Jump to content

klm

Members
  • Posts

    17
  • Joined

  • Last visited

Everything posted by klm

  1. I see.Thanks a lot for your help anyway.
  2. Yes,I get them when I use Firefox as well.
  3. Okay so I got 4 more of those pop-ups today;they were all inbound though...should I still be worried?
  4. A great help!Thank you very much!

  5. Results of screen317's Security Check version 0.99.89 Windows XP Service Pack 3 x86 Internet Explorer 6 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Please wait while WMIC compiles updated MOF files.d i s p l a y N a m e ECHO is off. A v i r a ECHO is off. D e s k t o p ECHO is off. Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` SUPERAntiSpyware JavaFX 2.1.1 Java 7 Update 71 Java version out of Date! Adobe Flash Player 15.0.0.189 Mozilla Firefox (33.0.2) Google Chrome 38.0.2125.104 Google Chrome 38.0.2125.111 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 20% Defragment your hard drive soon! (Do NOT defrag if SSD!) ````````````````````End of Log``````````````````````
  6. Do you mean if I keep getting those pop-ups or??If that's what you're asking,then no,I haven't got any since I reset Chrome.
  7. No suspicious programs were found...
  8. I have no idea what to think anymore.Today I've got several pop-ups as well,even though I wasn't on any suspicious sites and utorrent wasn't running either. mbam-protection-log-2014-11-03.txt
  9. Sorry.Here you go.zoek-results.log
  10. Done!Hope this will solve the problem.I'll update is something comes up.
  11. I already disabled utorrent and I didn't get any pop-ups for a while.But just now I went to this news site and I started getting pop-up after pop-up..but it's not the first time I'm visiting that site so why now?Is my computer vulnerable now all of a sudden or what? I also disabled all the extensions in Chrome,but the only change I've noticed is that it seems to work faster now.
  12. Google Chrome mbam-protection-log-2014-11-02.txt Also at the beginning of one of your replies I was advised to uninstall or disable peer-2-peer programs and I chose to fully uninstall it.But after everything settled I figured it was ok to install it again.And while I was using utorrent I realized that I started getting more and more pop-ups.So the problem that I'm having comes from using this program?
  13. Nope,it started again.7 attempts in the last minute and it keeps coming:ip address 91.188.50.208,port 0,outbound.
  14. It's ok now.I haven't got any other pop-ups,so I suppose everything is alright now. But what exactly happened?Last night before starting the thread the pop-ups just kept coming and coming,with different ip addresses everytime,both inbound and outbound(whatever that means).Was someone trying to access my computer or...? Thank you very much for helping me!
  15. AdwCleanerS0.txtJRT.txt As for the MBAM scan,no malicious items were found.
  16. Fixlog.txtTDSSKiller.3.0.0.41_01.11.2014_21.54.14_log.txtTDSSKiller.3.0.0.41_01.11.2014_21.40.35_log.txtTDSSKiller.3.0.0.41_01.11.2014_21.50.13_log.txtComboFix.txt
  17. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-11-2014 Ran by User (administrator) on INTELDUALCORE on 01-11-2014 20:20:12 Running from C:\Documents and Settings\User\Desktop Loaded Profiles: User & (Available profiles: User) Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States) Internet Explorer Version 6 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe (The Within Network, LLC) C:\WINDOWS\UnsignedThemesSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (BitTorrent Inc.) C:\Documents and Settings\User\Application Data\uTorrent\uTorrent.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [startCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2011-11-09] (Advanced Micro Devices, Inc.) HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [20065936 2012-06-06] (Realtek Semiconductor Corp.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-14] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [NCUpdateHelper] => C:\Program Files\NCWest\NCLauncher\NCUpdateHelper.exe HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKLM\...