[Solved] Possible Infection or glitch

Yes the link worked. Will take a few day.

Thank you again.

 

Nope worse now I hardly able to stay logged in here to post.

Once booted I cannot log back in have to clear everything and sometime that does not work.

 

Is there a reason you have this driver disabled.? If not, you need to open Device Manager right-click on them and click Enable.

Have you ever use Internet Explorer 10 in Windows 7 ?

 

Ya it is bluetooth just not using it at the time. When I use it I have it on.

yes.

 

Let's check for one more thing. As some software that can be causing problems.Java some older versions is one example

Download Security Check

http://www.bleepingcomputer.com/download/securitycheck/

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Adobe Reader XI
````````Process Check: objlist.exe by Laurent````````
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

 

Security Check and FRST shows

make sure Windows Defender ( Antivirus) is updating. The culprit is not malware. Or IE IMO... Perhaps it's a LAN driver or router/modem. You might want to reset your router/modem but not a hard reset. Have you never tried this when these issues began?

 

Just checked the past update information and it show several successful updates. One or two not then does them later and they come in.

Yes I have reset to factory and rebooted and it does help for a bit but after a while it starts again. No LAN it is WAN. I have already R and R the drivers and configuration.

 

There's one tool (ComboFix) I don't like to use it, unless there's something deeply hidden. If you like we can give it a shot.

Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

 

Will run Combofix next time I can get access to the system.

On April 9th, 2016 I did a Press "Restore WiFi Settings" to activate your Gateway Default Settings for WiFi only. Only your WiFi settings will be lost.
Re put in my WiFi name and password. The one thing that I noticed is that Channel Select it set to automatic.

Channel Selection: Channel to be used for your home WiFi network. In Automatic mode (default), the Gateway will select the channel with the least amount of WiFi interference. In Manual mode, you can choose the channel to be used.

Could having the channel set to automatic be the cause yet it just started happening and only on that system. Yet it has always been automatic and nothing else is affected just IE.

 

No automatic will take care of it that's not the problem there I was thinking the same thing at one point.

 

ComboFix


ComboFix 16-04-06.01 - Loretta 04/11/2016 11:21:18.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.2757 [GMT -6:00]

Running from: c:\users\Loretta\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\ntuser.pol

c:\windows\inf\autorun.inf

c:\windows\inf\win32

c:\windows\inf\win32\0x0404.ini

c:\windows\inf\win32\0x0405.ini

c:\windows\inf\win32\0x0406.ini

c:\windows\inf\win32\0x0407.ini

c:\windows\inf\win32\0x0408.ini

c:\windows\inf\win32\0x0409.ini

c:\windows\inf\win32\0x040a.ini

c:\windows\inf\win32\0x040b.ini

c:\windows\inf\win32\0x040c.ini

c:\windows\inf\win32\0x040e.ini

c:\windows\inf\win32\0x0410.ini

c:\windows\inf\win32\0x0411.ini

c:\windows\inf\win32\0x0412.ini

c:\windows\inf\win32\0x0413.ini

c:\windows\inf\win32\0x0414.ini

c:\windows\inf\win32\0x0415.ini

c:\windows\inf\win32\0x0416.ini

c:\windows\inf\win32\0x0418.ini

c:\windows\inf\win32\0x0419.ini

c:\windows\inf\win32\0x041a.ini

c:\windows\inf\win32\0x041d.ini

c:\windows\inf\win32\0x041f.ini

c:\windows\inf\win32\0x0804.ini

