Odeon
Members-
Posts
12 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Everything posted by Odeon
-
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
here is the delfix report. nice work man. thank you very much again. # DelFix v10.8 - Logfile created 17/01/2015 at 17:30:10 # Updated 29/07/2014 by Xplode # Username : Odeon - ODEON-PC # Operating System : Windows 7 Ultimate Service Pack 1 (64 bits) ~ Activating UAC ... OK ~ Removing disinfection tools ... Deleted : C:\_OTL Deleted : C:\FRST Deleted : C:\AdwCleaner Deleted : C:\Users\Odeon\Desktop\FRST-OlderVersion Deleted : C:\TDSSKiller.3.0.0.42_15.01.2015_20.43.42_log.txt Deleted : C:\Users\Odeon\Desktop\Addition.txt Deleted : C:\Users\Odeon\Desktop\AdwCleaner.exe Deleted : C:\Users\Odeon\Desktop\Fixlog.txt Deleted : C:\Users\Odeon\Desktop\FRST.txt Deleted : C:\Users\Odeon\Desktop\FRST64.exe Deleted : C:\Users\Odeon\Desktop\JRT.exe Deleted : C:\Users\Odeon\Desktop\JRT.txt Deleted : C:\Users\Odeon\Desktop\OTL.exe Deleted : C:\Users\Odeon\Desktop\scan.txt Deleted : HKLM\SOFTWARE\OldTimer Tools Deleted : HKLM\SOFTWARE\AdwCleaner ~ Creating registry backup ... OK ~ Cleaning system restore ... Deleted : RP #73 [OTL Restore Point - 15.01.2015 20:10:14 | 01/15/2015 19:10:14] Deleted : RP #75 [Restore Point Created by FRST | 01/16/2015 21:00:41] Deleted : RP #77 [Restore Point Created by FRST | 01/16/2015 21:01:42] New restore point created ! ~ Resetting system settings ... OK ########## - EOF - ########## -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
i dont know what was that but i think you fixed it ruggie. no more rundll32 and strange connections i am going to sleep now . if i need to do smthing more please write it. i will do it tomorrow. and send me a paypal link please thank you very much for everything. see you later . Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-01-2015 Ran by Odeon at 2015-01-17 01:23:40 Run:3 Running from C:\Users\Odeon\Desktop Loaded Profiles: Odeon (Available profiles: Odeon) Boot Mode: Normal ============================================== Content of fixlist: ***************** start C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000 C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000 C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000001 end ***************** C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000 => Moved successfully. C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000 => Moved successfully. C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000001 => Moved successfully. ==== End of Fixlog 01:23:40 ==== -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
hmm it seems it found also something in my cell backup. maybe my overheating and batery problem on my s4 is because of this ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # product=EOS # version=8 # IEXPLORE.EXE=11.00.9600.16428 (winblue_gdr.131013-1700) # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=b99887b9228b764b81815ac91ff2c49b # engine=22007 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2015-01-16 10:15:07 # local_time=2015-01-16 11:15:07 ) # country="Turkey" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Avira Desktop' # compatibility_mode=1810 16777213 100 99 14958 4629107 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776574 100 94 36135073 173076357 0 0 # scanned=176861 # found=4 # cleaned=0 # scan_time=2882 sh=65F7B04AA8130E65F6D9619F4A90C3B07A0A7CC2 ft=1 fh=95cb83a560a107ed vn="Win32/AdWare.1ClickDownload.AT application" ac=I fn="C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000" sh=B81F800AC9A5A600EE49B46EBA7661A8526950C9 ft=1 fh=fc75046d2cb7575b vn="Win32/AdWare.1ClickDownload.AW application" ac=I fn="C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000000" sh=B81F800AC9A5A600EE49B46EBA7661A8526950C9 ft=1 fh=fc75046d2cb7575b vn="Win32/AdWare.1ClickDownload.AW application" ac=I fn="C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\File System\003\t\00\00000001" sh=5DD069D14CC713AECF65AF5761203027D8F62D51 ft=0 fh=0000000000000000 vn="Win32/Exploit.MS04-028 trojan" ac=I fn="E:\telefon bekap\Samsung GT-I9505_20141222_222756.bak" -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