\Winlogon: [uIHost] C:\WINDOWS\system32\logonui.exe [514560 2008-04-14] (Microsoft Corporation) Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.) HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation) HKU\S-1-5-21-436374069-854245398-1801674531-1003\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6692632 2014-10-06] (SUPERAntiSpyware) HKU\S-1-5-21-436374069-854245398-1801674531-1003\...\Run: [Facebook Update] => "C:\Documents and Settings\User\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKU\S-1-5-21-436374069-854245398-1801674531-1003\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-21-436374069-854245398-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6692632 2014-10-06] (SUPERAntiSpyware) HKU\S-1-5-21-436374069-854245398-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Facebook Update] => "C:\Documents and Settings\User\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver HKU\S-1-5-21-436374069-854245398-1801674531-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-18\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Shortcut to rds bd.lnk ShortcutTarget: Shortcut to rds bd.lnk -> (No File) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome SearchScopes: HKLM - URL http://search.certified-toolbar.com?si=41460&bs=true&tid=2938&q={searchTerms} SearchScopes: HKLM - SuggestionsURL_JSON http://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=41460&gid=1&dbCode=1&command={searchTerms} SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=41460&bs=true&tid=2938&q={searchTerms} SearchScopes: HKCU - DefaultScope 3AC374FC-8DCB-4AE5-8637-483CDFE8E029 URL = http://searchou.com/q= SearchScopes: HKCU - URL http://search.certified-toolbar.com?si=41460&bs=true&tid=2938&q={searchTerms} SearchScopes: HKCU - SuggestionsURL_JSON http://api.widdit.com/suggestions/?format=ffplugin&ua=ie&src=addon&si=41460&gid=1&dbCode=1&command={searchTerms} SearchScopes: HKCU - 3AC374FC-8DCB-4AE5-8637-483CDFE8E029 URL = http://searchou.com/q= SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=41460&bs=true&tid=2938&q={searchTerms} BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {8d3ec233-b92d-4187-a506-284127cfba2d} - No File Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [113024 2011-07-19] (SuperAdBlocker.com) Tcpip\..\Interfaces\{C7262CFB-57EE-41AE-AD87-832E63F51CF0}: [NameServer] 193.231.252.1 213.154.124.1 FireFox: ======== FF ProfilePath: C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default FF DefaultSearchEngine: Google FF SelectedSearchEngine: Google FF Homepage: hxxp://google.com/ FF Keyword.URL: hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-yff27&p= FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Documents and Settings\User\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll No File FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\User\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\user.js FF Extension: Avira Browser Safety - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\abs@avira.com [2014-10-01] FF Extension: Big Clock Background - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\clocktab@vik.josh.xpi [2014-04-19] FF Extension: Heartbleed Notifier - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\heartbleed@dactyl.googlecode.com.xpi [2014-05-04] FF Extension: Heartbleed Monitor - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\jid1-eMhaOaq3SPBFDg@jetpack.xpi [2014-05-04] FF Extension: Stylish - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2013-07-27] FF Extension: Adblock Plus - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-19] FF Extension: Greasemonkey - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\15u5x17j.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-06-29] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\Documents and Settings\All Users\Application Data\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi Chrome: ======= CHR HomePage: Default -> hxxp://google.com/ CHR StartupUrls: Default -> "https://www.google.com/" CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default CHR Extension: (Duolingo Web) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2013-08-26] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24] CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-09] CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-09] CHR Extension: (Chromebleed) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eeoekjnjgppnaegdjbcafdggilajhpic [2014-04-10] CHR Extension: (Block site) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eiimnmioipafcokbfikbljfdeojpcgbh [2014-03-31] CHR Extension: (Stylish) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2014-07-18] CHR Extension: (Avira Browser Safety) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-12] CHR Extension: (XKit) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fpfgeeomkfdefkckijiabdbogjkdaecd [2014-07-18] CHR Extension: (AdBlock) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-25] CHR Extension: (Cool Clock) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icegcmhgphfkgglbljbkdegiaaihifce [2014-04-17] CHR Extension: (Image Search Options) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kljmejbpilkadikecejccebmccagifhl [2013-02-09] CHR Extension: (New Tab Clock) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ljpapphpgkmigobbbakmnfoohclifanm [2014-04-15] CHR Extension: (Casey Reas) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nijljpbmaieiejfcgahimekneppldbha [2014-03-16] CHR Extension: (Google Wallet) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22] CHR Extension: (Duolingo Test Center) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\peghfgbgbdfhiilhefhghjpghgkcbaon [2014-10-22] CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-09] CHR HKLM\...\Chrome\Extension: [21fb4c4d-8a40-45e8-9772-565851bb781a] - C:\Program Files\DownTango4SToolbar\chrome\DownTango4SToolbar.crx [] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-08-14] (SUPERAntiSpyware.com) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-14] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG) R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-10-18] (Oracle Corporation) R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [270336 2001-02-23] (Microsoft Corporation) [File not signed] R2 UnsignedThemes; C:\WINDOWS\UnsignedThemesSvc.exe [21096 2009-07-13] (The Within Network, LLC) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative) R3 AtiHDAudioService; C:\WINDOWS\System32\drivers\AtihdXP3.sys [100368 2011-10-17] (Advanced Micro Devices) R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [98160 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-10-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG) S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) R3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [54232 2014-11-01] (Malwarebytes Corporation) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [114904 2014-11-01] (Malwarebytes Corporation) S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.) S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) S3 RT73; C:\WINDOWS\System32\DRIVERS\rt73.sys [476544 2009-07-17] (Ralink Technology, Corp.) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-02-25] (Avira GmbH) R2 uxpatch; C:\WINDOWS\system32\drivers\uxpatch.sys [25448 2009-07-13] () S3 ALSysIO; \??\C:\DOCUME~1\User\LOCALS~1\Temp\ALSysIO.sys [X] S4 IntelIde; No ImagePath U4 vsserv; No ImagePath S3 vvftav211; system32\drivers\vvftav211.sys [X] U1 WS2IFSL; No ImagePath S3 zgwhsdiag; system32\DRIVERS\zgwhsdiag.sys [X] S3 zgwhsmdm; system32\DRIVERS\zgwhsmdm.sys [X] S3 zgwhsnmea; system32\DRIVERS\zgwhsnmea.sys [X] S3 ZSMC30x; System32\Drivers\ZS211.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-01 20:20 - 2014-11-01 20:20 - 00019553 _____ () C:\Documents and Settings\User\Desktop\FRST.txt 2014-11-01 20:20 - 2014-11-01 20:20 - 00000000 ____D () C:\FRST 2014-11-01 20:19 - 2014-11-01 20:19 - 01105920 _____ (Farbar) C:\Documents and Settings\User\Desktop\FRST.exe 2014-11-01 19:26 - 2014-11-01 20:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable) 2014-11-01 19:23 - 2014-11-01 20:01 - 00000000 ____D () C:\Documents and Settings\User\Desktop\mbar 2014-11-01 19:23 - 2014-11-01 19:23 - 14349744 _____ (Malwarebytes Corp.) C:\Documents and Settings\User\Desktop\mbar-1.07.0.1012.exe 2014-11-01 19:04 - 2014-11-01 19:04 - 00001851 _____ () C:\Documents and Settings\User\Desktop\Chrome App Launcher.lnk 2014-11-01 19:04 - 2014-11-01 19:04 - 00000000 ____D () C:\Documents and Settings\User\Start Menu\Programs\Google Chrome 2014-10-30 14:20 - 2014-10-30 14:20 - 00000783 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2014-10-30 09:04 - 2014-10-30 16:14 