c:\windows\inf\win32\0x0816.ini

c:\windows\inf\win32\1028.mst

c:\windows\inf\win32\1029.mst

c:\windows\inf\win32\1030.mst

c:\windows\inf\win32\1031.mst

c:\windows\inf\win32\1032.mst

c:\windows\inf\win32\1033.mst

c:\windows\inf\win32\1034.mst

c:\windows\inf\win32\1035.mst

c:\windows\inf\win32\1036.mst

c:\windows\inf\win32\1038.mst

c:\windows\inf\win32\1040.mst

c:\windows\inf\win32\1041.mst

c:\windows\inf\win32\1042.mst

c:\windows\inf\win32\1043.mst

c:\windows\inf\win32\1044.mst

c:\windows\inf\win32\1045.mst

c:\windows\inf\win32\1046.mst

c:\windows\inf\win32\1048.mst

c:\windows\inf\win32\1049.mst

c:\windows\inf\win32\1050.mst

c:\windows\inf\win32\1053.mst

c:\windows\inf\win32\1055.mst

c:\windows\inf\win32\2052.mst

c:\windows\inf\win32\2070.mst

c:\windows\inf\win32\BBalloon.dll

c:\windows\inf\win32\brcmVista\bcbthid32.cat

c:\windows\inf\win32\brcmVista\bcbthid32.inf

c:\windows\inf\win32\brcmVista\bcbtums-win7x86-brcm.cat

c:\windows\inf\win32\brcmVista\Bcbtums-Win7x86-brcm.inf

c:\windows\inf\win32\brcmVista\btusbflt.sys

c:\windows\inf\win32\brcmVista\DPInst.exe

c:\windows\inf\win32\brcmWin7\bcbthid32.cat

c:\windows\inf\win32\brcmWin7\bcbthid32.inf

c:\windows\inf\win32\brcmWin7\bcbtums-win7x86-brcm.cat

c:\windows\inf\win32\brcmWin7\Bcbtums-Win7x86-brcm.inf

c:\windows\inf\win32\brcmWin7\btusbflt.sys

c:\windows\inf\win32\brcmWin7\DPInst.exe

c:\windows\inf\win32\BtSetup.dll

c:\windows\inf\win32\BTW.msi

c:\windows\inf\win32\btw_ci.dll

c:\windows\inf\win32\btwaudio.cat

c:\windows\inf\win32\btwaudio.inf

c:\windows\inf\win32\btwaudio.sys

c:\windows\inf\win32\btwavdt.cat

c:\windows\inf\win32\btwavdt.inf

c:\windows\inf\win32\btwavdt.sys

c:\windows\inf\win32\btwl2cap.cat

c:\windows\inf\win32\btwl2cap.inf

c:\windows\inf\win32\BTWL2CAP.sys

c:\windows\inf\win32\BtwMM.exe

c:\windows\inf\win32\btwprofpack.dll

c:\windows\inf\win32\btwrchid.cat

c:\windows\inf\win32\btwrchid.inf

c:\windows\inf\win32\btwrchid.sys

c:\windows\inf\win32\BtwRSupport.dll

c:\windows\inf\win32\Data1.cab

c:\windows\inf\win32\Inst.exe

c:\windows\inf\win32\instmsia.exe

c:\windows\inf\win32\instmsiw.exe

c:\windows\inf\win32\Setup.exe

c:\windows\inf\win32\Setup.ini

c:\windows\inf\win32\svcpack\SvcPack.ini

.

.

((((((((((((((((((((((((( Files Created from 2016-03-11 to 2016-04-11 )))))))))))))))))))))))))))))))

.

.

2074-05-19 00:44 . 2008-03-21 21:46 607296 ----a-w- c:\program files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll

2074-05-08 01:38 . 2006-11-22 03:48 203576 ------w- c:\program files (x86)\Microsoft Games\Age of Empires III\autopatcher2.exe

2016-04-10 18:46 . 2016-03-28 18:07 11686560 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E091DCB7-CED1-4DC1-BF7A-50DF39F654D7}\mpengine.dll

2016-04-10 03:40 . 2016-04-10 03:40 -------- d-----w- C:\$Windows.~WS

2016-03-31 03:31 . 2016-03-31 03:31 -------- d--h--w- c:\windows\AxInstSV

2016-03-30 18:45 . 2016-03-30 18:45 -------- dc----w- c:\programdata\Malwarebytes

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2016-04-07 17:21 . 2016-01-21 20:08 797376 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2016-04-07 17:21 . 2016-01-21 20:08 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2016-03-09 02:00 . 2009-11-06 20:08 143659408 ----a-w- c:\windows\system32\MRT.exe

2016-02-19 19:02 . 2016-03-04 19:58 38336 ----a-w- c:\windows\system32\CompatTelRunner.exe

2016-02-19 18:54 . 2016-03-04 19:58 1168896 ----a-w- c:\windows\system32\aeinv.dll

2016-02-19 14:07 . 2016-03-04 19:58 1373184 ----a-w- c:\windows\system32\appraiser.dll

