mo
        2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19720192 | Size: 295601 Mo
        3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 625113088 | Size: 10 Mo
        User != LL2 ... KO!
        --- LL2 ---
        [MBR] c99a80f71cd2cb87989295b0742b8958
        [BSP] d6fa0baa324f7283cd5562cbdbab808d : Windows 7/8 MBR Code [possible maxSST in 3!]
        Partition table:
        0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 9528 Mo
        1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19515392 | Size: 100 Mo
        2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 19720192 | Size: 295601 Mo
        3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 625113088 | Size: 10 Mo

        Finished : << RKreport[0]_S_07182013_223121.txt >>





        SuperDave

        • Malware Removal Specialist


        • Genius
        • Thanked: 1020
        • Certifications: List
        • Experience: Expert
        • OS: Windows 10
        Re: Computer was hijacked by "File Recovery" program
        « Reply #5 on: July 20, 2013, 01:12:13 PM »
        Quote
        RogueKiller had a list of files that I could delete but I did not delete them since that was not mentioned in the post. Should I delete any of the files listed from the scan?
        Yes, please run it again and delete those items.

        Your computer has keygens, which is a form of software piracy. What is so bad about Cracks, Hacks, Pirated software, warez, or Keygens?

        Most popular cracks or keygens I see, are for Adobe CS3, a lot of different games, Nero, Kaspersky antivirus, and much more. All of these cracks and keygens have what is called "cloaked malware," which is a form of spyware or viruses or trojans that hide themselves inside the keygen or crack files. Most hacks for games that come in the form of a program or installer, will also be infected. It is the opportunity for attackers to present a seemingly safe situation where the opportunity to steal something is in play, while the malware infects your system in the process. Yes, it will install what you were looking for, but also allow malware to potentially take control of your computer.

        Lastly, it is illegal. I will counsel you that we do not report such incidents. However, it is not good practice to pirate software.
        ***************************************************
        I'd like to scan your machine with ESET OnlineScan

        •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
        ESET OnlineScan

        •Click the button.
        •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
        • Click on to download the ESET Smart Installer. Save it to your desktop.
        • Double click on the icon on your desktop.
        •Check
        •Click the button.
        •Accept any security warnings from your browser.
        • Leave the check mark next to Remove found threats.
        •Check
        •Push the Start button.
        •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
        •When the scan completes, push
        •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
        •Push the button.
        •Push
        A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
        Windows 8 and Windows 10 dual boot with two SSD's

        ZGK

          Topic Starter


          Starter

          • Experience: Familiar
          • OS: Windows XP
          Re: Computer was hijacked by "File Recovery" program
          « Reply #6 on: July 20, 2013, 06:48:29 PM »
          I ran RogueKiller again and delete those items. I downloaded the ESET Smart Installer and when I pressed Start so it can download updates it says "Can not get update. Is proxy configured?" I am connect to the internet through an Ethernet cable and I should not have a proxy. This is preventing me from completing the installation.

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: Computer was hijacked by "File Recovery" program
          « Reply #7 on: July 20, 2013, 07:45:42 PM »
          Please try this one.

          Run the BitDefender Online scanner

          Agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files.

          Once Bitdefender completes the scan:
          Click-on the Detected Problems tab.
          Then select Click here to export the scan report.

          When the window comes up to save the report, change the Save as type: box to:
          Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save.

          This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later).
          This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

          If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.

          Post the bdscan.txt file as an Attachment.
          Windows 8 and Windows 10 dual boot with two SSD's