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-10-25 21:00 - 2014-10-25 21:01 - 00000000 ____D () C:\Documents and Settings\User\Desktop\1-am 2014-10-25 20:44 - 2009-06-03 11:59 - 00000000 ____D () C:\Documents and Settings\User\Desktop\Natsume Yuujinchou OST 2014-10-25 20:35 - 2014-10-25 20:46 - 00000000 ____D () C:\Documents and Settings\User\Desktop\SVWC-7611 2014-10-25 11:37 - 2014-10-25 23:13 - 00065536 _____ () C:\WINDOWS\system32\config\TuneUp.evt 2014-10-25 11:37 - 2014-10-25 11:37 - 00000000 ____D () C:\Documents and Settings\User\Local Settings\Application Data\TuneUp Software 2014-10-25 11:37 - 2014-10-25 11:37 - 00000000 ____D () C:\Documents and Settings\User\Application Data\TuneUp Software 2014-10-25 11:33 - 2014-10-25 11:37 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\TuneUp Software 2014-10-25 11:33 - 2014-10-25 11:33 - 00000000 __SHD () C:\Documents and Settings\All Users\Application Data\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-10-25 11:33 - 2014-10-25 11:33 - 00000000 ____D () C:\Documents and Settings\User\Application Data\RHEng 2014-10-25 11:32 - 2014-10-25 11:55 - 00000528 _____ () C:\Documents and Settings\User\Desktop\KMPlayer.lnk 2014-10-25 11:32 - 2014-10-25 11:32 - 00000000 ____D () C:\Documents and Settings\User\Start Menu\Programs\The KMPlayer 2014-10-24 15:57 - 2014-10-24 15:57 - 00000000 ____D () C:\Documents and Settings\User\My Documents\Gameforge Live 2014-10-18 16:32 - 2014-10-18 16:32 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-10-18 16:32 - 2014-10-18 16:32 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Java 2014-10-18 16:32 - 2014-10-18 16:31 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe 2014-10-18 16:32 - 2014-10-18 16:31 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe 2014-10-18 16:32 - 2014-10-18 16:31 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe 2014-10-18 16:32 - 2014-10-18 16:31 - 00145408 _____ (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl 2014-10-18 16:32 - 2014-10-18 16:31 - 00096680 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll 2014-10-18 16:31 - 2014-10-18 16:31 - 00000000 ____D () C:\Program Files\Java 2014-10-14 20:17 - 2014-10-14 20:17 - 00000864 _____ () C:\Documents and Settings\All Users\Desktop\Avira.lnk 2014-10-11 21:12 - 2014-10-11 21:12 - 05688862 _____ () C:\Documents and Settings\User\My Documents\de la ioana.mp4 2014-10-08 07:38 - 2014-10-08 08:04 - 00000000 ____D () C:\Documents and Settings\User\Desktop\accounts.TIC 2014-10-05 21:39 - 2014-10-05 21:39 - 00000000 ____D () C:\WINDOWS\system32\IPM ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-01 20:20 - 2014-06-07 17:14 - 00000994 _____ () C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-436374069-854245398-1801674531-1003UA.job 2014-11-01 20:20 - 2014-06-07 17:14 - 00000972 _____ () C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-436374069-854245398-1801674531-1003Core.job 2014-11-01 20:20 - 2012-05-09 19:38 - 00000000 ____D () C:\Documents and Settings\User\Application Data\uTorrent 2014-11-01 20:20 - 2012-05-09 12:14 - 00000000 ____D () C:\Documents and Settings\User\Local Settings\Temp 2014-11-01 19:59 - 2012-12-25 12:08 - 00000000 ____D () C:\KMPlayer 2014-11-01 19:59 - 2012-06-08 17:52 - 00007680 __SHC () C:\WINDOWS\Thumbs.db 2014-11-01 19:32 - 2012-05-09 12:34 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-11-01 19:24 - 2014-05-17 12:36 - 00054232 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-11-01 19:23 - 2012-06-13 16:51 - 00000886 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-01 18:26 - 2014-05-17 12:40 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-11-01 15:12 - 2014-09-29 19:52 - 00000000 ____D () C:\Documents and Settings\User\Desktop\school.stuff 2014-11-01 14:31 - 2012-06-13 16:51 - 00000882 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-01 14:31 - 2012-05-09 15:04 - 00000159 _____ () C:\WINDOWS\wiadebug.log 2014-11-01 14:31 - 2012-05-09 15:04 - 00000049 _____ () C:\WINDOWS\wiaservc.log 2014-11-01 14:31 - 2012-05-09 12:13 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-10-31 23:16 - 2014-08-13 23:22 - 00329082 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-436374069-854245398-1801674531-1003-0.dat 2014-10-31 23:16 - 2014-08-12 13:22 - 00329082 