i didnt see any rundll32 connection attemps about 5 mins . lets wait and see ... -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
when program wanted to restart the pc i clicked yes and windows made some checks which i didnt see before. when it finished pc restarted again and windows loaded normaly -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
in my first attempt frst.exe stopped working. i tried again and had no problems. here is the result. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-01-2015 01 Ran by Odeon at 2015-01-16 22:01:42 Run:2 Running from C:\Users\Odeon\Desktop Loaded Profiles: Odeon (Available profiles: Odeon) Boot Mode: Normal ============================================== Content of fixlist: ***************** start createrestorepoint: Task: C:\Windows\Tasks\XHKTUV.job => C:\Windows\SysWOW64\KBDINBE23.dll C:\Windows\SysWOW64\KBDINBE23.dll Task: {1FD695DC-DFE2-4060-AB18-FA29C3C5EDEF} - System32\Tasks\{E3E36F76-38C9-4279-9256-F9DAF244559C} => pcalua.exe -a C:\Users\Odeon\Desktop\pbsetup\pbsetup.exe -d C:\Users\Odeon\Desktop\pbsetup AlternateDataStreams: C:\ProgramData\TEMP:C76EDAC3 AlternateDataStreams: C:\ProgramData\TEMP:F0D7EE30 HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\...\Run: [Octoshape Streaming Services] => C:\Users\Odeon\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe [107800 2011-03-24] (Octoshape ApS) ShortcutTarget: MobileGo Service.lnk -> C:\Program Files (x86)\Wondershare\MobileGo\MobileGoService.exe (Wondershare) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk FF Plugin HKU\S-1-5-21-2136585609-3857142508-2264692070-1000: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\Odeon\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1312180-0-npoctoshape.dll (Octoshape ApS) FF Plugin ProgramFiles/Appdata: C:\Users\Odeon\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS) cmd: ipconfig /release cmd: ipconfig /renew cmd: ipconfig /flushdns cmd: netsh winsock reset all cmd: netsh int ip reset all cmd: netsh advfirewall reset cmd: netsh advfirewall set allprofiles state on emptytemp: end ***************** Restore point was successfully created. C:\Windows\Tasks\XHKTUV.job not found. "C:\Windows\SysWOW64\KBDINBE23.dll" => File/Directory not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1FD695DC-DFE2-4060-AB18-FA29C3C5EDEF} => Key not found. C:\Windows\System32\Tasks\{E3E36F76-38C9-4279-9256-F9DAF244559C} not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E3E36F76-38C9-4279-9256-F9DAF244559C} => Key not found. "C:\ProgramData\TEMP" => ":C76EDAC3" ADS not found. "C:\ProgramData\TEMP" => ":F0D7EE30" ADS not found. HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Octoshape Streaming Services => Value not found. C:\Program Files (x86)\Wondershare\MobileGo\MobileGoService.exe not found. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnk not found. HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0 => Key not found. C:\Users\Odeon\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1312180-0-npoctoshape.dll not found. "C:\Users\Odeon\AppData\Roaming\mozilla\plugins\npoctoshape.dll" => not found. ========= ipconfig /release ========= Windows IP Yap�land�rmas� Ethernet ba�da�t�r�c� Yerel A� Ba�lant�s�: Ba�lant�ya �zg� DNS Soneki . . . : Ba�lant� Yerel IPv6 Adresi . . . . . : fe80::dcbc:b972:4d4a:182d%11 Varsay�lan A� Ge�idi. . . . . . . : Tunnel ba�da�t�r�c� isatap.homenet.telecomitalia.it: Medya Durumu . . . . . . . . . . : Medya Ba�lant�s� kesildi Ba�lant�ya �zg� DNS Soneki . . . : Tunnel ba�da�t�r�c� Teredo Tunneling Pseudo-Interface: Medya Durumu . . . . . . . . . . : Medya Ba�lant�s� kesildi Ba�lant�ya �zg� DNS Soneki . . . : ========= End of CMD: ========= ========= ipconfig /renew ========= Windows IP Yap�land�rmas� Ethernet ba�da�t�r�c� Yerel A� Ba�lant�s�: Ba�lant�ya �zg� DNS Soneki . . . : homenet.telecomitalia.it Ba�lant� Yerel IPv6 Adresi . . . . . : fe80::dcbc:b972:4d4a:182d%11 IPv4 Adresi. . . . . . . . . . . : 192.168.1.2 Alt A� Maskesi. . . . . . . . . . : 255.255.255.0 Varsay�lan A� Ge�idi. . . . . . . : 192.168.1.1 Tunnel ba�da�t�r�c� isatap.homenet.telecomitalia.it: Medya Durumu . . . . . . . . . . : Medya Ba�lant�s� kesildi Ba�lant�ya �zg� DNS Soneki . . . : homenet.telecomitalia.it Tunnel ba�da�t�r�c� Teredo Tunneling Pseudo-Interface: Ba�lant�ya �zg� DNS Soneki . . . : IPv6 Adresi. . . . . . . . . . . : 2001:0:9d38:90d7:3850:31ff:3f57:fefd Ba�lant� Yerel IPv6 Adresi . . . . . : fe80::3850:31ff:3f57:fefd%12 Varsay�lan A� Ge�idi. . . . . . . : :: ========= End of CMD: ========= ========= ipconfig /flushdns ========= Windows IP Yap�land�rmas� DNS ��z�c� �nbelle�i ba�ar�yla temizlendi. ========= End of CMD: ========= ========= netsh winsock reset all ========= Winsock Katalo�u ba�ar�yla s�f�rland�. S�f�rlamay� tamamlamak i�in bilgisayar� yeniden ba�latmal�s�n�z. ========= End of CMD: ========= ========= netsh int ip reset all ========= Arabirim s�f�rlan�yor, Tamam! Bu eylemi tamamlamak i�in sistemi yeniden ba�lat�n. ========= End of CMD: ========= ========= netsh advfirewall reset ========= Tamam. ========= End of CMD: ========= ========= netsh advfirewall set allprofiles state on ========= Tamam. ========= End of CMD: ========= EmptyTemp: => Removed 436.4 MB temporary data. The system needed a reboot. ==== End of Fixlog 22:02:03 ==== -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
i uninstalled the octopus witouth any problem. here is the jrt log. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.4.1 (12.28.2014:1)OS: Windows 7 Ultimate x64Ran by Odeon on 16.01.2015 at 21:32:35,85~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on 16.01.2015 at 21:34:10,42End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ and adwcleaner log : (its in turkish but no problem for you i guess ) # AdwCleaner v4.107 - Rapor olusturuldu 16/01/2015 tarihinde 21:36:11# Guncellendi 07/01/2015 tarafindan Xplode# Database : 2015-01-13.2 [Live]# Isletim sistemi : Windows 7 Ultimate Service Pack 1 (64 bits)# Kullanici adi : Odeon - ODEON-PC# Adwcleaner konumu : C:\Users\Odeon\Desktop\AdwCleaner.exe# Tarama turu : Tara ***** [ Servisler ] ***** ***** [ Dosyalar / Klasorler ] ***** ***** [ Görevler ] ***** ***** [ Kisayollar ] ***** ***** [ Registry ] ***** ***** [ Tarayicilar ] ***** -\\ Internet Explorer v11.0.9600.16428 -\\ Mozilla Firefox v -\\ Google Chrome v39.0.2171.95 ************************* AdwCleaner[R0].txt - [1656 octets] - [15/01/2015 20:48:49]AdwCleaner[R1].txt - [728 octets] - [16/01/2015 21:36:11]AdwCleaner[s0].txt - [1719 octets] - [15/01/2015 20:52:38] ########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [847 octets] ########## and frst log Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01Ran by Odeon (administrator) on ODEON-PC on 16-01-2015 21:40:42Running from C:\Users\Odeon\DesktopLoaded Profiles: Odeon (Available profiles: Odeon)Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Türkçe (Türkiye)Internet Explorer Version 11 (Default browser: IE)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe() C:\Windows\SysWOW64\ASGT.exe(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe() C:\Windows\System32\PnkBstrA.exe(DEVGURU Co., LTD.) C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe(Wondershare) C:\Program Files (x86)\Wondershare\MobileGo\MobileGoService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Microsoft Corporation) C:\Windows\System32\taskmgr.exe(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)HKLM\...\Run: [iAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)HKLM\...\Run: [XFast LAN] => C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStartHKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10396440 2014-04-15] (Logitech Inc.)HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)HKLM-x32\...\Run: [XFastUSB] => C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5021448 2013-11-23] (FNet Co., Ltd.)HKLM-x32\...\Run: [googletalk] => C:\Program Files (x86)\Google\Google Talk\googletalk.exe [3739648 2007-01-01] (Google)HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\...