2016-02-12 18:52 . 2016-03-04 19:58 98816 ----a-w- c:\windows\system32\wudriver.dll

2016-02-12 18:52 . 2016-03-04 19:58 3169792 ----a-w- c:\windows\system32\wucltux.dll

2016-02-12 18:52 . 2016-03-04 19:58 192512 ----a-w- c:\windows\system32\wuwebv.dll

2016-02-12 18:44 . 2016-03-04 19:58 91136 ----a-w- c:\windows\system32\WinSetupUI.dll

2016-02-12 18:39 . 2016-03-04 19:58 174080 ----a-w- c:\windows\SysWow64\wuwebv.dll

2016-02-12 18:22 . 2016-03-04 19:58 2610688 ----a-w- c:\windows\system32\wuaueng.dll

2016-02-12 18:19 . 2016-03-04 19:58 709120 ----a-w- c:\windows\system32\wuapi.dll

2016-02-12 18:18 . 2016-03-04 19:58 37888 ----a-w- c:\windows\system32\wuapp.exe

2016-02-12 18:18 . 2016-03-04 19:58 140288 ----a-w- c:\windows\system32\wuauclt.exe

2016-02-12 18:18 . 2016-03-04 19:58 36864 ----a-w- c:\windows\system32\wups.dll

2016-02-12 18:18 . 2016-03-04 19:58 37888 ----a-w- c:\windows\system32\wups2.dll

2016-02-12 18:18 . 2016-03-04 19:58 12288 ----a-w- c:\windows\system32\wu.upgrade.ps.dll

2016-02-12 18:06 . 2016-03-04 19:58 573440 ----a-w- c:\windows\SysWow64\wuapi.dll

2016-02-12 18:05 . 2016-03-04 19:58 93696 ----a-w- c:\windows\SysWow64\wudriver.dll

2016-02-12 18:05 . 2016-03-04 19:58 30208 ----a-w- c:\windows\SysWow64\wups.dll

2016-02-12 18:05 . 2016-03-04 19:58 35328 ----a-w- c:\windows\SysWow64\wuapp.exe

2016-02-11 18:56 . 2016-03-09 01:54 5572032 ----a-w- c:\windows\system32\ntoskrnl.exe

2016-02-11 18:56 . 2016-03-09 01:53 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2016-02-11 18:56 . 2016-03-09 01:53 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2016-02-11 18:52 . 2016-03-09 01:54 1733592 ----a-w- c:\windows\system32\ntdll.dll

2016-02-11 18:49 . 2016-03-09 01:53 362496 ----a-w- c:\windows\system32\wow64win.dll

2016-02-11 18:49 . 2016-03-09 01:53 243712 ----a-w- c:\windows\system32\wow64.dll

2016-02-11 18:49 . 2016-03-09 01:53 13312 ----a-w- c:\windows\system32\wow64cpu.dll

2016-02-11 18:49 . 2016-03-09 01:53 215040 ----a-w- c:\windows\system32\winsrv.dll

2016-02-11 18:49 . 2016-03-09 01:53 210432 ----a-w- c:\windows\system32\wdigest.dll

2016-02-11 18:49 . 2016-03-09 01:53 86528 ----a-w- c:\windows\system32\TSpkg.dll

2016-02-11 18:49 . 2016-03-09 01:53 135680 ----a-w- c:\windows\system32\sspicli.dll

2016-02-11 18:49 . 2016-03-09 01:53 28672 ----a-w- c:\windows\system32\sspisrv.dll

2016-02-11 18:48 . 2016-03-09 01:53 503808 ----a-w- c:\windows\system32\srcore.dll

2016-02-11 18:48 . 2016-03-09 01:53 50176 ----a-w- c:\windows\system32\srclient.dll

2016-02-11 18:48 . 2016-03-09 01:53 28160 ----a-w- c:\windows\system32\secur32.dll

2016-02-11 18:48 . 2016-03-09 01:54 344064 ----a-w- c:\windows\system32\schannel.dll

2016-02-11 18:48 . 2016-03-09 01:54 1214464 ----a-w- c:\windows\system32\rpcrt4.dll

2016-02-11 18:47 . 2016-03-09 01:53 16384 ----a-w- c:\windows\system32\ntvdm64.dll

2016-02-11 18:45 . 2016-03-09 01:53 312320 ----a-w- c:\windows\system32\ncrypt.dll

2016-02-11 18:45 . 2016-03-09 01:53 315392 ----a-w- c:\windows\system32\msv1_0.dll

2016-02-11 18:45 . 2016-03-09 01:53 60416 ----a-w- c:\windows\system32\msobjs.dll

2016-02-11 18:45 . 2016-03-09 01:53 146432 ----a-w- c:\windows\system32\msaudite.dll

2016-02-11 18:44 . 2016-03-09 01:54 3994560 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2016-02-11 18:44 . 2016-03-09 01:54 3938240 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2016-02-11 18:44 . 2016-03-09 01:54 1461248 ----a-w- c:\windows\system32\lsasrv.dll

2016-02-11 18:44 . 2016-03-09 01:54 730112 ----a-w- c:\windows\system32\kerberos.dll