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat 2014-10-31 23:16 - 2012-05-09 12:29 - 00524288 _____ () C:\WINDOWS\system32\config\ACEEvent.evt 2014-10-31 23:16 - 2012-05-09 12:14 - 00000278 ___SH () C:\Documents and Settings\User\ntuser.ini 2014-10-31 23:16 - 2012-05-09 12:13 - 00032644 _____ () C:\WINDOWS\SchedLgU.Txt 2014-10-31 23:16 - 2012-05-09 12:09 - 00286225 _____ () C:\WINDOWS\WindowsUpdate.log 2014-10-31 08:04 - 2012-12-26 22:39 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-10-30 14:20 - 2014-05-17 12:37 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware 2014-10-30 14:20 - 2014-05-17 12:36 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware 2014-10-30 10:34 - 2012-06-02 20:30 - 00003072 ____H () C:\Documents and Settings\User\My Documents\photothumb.db 2014-10-29 14:17 - 2014-09-03 19:16 - 00000000 ____D () C:\Documents and Settings\User\Local Settings\Application Data\Adobe 2014-10-29 14:17 - 2012-05-09 12:34 - 00701104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2014-10-29 14:17 - 2012-05-09 12:34 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2014-10-27 19:46 - 2012-05-09 15:01 - 01008290 _____ () C:\WINDOWS\setupapi.log 2014-10-27 16:36 - 2012-05-09 12:39 - 00002489 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk 2014-10-26 08:02 - 2012-05-09 15:02 - 00544060 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-10-25 11:42 - 2014-06-24 12:03 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2014-10-25 11:42 - 2014-06-24 12:03 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2014-10-25 11:18 - 2008-04-14 14:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl 2014-10-20 15:40 - 2014-08-31 09:53 - 00000000 ____D () C:\The KMPlayer 2014-10-19 13:02 - 2013-06-29 17:22 - 00000000 ____D () C:\Documents and Settings\User\My Documents\cool 2014-10-19 13:02 - 2012-05-16 16:41 - 06632448 ___SH () C:\Documents and Settings\User\My Documents\Thumbs.db 2014-10-18 15:17 - 2012-06-03 13:01 - 01745920 ___SH () C:\Documents and Settings\User\Desktop\Thumbs.db 2014-10-18 09:47 - 2012-09-23 15:48 - 00000284 _____ () C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2014-10-15 21:06 - 2012-10-06 13:38 - 00000000 ___RD () C:\Documents and Settings\User\My Documents\STUFF 2014-10-14 20:17 - 2013-02-25 19:50 - 00000000 ____D () C:\Program Files\Avira 2014-10-14 20:17 - 2013-02-25 19:50 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Avira 2014-10-14 20:16 - 2014-08-12 12:49 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Package Cache 2014-10-14 16:08 - 2012-12-08 14:08 - 00072824 _____ () C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT 2014-10-14 12:40 - 2013-02-25 19:50 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys 2014-10-14 12:40 - 2013-02-25 19:50 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys 2014-10-13 08:34 - 2012-06-03 20:19 - 00034816 ____H () C:\Documents and Settings\User\Desktop\photothumb.db 2014-10-09 18:27 - 2012-06-27 16:02 - 00000000 ____D () C:\WINDOWS\system32\NtmsData 2014-10-05 17:21 - 2013-03-18 23:03 - 00000000 ____D () C:\Documents and Settings\User\My Documents\inspirational 2014-10-05 08:42 - 2014-09-07 14:20 - 00000000 ____D () C:\Documents and Settings\User\My Documents\Anki Files to move or delete: ==================== C:\Documents and Settings\User\jagex_cl_runescape_LIVE.dat C:\Documents and Settings\User\random.dat Some content of TEMP: ==================== C:\Documents and Settings\Crina\Local Settings\Temp\avgnt.exe C:\Documents and Settings\Crina\Local Settings\Temp\jre-7u65-windows-i586-iftw.exe C:\Documents and Settings\User\Local Settings\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ mbam-log-2014-11-01.txtAddition.txtRKreport_SCN_11012014_211334.log
  18. A couple of days ago I started getting these pop-ups from Malwarebytes saying malicious websites have been blocked.I checked the IP addresses of the blocked websites and they're all from Ecatel LDT from Netherlands.I've run both MBAM and Malwarebytes Anti-Rootkit but no malware has been found.I've attached the Application logs from the past three days since this problem started and Scan logs. mbam-scan-log-2014-10-30.txtmbam-daily-log-2014-10-30.txtmbam-daily-log-2014-10-31.txtmbam-daily-log-2014-11-01.txt
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.