\Run: [ASRock A-Tuning] => [X]HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MobileGo Service.lnkShortcutTarget: MobileGo Service.lnk -> C:\Program Files (x86)\Wondershare\MobileGo\MobileGoService.exe (Wondershare) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://battlelog.battlefield.com/bf4HKU\S-1-5-21-2136585609-3857142508-2264692070-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://tr.msn.com/SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox:========FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll (EA Digital Illusions CE AB)FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll (EA Digital Illusions CE AB)FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\Odeon\AppData\Roaming\rcru\plugins\nprcplugin.dll (Raidcall)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: =======CHR HomePage: Default -> hxxp://www.google.com/CHR StartupUrls: Default -> "hxxp://www.google.com/"CHR Profile: C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (BetterTTV) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2014-06-05]CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce [2014-05-01]CHR Extension: (Google Drive) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-23]CHR Extension: (imgur Extension by Metronomik) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehoopddfhgaehhmphfcooacjdpmbjlao [2014-05-31]CHR Extension: (Lounge Assistant) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjonnlehciedbcidabdglnnihcncbml [2014-09-26]CHR Extension: (AdBlock) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-11-23]CHR Extension: (Lazarus: Form Recovery) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\loljledaigphbcpfhfmgopdkppkifgno [2013-11-23]CHR Extension: (Google Cüzdan) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-23]CHR Extension: (Gmail) - C:\Users\Odeon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-23]CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No PathCHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () [File not signed]R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [93016 2014-04-21] (EasyAntiCheat Ltd)R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel® Corporation) [File not signed]S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel® Corporation)R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-03-12] (Intel Corporation)S3 iumsvc; C:\Program Files (x86)\Intel\Intel® Update Manager\bin\iumsvc.exe [174368 2014-02-28] ()R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-03-12] (Intel Corporation)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-30] (Electronic Arts)R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-09-01] ()R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-05-09] ()R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2013-02-19] (Realtek Semiconductor)R2 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [741640 2014-06-16] (DEVGURU Co., LTD.)S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-11-18] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [34640 2012-08-09] (ASRock Inc.)R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [496400 2013-02-26] (Intel Corporation)S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2014-12-26] (FNet Co., Ltd.)R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [16648 2013-11-23] (FNet Co., Ltd.)R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)R3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [41752 2013-05-30] (Logitech Inc.)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-16] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)S1 ElRawDisk; \??\C:\Windows\system32\drivers\rsdrvx64.sys [X]S3 ESEADriver2; \??\C:\Users\Odeon\AppData\Local\Temp\ESEADriver2.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 21:34 - 2015-01-16 21:35 - 01242621 _____ (Thisisu) C:\Users\Odeon\Desktop\JRT (1).exe2015-01-16 21:34 - 2015-01-16 21:34 - 00000621 _____ () C:\Users\Odeon\Desktop\JRT.txt2015-01-16 21:32 - 2015-01-16 21:32 - 00000000 ____D () C:\Windows\ERUNT2015-01-16 21:29 - 2015-01-16 21:32 - 01707939 _____ (Thisisu) C:\Users\Odeon\Desktop\JRT.exe2015-01-16 20:34 - 2015-01-16 20:34 - 00002762 _____ () C:\Users\Odeon\Desktop\protection.txt2015-01-16 20:32 - 2015-01-16 20:32 - 00001135 _____ () C:\Users\Odeon\Desktop\scan.txt2015-01-15 21:07 - 2015-01-16 21:40 - 00017876 _____ () C:\Users\Odeon\Desktop\FRST.txt2015-01-15 21:07 - 2015-01-15 21:07 - 00030386 _____ () C:\Users\Odeon\Desktop\Addition.txt2015-01-15 21:06 - 2015-01-16 21:40 - 00000000 ____D () C:\FRST2015-01-15 21:01 - 2015-01-15 21:02 - 02125312 _____ (Farbar) C:\Users\Odeon\Desktop\FRST64.exe2015-01-15 20:48 - 2015-01-16 21:36 - 00000000 ____D () C:\AdwCleaner2015-01-15 20:43 - 2015-01-15 20:43 - 00000000 ____D () C:\Users\Odeon\Desktop\tdsskiller2015-01-15 20:10 - 2015-01-15 20:10 - 00000000 ____D () C:\_OTL2015-01-15 20:08 - 2015-01-15 20:08 - 02191360 _____ () C:\Users\Odeon\Desktop\AdwCleaner.exe2015-01-15 20:08 - 2015-01-15 20:08 - 00602112 _____ (OldTimer Tools) C:\Users\Odeon\Desktop\OTL.exe2015-01-15 01:52 - 2015-01-15 01:52 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC2015-01-15 01:52 - 2015-01-15 01:52 - 00000825 _____ () C:\Users\Public\Desktop\CCleaner.lnk2015-01-15 01:52 - 2015-01-15 01:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner2015-01-15 01:52 - 2015-01-15 01:52 - 00000000 ____D () C:\Program Files\CCleaner2015-01-15 01:28 - 2015-01-15 01:28 - 00000000 _____ () C:\Users\Odeon\Desktop\Yeni Metin Belgesi.txt2015-01-15 01:16 - 2015-01-15 01:28 - 00000000 ____D () C:\Users\Odeon\Desktop\Yeni klasör2015-01-15 00:27 - 2015-01-16 21:40 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-01-15 00:27 - 2015-01-15 00:27 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-01-15 00:27 - 2015-01-15 00:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2015-01-15 00:27 - 2015-01-15 00:27 - 00000000 ____D () C:\ProgramData\Malwarebytes2015-01-15 00:27 - 2015-01-15 00:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2015-01-15 00:27 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2015-01-15 00:27 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2015-01-15 00:27 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2015-01-14 23:59 - 2015-01-14 23:59 - 00007624 _____ () C:\Users\Odeon\AppData\Local\Resmon.ResmonCfg2014-12-30 15:53 - 2015-01-02 18:21 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\TS3Client2014-12-30 15:53 - 2014-12-30 15:53 - 00001169 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk2014-12-30 15:53 - 2014-12-30 15:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client2014-12-30 15:53 - 2014-12-30 15:53 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client2014-12-28 16:13 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll2014-12-28 16:13 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll2014-12-28 16:13 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll2014-12-28 16:13 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll2014-12-28 16:13 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll2014-12-28 16:13 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll2014-12-28 16:13 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll2014-12-28 16:13 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll2014-12-28 16:13 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll2014-12-28 16:13 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys2014-12-28 16:13 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll2014-12-28 16:13 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll2014-12-28 16:13 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll2014-12-28 16:13 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00994384 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00876976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00178632 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll2014-12-28 16:13 - 2014-12-13 11:08 - 00165760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll2014-12-28 16:13 - 2014-12-13 01:47 - 00620176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe2014-12-28 16:13 - 2014-10-09 18:02 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys2014-12-28 16:13 - 2014-10-09 18:02 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll2014-12-28 16:13 - 2014-10-09 08:17 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll2014-12-28 16:11 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys2014-12-28 16:11 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll2014-12-26 19:54 - 2014-12-26 19:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ISO to USB2014-12-26 19:54 - 2014-12-26 19:54 - 00000000 ____D () C:\Program Files (x86)\ISO to USB2014-12-26 17:18 - 2014-12-26 20:07 - 00000000 ____D () C:\Program Files (x86)\Easy Image2014-12-26 17:18 - 2014-12-26 17:18 