Mortifier

i will reinstall it once this is all done. I'm going to retire for now, i need to get some sleep.

well unfortunatley it deleted my avg do not track which is the only thing i left of avg secure search, I really liked that addon.... # AdwCleaner v2.104 - Logfile created 01/04/2013 at 16:09:33 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Erik - ERIK-VAIO # Boot Mode : Normal # Running from : C:\Users\Erik\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** Stopped & Deleted : WajamUpdater ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search Folder Deleted : C:\Program Files (x86)\AVG Secure Search Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\ProgramData\AVG Secure Search Folder Deleted : C:\ProgramData\Partner Folder Deleted : C:\Users\Erik\AppData\Local\APN Folder Deleted : C:\Users\Erik\AppData\Local\AVG Secure Search Folder Deleted : C:\Users\Erik\AppData\Local\Conduit Folder Deleted : C:\Users\Erik\AppData\LocalLow\AVG Secure Search Folder Deleted : C:\Users\Erik\AppData\LocalLow\boost_interprocess Folder Deleted : C:\Users\Erik\AppData\LocalLow\Conduit Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} ***** [Registry] ***** Key Deleted : HKCU\Software\APN Key Deleted : HKCU\Software\AVG Secure Search Key Deleted : HKCU\Software\IGearSettings Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\Wajam Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\Software\APN Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9 Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={31656C56-8DB5-4EB7-8486-8A5BC5C80537}&mid=8c087e22962747d0ad32850b0fedfd0c-fe5d6839176ba86ff95409436d43bc04d03853a7〈=en&ds=gm011&pr=sa&d=2012-05-17 13:35:18&v=12.2.5.32&sap=hp --> hxxp://www.google.com -\\ Google Chrome v23.0.1271.97 File : C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [8483 octets] - [04/01/2013 04:10:24] AdwCleaner[R2].txt - [8543 octets] - [04/01/2013 16:09:21] AdwCleaner[s2].txt - [8418 octets] - [04/01/2013 16:09:33] ########## EOF - C:\AdwCleaner[s2].txt - [8478 octets] ########## next log Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Windows Firewall Enabled! avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` McAfee SiteAdvisor Malwarebytes Anti-Malware version 1.70.0.1100 Adobe Flash Player 10 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 Google Chrome 23.0.1271.91 Google Chrome 23.0.1271.95 Google Chrome 23.0.1271.97 ````````Process Check: objlist.exe by Laurent```````` AVAST Software Avast AvastSvc.exe AVAST Software Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 5% ````````````````````End of Log``````````````````````

AdwCleanerR1.txt

here you go doesnt look like i got any adware, im usually good at removing it right away AdwCleanerR1.txt

You sir are a gentleman and a scholar, my screen hasn't once flickered since svchost.exe got removed, its been mining bitcoins with my gpu and/or cpu and that's made me think my power supply is damaged and my laptop has come to its end. ComboFix.txt

Many thanks sir that nasty bug is gone at last! I just realized that these are the malwarebytes forums, i ddint even notice. can you give me anything on rundll32 which ive asked earlier? maybe im just paranoid but it really shouldnt have a page icon or? and what about the RK quarantine folder? can i safely delete all the files in it? i suspect i shouldnt be keeping roguekiller as it can lead me to deleting important files but im going to stick with the rootkit remover for a while longer, is there any other software you can recommend me that gets rid of nasty infections that dont show up on my antivirus? I am forever greatful. mbar-log-2013-01-04 (01-36-55).txt system-log.txt

roguekiller report RogueKiller V8.4.2 [Dec 31 2012] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Erik [Admin rights] Mode : Scan -- Date : 01/04/2013 00:44:27 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 4 ¤¤¤ [RUN][sUSP PATH] HKLM\[...]\Wow6432Node\Run : Adobe (C:\ProgramData\Adobe\1A1E3A.vbe) -> FOUND [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (109.171.3.191:80) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: TOSHIBA MK3265GSX +++++ --- User --- [MBR] 298065d124ea9f8c8d79cb35b374d373 [bSP] 6eb07ea6fc3ceb1b2edcb57337305939 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10306 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21108736 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21313536 | Size: 294837 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_01042013_02d0044.txt >> RKreport[1]_S_01042013_02d0044.txt