2016-02-11 18:44 . 2016-03-09 01:53 422400 ----a-w- c:\windows\system32\KernelBase.dll

2016-02-11 18:44 . 2016-03-09 01:53 1163264 ----a-w- c:\windows\system32\kernel32.dll

2016-02-11 18:42 . 2016-03-09 01:53 43520 ----a-w- c:\windows\system32\csrsrv.dll

2016-02-11 18:42 . 2016-03-09 01:53 43520 ----a-w- c:\windows\system32\cryptbase.dll

2016-02-11 18:42 . 2016-03-09 01:53 22016 ----a-w- c:\windows\system32\credssp.dll

2016-02-11 18:41 . 2016-03-09 01:53 6656 ----a-w- c:\windows\system32\apisetschema.dll

2016-02-11 18:41 . 2016-03-09 01:53 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2016-02-11 18:41 . 2016-03-09 01:53 880128 ----a-w- c:\windows\system32\advapi32.dll

2016-02-11 18:41 . 2016-03-09 01:53 686080 ----a-w- c:\windows\system32\adtschema.dll

2016-02-11 18:41 . 2016-03-09 01:53 1314328 ----a-w- c:\windows\SysWow64\ntdll.dll

2016-02-11 18:38 . 2016-03-09 01:53 665088 ----a-w- c:\windows\SysWow64\rpcrt4.dll

2016-02-11 18:38 . 2016-03-09 01:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2016-02-11 18:38 . 2016-03-09 01:53 5120 ----a-w- c:\windows\SysWow64\wow32.dll

2016-02-11 18:38 . 2016-03-09 01:53 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll

2016-02-11 18:38 . 2016-03-09 01:53 171520 ----a-w- c:\windows\SysWow64\wdigest.dll

2016-02-11 18:38 . 2016-03-09 01:53 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll

2016-02-11 18:37 . 2016-03-09 01:53 43008 ----a-w- c:\windows\SysWow64\srclient.dll

2016-02-11 18:37 . 2016-03-09 01:53 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2016-02-11 18:37 . 2016-03-09 01:54 251392 ----a-w- c:\windows\SysWow64\schannel.dll

2016-02-11 18:35 . 2016-03-09 01:53 223232 ----a-w- c:\windows\SysWow64\ncrypt.dll

2016-02-11 18:35 . 2016-03-09 01:53 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll

2016-02-11 18:35 . 2016-03-09 01:53 60416 ----a-w- c:\windows\SysWow64\msobjs.dll

2016-02-11 18:34 . 2016-03-09 01:53 146432 ----a-w- c:\windows\SysWow64\msaudite.dll

2016-02-11 18:33 . 2016-03-09 01:54 553472 ----a-w- c:\windows\SysWow64\kerberos.dll

2016-02-11 18:31 . 2016-03-09 01:53 17408 ----a-w- c:\windows\SysWow64\credssp.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2009-05-16 380928]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2015-12-14 1085656]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableSecureUIAPath"= 1 (0x1)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

R3 bcbtums;Bluetooth USB LD Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]

R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]

R3 btwampfl;btwampfl;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 MDA_NTDRV;MDA_NTDRV;c:\windows\system32\MDA_NTDRV.sys;c:\windows\SYSNATIVE\MDA_NTDRV.sys [x]

R3 PSMounterEx;Macrium Reflect Image Explorer Driver;c:\windows\system32\drivers\psmounterex.sys;c:\windows\SYSNATIVE\drivers\psmounterex.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 BcmBtRSupport;Bluetooth Driver Management Service;c:\windows\system32\BtwRSupportService.exe;c:\windows\SYSNATIVE\BtwRSupportService.exe [x]

S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe;c:\program files\Macrium\Reflect\ReflectService.exe [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 t3;Sound Blaster X-Fi Xtreme Audio;c:\windows\system32\drivers\t3.sys;c:\windows\SYSNATIVE\drivers\t3.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2013-01-16 18:46 454176 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2016-04-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-21 17:21]

.

.

--------- X64 Entries -----------