here are the logs i took just now DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: Run by Erik at 0:37:47 on 2013-01-04 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.6126.4595 [GMT 0:00] . AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\AVAST Software\Avast\AvastSvc.exe C:\Windows\system32\WLANExt.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k apphost C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\ProgramData\DatacardService\HWDeviceService64.exe C:\ProgramData\DatacardService\DCSHelper.exe c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\rundll32.exe c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe C:\Program Files\Sony\VAIO Smart Network\VSNService.exe C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe C:\Windows\SysWOW64\DllHost.exe C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe C:\Windows\system32\svchost.exe -k iissvcs C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe C:\Program Files\Sony\VAIO Power Management\SPMService.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe C:\Program Files\Sony\VAIO Update\VUAgent.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Program Files\Sony\VAIO Care\VCPerfService.exe C:\Program Files\Sony\VAIO Care\VCsystray.exe C:\Program Files\Sony\VAIO Care\VCService.exe C:\Program Files\Sony\VAIO Care\VCAgent.exe C:\Windows\System32\vds.exe C:\Windows\SysWOW64\ctfmon.exe C:\Program Files\Sony\VAIO Care\Admload.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxps://isearch.avg.com/?cid={31656C56-8DB5-4EB7-8486-8A5BC5C80537}&mid=8c087e22962747d0ad32850b0fedfd0c-fe5d6839176ba86ff95409436d43bc04d03853a7〈=en&ds=gm011&pr=sa&d=2012-05-17 13:35:18&v=12.2.5.32&sap=hp uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01 uProxyServer = 109.171.3.191:80 uURLSearchHooks: {00000000-6E41-4FD3-8538-502F5495E5FC} - <orphaned> uURLSearchHooks: {687578b9-7132-4a7a-80e4-30ee31099e03} - <orphaned> uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll mWinlogon: Userinit = userinit.exe, BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file> TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun mRun: [iSBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" mRun: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui mRun: [Adobe] C:\ProgramData\Adobe\1A1E3A.vbe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-Explorer: HideSCAHealth = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} TCP: NameServer = 192.168.1.1 192.168.1.1 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A} : DHCPNameServer = 192.168.1.1 192.168.1.1 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244564F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244575966496 : DHCPNameServer = 192.168.22.22 192.168.22.23 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244575966496D277964786D264F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\3375962756C6563737D2D4F64656D6D246362673 : DHCPNameServer = 192.168.1.1 192.168.1.1 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\33D4F62696C65675966496D253531663 : DHCPNameServer = 192.168.1.1 192.168.1.1 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\6796277696E6D65646961673139353333363 : DHCPNameServer = 194.168.4.100 194.168.8.100 TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\8656E6E65637379713 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{BB8C9484-BDD0-485F-9085-847F9BF303D0} : DHCPNameServer = 192.168.1.254 TCP: Interfaces\{F503C021-1873-4F53-834D-88F21623C22B} : DHCPNameServer = 192.168.1.1 192.168.1.1 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll Notify: VESWinlogon - VESWinlogon.dll SSODL: WebCheck - <orphaned> x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - LocalServer32 - <no file> x64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 x64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-2-29 55856] R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-2-29 984144] R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-2-29 370288] R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-8-29 30568] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-3-8 283200] R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2012-2-29 25232] R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-2-29 71600] R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-11-13 44808] R2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe [2011-3-14 346976] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2012-12-22 103472] R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224] R2 rimspci;rimspci;C:\Windows\System32\drivers\rimssne64.sys [2009-11-23 93696] R2 risdsnpe;risdsnpe;C:\Windows\System32\drivers\risdsne64.sys [2012-4-16 76800] R2 SampleCollector;VAIO Care Performance Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2012-3-2 259192] R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2012-2-29 104960] R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2012-2-29 845312] R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-8 711112] R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2012-2-29 19968] R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\drivers\ew_jubusenum.sys [2012-12-30 86016] R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2009-11-23 151040] R3 NETwNv64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETwNv64.sys [2012-4-16 8388096] R3 RzSynapse;Razer Driver;C:\Windows\System32\drivers\RzSynapse.sys [2011-11-15 126464] R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2009-11-23 11392] R3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2012-2-29 571248] R3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2012-3-2 44736] R3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update\VUAgent.exe [2012-12-30 1286784] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2012-4-16 402720] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 McShield;McAfee Real-time Scanner; [x] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944] S2 