.

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

DPF: {28AF57CC-DD0B-4166-92C3-5F8F7F8C8ABA} - hxxp://www.digitalworkshop.com/OpusPlugins/ilm500.cab

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-20951211.sys

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_21_0_0_213_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_21_0_0_213_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_21_0_0_213_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_21_0_0_213_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_21_0_0_213.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.21"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_21_0_0_213.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_21_0_0_213.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_21_0_0_213.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]

@Denied: (A 2) (Everyone)

@="IFlashBroker6"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*]

"v5Licence0"="35-RCB7-ZCTE-N72E-MHC1-NHV7-P5SYATS"

"Activated"="Y"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

.

**************************************************************************

.

Completion time: 2016-04-11 11:35:22 - machine was rebooted

ComboFix-quarantined-files.txt 2016-04-11 17:35

.

Pre-Run: 533,152,636,928 bytes free

Post-Run: 533,191,221,248 bytes free

.

- - End Of File - - 5B84F87DF8E56AD7563A238924F102D4

9A8A3170E20FE01EE5B7A41AB0CAE110

 

OK Rusty, sorry for the delay again another busy week let me look at this report. I see a lot of files were cleaned up that were older files inside the folders that was not really is not malware just tidy things up. So, either tonight or tomorrow night let me look at things the one more time and see what we're looking at.

 

Not a problem I full understand how demanding work can be.

 

One last question, do you have Microsoft .NET Framework 4.6 installed?
If not this could be an issue with IE... visit http://www.askvg.com/what-is-microsoft-net-framework-download-links-for-all-versions-inside/
for 64 bit NET Framework 4.6


Please read this
NET Framework problems with Internet Explorer 11

https://technet.microsoft.com/en-us...roblems-with-ie11?f=255&MSPPError=-2147217396

 

Yes showing it was installed with the last batch of updates on April 12, 2016.

 

Since it was installed yesterday have you rebooted your computer if not please do so. And is there any changes since that's been done or is it too early to tell?

 

To early to tell...
Will reboot and let you know.

 

This might be the ticket if not I got one more item in my hip pocket to try......

 

Rusty if you don't mind. I know we ran SecurityCheck, but this tool will give us more infromation. I like to look at something. We'll clean all the tools that was used after we are done, If we never get there....

Please download Security Analysis by Rocket Grannie from here

• Save it to your Desktop.
• Close your security software to avoid potential conflicts.
• Double click RGSA.exe
• Click OK on the copyright-disclaimer
• It will produce a log named SALog.txt on the Desktop or in the same folder from where the tool is run if installed elsewhere.
• Please copy and paste the contents of that log in this topic.

Note: The link to the most current version of the program will always be in the first post of this topic.
Note: Windows 10 may pop up a warning message.
Note: The current java version on XP will show as "out of date".
Note: Flash Player ActiveX is pre-installed with Internet Explorer in Windows 10 and updates Automatically.