WajamUpdater;WajamUpdater;"C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" --> C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [?] S3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2009-11-23 52264] S3 DirMngr;DirMngr;C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [2011-3-2 224256] S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\drivers\ew_hwusbdev.sys [2012-12-30 117248] S3 ew_usbenumfilter;huawei_CompositeFilter;C:\Windows\System32\drivers\ew_usbenumfilter.sys [2012-12-30 13952] S3 ewusbmbb;HUAWEI USB-WWAN miniport;C:\Windows\System32\drivers\ewusbwwan.sys [2012-12-30 421376] S3 huawei_cdcacm;huawei_cdcacm;C:\Windows\System32\drivers\ew_jucdcacm.sys [2012-12-30 98816] S3 huawei_cdcecm;huawei_cdcecm;C:\Windows\System32\drivers\ew_jucdcecm.sys [2012-12-30 69632] S3 huawei_ext_ctrl;huawei_ext_ctrl;C:\Windows\System32\drivers\ew_juextctrl.sys [2012-12-30 28672] S3 McSysmon;McAfee SystemGuards; [x] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2009-9-15 6952960] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-3-4 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-3-3 1255736] S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464] . =============== Created Last 30 ================ . 2013-01-03 06:41:32 -------- d-----w- C:\Users\Erik\AppData\Roaming\Malwarebytes 2013-01-03 06:41:15 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys 2013-01-03 06:41:15 -------- d-----w- C:\ProgramData\Malwarebytes 2013-01-03 06:41:14 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-02 19:12:19 -------- d-sh--w- C:\ProgramData\SecuROM 2013-01-02 18:52:36 -------- d-----w- C:\Program Files (x86)\JoWooD Entertainment AG 2013-01-02 14:46:31 -------- d-----w- C:\Users\Erik\AppData\Roaming\NVIDIA 2012-12-31 06:38:02 -------- d-----w- C:\ProgramData\SecTaskMan 2012-12-30 19:50:38 98816 ----a-w- C:\Windows\System32\drivers\ew_jucdcacm.sys 2012-12-30 19:50:38 86016 ----a-w- C:\Windows\System32\drivers\ew_jubusenum.sys 2012-12-30 19:50:38 69632 ----a-w- C:\Windows\System32\drivers\ew_jucdcecm.sys 2012-12-30 19:50:38 421376 ----a-w- C:\Windows\System32\drivers\ewusbwwan.sys 2012-12-30 19:50:38 32768 ----a-w- C:\Windows\System32\drivers\ewdcsc.sys 2012-12-30 19:50:38 28672 ----a-w- C:\Windows\System32\drivers\ew_juextctrl.sys 2012-12-30 19:50:38 221312 ----a-w- C:\Windows\System32\drivers\ewusbmdm.sys 2012-12-30 19:50:38 22016 ----a-w- C:\Windows\System32\drivers\ew_hwupgrade.sys 2012-12-30 19:50:38 212992 ----a-w- C:\Windows\System32\drivers\ew_juwwanecm.sys 2012-12-30 19:50:38 13952 ----a-w- C:\Windows\System32\drivers\ew_usbenumfilter.sys 2012-12-30 19:50:38 117248 ----a-w- C:\Windows\System32\drivers\ew_hwusbdev.sys 2012-12-30 19:50:38 1001472 ----a-w- C:\Windows\System32\drivers\mod7700.sys 2012-12-30 02:15:04 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr 2012-12-30 02:14:57 -------- d-----w- C:\Users\Erik\AppData\Local\PunkBuster 2012-12-30 02:14:27 -------- d-----w- C:\ProgramData\Orbit 2012-12-30 02:06:27 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0 2012-12-28 19:36:43 -------- d-----w- C:\ProgramData\NVIDIA Corporation 2012-12-28 19:34:01 -------- d-----w- C:\NVIDIA 2012-12-28 19:12:54 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation 2012-12-28 19:12:40 890216 ----a-w- C:\Windows\System32\nvvsvc.exe 2012-12-28 19:12:40 63336 ----a-w- C:\Windows\System32\nvshext.dll 2012-12-28 19:12:40 6223208 ----a-w- C:\Windows\System32\nvcpl.dll 2012-12-28 19:12:40 3311464 ----a-w- C:\Windows\System32\nvsvc64.dll 2012-12-28 19:12:40 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll 2012-12-28 19:12:40 118120 ----a-w- C:\Windows\System32\nvmctray.dll 2012-12-28 19:12:02 60776 ----a-w- C:\Windows\System32\OpenCL.dll 2012-12-28 19:12:02 52584 ----a-w- C:\Windows\SysWow64\OpenCL.dll 2012-12-27 15:06:12 -------- d-----w- C:\Users\Erik\AppData\Local\Razer 2012-12-25 19:52:38 -------- d-----w- C:\Users\Erik\AppData\Local\Ubisoft Game Launcher 2012-12-23 22:57:47 -------- d-----w- C:\Program Files (x86)\DreamCatcher 2012-12-22 22:34:52 -------- d-----w- C:\Program Files\McAfee 2012-12-22 03:00:34 46080 ----a-w- C:\Windows\System32\atmlib.dll 2012-12-22 03:00:34 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll 2012-12-22 03:00:33 367616 ----a-w- C:\Windows\System32\atmfd.dll 2012-12-22 03:00:32 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll 2012-12-16 01:13:02 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2012-12-16 01:13:02 2048 ----a-w- C:\Windows\System32\tzres.dll 2012-12-16 01:01:03 -------- d-----w- C:\Users\Erik\AppData\Local\ElevatedDiagnostics 2012-12-12 13:38:01 81 ----a-w- C:\Program Files (x86)\update-dead-island.bat 2012-12-12 13:38:01 12212040 ----a-w- C:\Program Files (x86)\WMFDist11-WindowsXP.exe 2012-12-12 13:28:40 -------- d-----w- C:\Program Files (x86)\Dead Island Game of The Year Edition 2012-12-09 10:24:31 -------- d--h--w- C:\Program Files (x86)\Common Files\EAInstaller 2012-12-09 10:06:14 -------- d-----w- C:\Program Files (x86)\Mass Effect 3 . ==================== Find3M ==================== . 2012-11-28 16:53:55 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll 2012-11-28 16:53:55 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2012-11-22 03:26:40 3149824 ----a-w- C:\Windows\System32\win32k.sys 2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll 2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll 2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll 2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-11-10 21:12:46 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll 2012-11-08 14:45:10 30568 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys 2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll 2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll 2012-10-30 22:51:55 984144 ----a-w- C:\Windows\System32\drivers\aswSnx.sys 2012-10-30 22:51:55 71600 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys 2012-10-30 22:51:07 41224 ----a-w- C:\Windows\avastSS.scr 2012-10-15 17:59:28 54072 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys . ============= FINISH: 0:38:10.14 =============== attach.txt

shall i run dds while svchost is active? ive curretly ended the process.

Hello, at first i saw posting on a forum as my last option but now im just getting desperate and cant afford to make a complete system restore. So I have this problem since lately my screen brightness has been flickering which at first i thought was a problem with the power supply (it started after i installed a few torrents), but since this never occurred while in safe mode or on the login screen i began to question my antivirus (avast) and started questioning the active processes in my task manager, there were two suspicious processes, one was svchost and the other was 3 instances of rundll32. Then I found this nice little program called malwarebytes anti malware which found svchost.exe in my %temp% folder and svchost.exe as active process and identified it as trojan, additionally virustotal.com identified it as bitcoinminer trojan. Unfortunately after removing it with malwarebytes it would restore itself upon a computer restart and ive tried a lot to get rid of it, ive deleted it manually, deleted all restore points and turned off system restore (i had no restore points prior to the incident) but to no avail. I hope you can and want to help me remove it and additionally id like to know wether having 3 instances of rundll32.exe running which cannot be ended in task manager and of which the applications in system 32 have a blank page as icon is potentially dangerous. (this was defined as corrupted rundll32 by several internet blogs i found on google) I'm ready to fully cooperate and post any logs you demand, but please dont let me download too much software as I am currently on mobile broadband. thankyou for your help!