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy Image2014-12-26 17:18 - 2014-12-26 17:18 - 00000000 ____D () C:\Program Files (x86)\AwenGers442014-12-24 14:19 - 2014-12-24 14:15 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys2014-12-24 14:16 - 2014-12-24 14:16 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Avira2014-12-24 14:14 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys2014-12-24 14:14 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys2014-12-24 14:14 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys2014-12-24 13:57 - 2014-12-24 14:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira2014-12-21 23:00 - 2014-12-21 23:00 - 00000000 ____D () C:\ProgramData\Licenses2014-12-21 22:43 - 2015-01-16 21:32 - 00000306 _____ () C:\Windows\Tasks\XHKTUV.job2014-12-21 22:43 - 2014-12-21 22:43 - 00147456 __RSH () C:\Windows\SysWOW64\KBDINBE23.dll2014-12-21 22:43 - 2014-12-21 22:43 - 00002586 _____ () C:\Windows\System32\Tasks\XHKTUV2014-12-21 15:45 - 2014-12-21 15:45 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf2014-12-21 15:43 - 2014-12-21 15:43 - 00000000 ____D () C:\Program Files\SAMSUNG2014-12-21 15:43 - 2014-06-16 07:01 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll2014-12-21 15:43 - 2014-06-16 07:01 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll2014-12-21 15:43 - 2014-06-16 07:01 - 00206080 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys2014-12-21 15:42 - 2014-12-21 15:42 - 00000000 ____D () C:\ProgramData\Samsung2014-12-21 13:56 - 2014-12-21 13:56 - 00000000 ____D () C:\Users\Odeon\Documents\Wondershare2014-12-21 13:55 - 2014-12-21 13:55 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\HMYGSetting2014-12-21 02:54 - 2014-12-21 23:03 - 00000000 ____D () C:\ProgramData\TEMP2014-12-20 17:59 - 2014-12-20 17:59 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll2014-12-20 17:59 - 2014-12-20 17:59 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf2014-12-20 17:59 - 2014-06-16 07:01 - 00110336 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys2014-12-20 17:52 - 2014-12-21 13:54 - 00000000 ____D () C:\ProgramData\Wondershare2014-12-20 17:51 - 2014-12-23 23:43 - 00000000 ___HD () C:\Program Files (x86)\DrFoneAndroid_Temp2014-12-20 17:51 - 2014-12-23 23:43 - 00000000 ____D () C:\Users\Odeon\.android2014-12-20 17:51 - 2014-12-23 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare2014-12-20 17:51 - 2014-12-23 23:43 - 00000000 ____D () C:\Program Files (x86)\Wondershare2014-12-20 17:51 - 2014-12-21 16:12 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Wondershare2014-12-20 17:51 - 2014-12-20 17:51 - 00000000 ____D () C:\Users\Odeon\AppData\Local\Wondershare2014-12-20 17:50 - 2014-12-21 13:54 - 00000000 ____D () C:\Users\Public\Documents\Wondershare2014-12-19 09:14 - 2015-01-14 22:10 - 00001408 _____ () C:\Users\Odeon\AppData\Roaming\BreakingPoint_Options.ini2014-12-19 09:13 - 2015-01-14 20:36 - 00000293 _____ () C:\Users\Odeon\AppData\Roaming\BreakingPoint_Login.ini2014-12-19 09:11 - 2015-01-10 18:09 - 00000000 ____D () C:\Users\Odeon\AppData\Local\Arma 32014-12-19 09:11 - 2014-12-19 09:13 - 00000000 ____D () C:\Users\Odeon\Documents\Arma 32014-12-19 09:11 - 2014-12-19 09:11 - 00000000 ____D () C:\ProgramData\Bohemia Interactive2014-12-19 09:04 - 2014-12-19 09:04 - 00000706 _____ () C:\Users\Odeon\Desktop\Breaking Point.lnk2014-12-19 09:03 - 2015-01-10 17:51 - 00000000 ____D () C:\Breaking Point ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 21:29 - 2014-04-06 12:42 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Octoshape2015-01-16 21:26 - 2013-11-23 22:31 - 00001020 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-01-16 21:15 - 2013-11-23 22:37 - 00000000 ____D () C:\Program Files (x86)\Steam2015-01-16 20:37 - 2009-07-14 05:45 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-01-16 20:37 - 2009-07-14 05:45 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-01-16 20:35 - 2011-04-12 15:56 - 00657000 _____ () C:\Windows\system32\perfh01F.dat2015-01-16 20:35 - 2011-04-12 15:56 - 00139926 _____ () C:\Windows\system32\perfc01F.dat2015-01-16 20:35 - 2009-07-14 06:13 - 01572100 _____ () C:\Windows\system32\PerfStringBackup.INI2015-01-16 20:33 - 2013-11-23 20:26 - 01901168 _____ () C:\Windows\WindowsUpdate.log2015-01-16 20:30 - 2013-11-23 22:31 - 00001016 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-01-16 20:30 - 2013-11-23 21:00 - 00000000 ____D () C:\ProgramData\NVIDIA2015-01-16 20:30 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-01-16 20:30 - 2009-07-14 05:51 - 00161381 _____ () C:\Windows\setupact.log2015-01-16 20:29 - 2010-11-21 04:47 - 00254954 _____ () C:\Windows\PFRO.log2015-01-15 21:52 - 2013-11-23 23:19 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Mumble2015-01-15 01:18 - 2014-02-22 23:24 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\uTorrent2015-01-15 00:36 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Branding2015-01-13 22:10 - 2014-02-22 23:12 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-01-13 22:10 - 2014-02-22 23:12 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-01-11 13:14 - 2014-06-20 20:55 - 00000000 ____D () C:\Users\Odeon\Documents\Euro Truck Simulator 22015-01-01 11:40 - 2014-08-06 20:41 - 00000000 ____D () C:\Users\Odeon\AppData\Local\Adobe2014-12-28 16:14 - 2013-11-23 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation2014-12-26 19:55 - 2013-11-23 22:01 - 00032320 _____ (FNet Co., Ltd.) C:\Windows\system32\Drivers\FNETTBOH_305.SYS2014-12-24 14:14 - 2013-11-23 23:14 - 00000000 ____D () C:\ProgramData\Avira2014-12-24 14:14 - 2013-11-23 23:14 - 00000000 ____D () C:\Program Files (x86)\Avira2014-12-24 13:57 - 2013-11-24 11:10 - 00000000 ____D () C:\ProgramData\Package Cache2014-12-20 17:54 - 2014-12-14 12:04 - 00000000 ___RD () C:\Users\Odeon\Dropbox2014-12-20 17:53 - 2014-12-14 12:02 - 00000000 ____D () C:\Users\Odeon\AppData\Roaming\Dropbox2014-12-20 17:51 - 2013-11-23 20:31 - 00000000 ____D () C:\Users\Odeon Some content of TEMP:====================C:\Users\Odeon\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 20:09 ==================== End Of Log ============================ -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
btw when i was scanning mbam blocked some of those ip's . here is the protection log. maybe it helps. Malwarebytes Anti-Malwarewww.malwarebytes.org Protection, 16.01.2015 20:20:52, SYSTEM, ODEON-PC, Protection, Malware Protection, Starting, Protection, 16.01.2015 20:20:52, SYSTEM, ODEON-PC, Protection, Malware Protection, Started, Protection, 16.01.2015 20:20:52, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 20:20:53, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Started, Update, 16.01.2015 20:21:11, SYSTEM, ODEON-PC, Scheduler, Malware Database, 2015.1.15.11, 2015.1.16.9, Protection, 16.01.2015 20:21:11, SYSTEM, ODEON-PC, Protection, Refresh, Starting, Protection, 16.01.2015 20:21:11, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Stopping, Protection, 16.01.2015 20:21:11, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Stopped, Protection, 16.01.2015 20:21:14, SYSTEM, ODEON-PC, Protection, Refresh, Success, Protection, 16.01.2015 20:21:14, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 20:21:14, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Started, Scan, 16.01.2015 20:22:20, SYSTEM, ODEON-PC, Manual, Start:16.01.2015 20:21:11, Duration:1 min 8 sec, Threat Scan, Cancelled, 0 Malware Detections, 0 Non-Malware Detections, Detection, 16.01.2015 20:25:14, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 51180, Outbound, C:\Windows\SysWOW64\rundll32.exe, Detection, 16.01.2015 20:25:14, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 51180, Outbound, C:\Windows\SysWOW64\rundll32.exe, Detection, 16.01.2015 20:25:22, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 51297, Outbound, C:\Windows\SysWOW64\rundll32.exe, Detection, 16.01.2015 20:25:25, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, IP, 66.45.56.109, redirect.ad-feeds.net, 51318, Outbound, C:\Windows\SysWOW64\rundll32.exe, Detection, 16.01.2015 20:25:25, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, IP, 66.45.56.109, redirect.ad-feeds.net, 51318, Outbound, C:\Windows\SysWOW64\rundll32.exe, Scan, 16.01.2015 20:29:06, SYSTEM, ODEON-PC, Manual, Start:16.01.2015 20:22:37, Duration:5 min 58 sec, Threat Scan, Completed, 1 Malware Detection, 0 Non-Malware Detections, Protection, 16.01.2015 20:30:57, SYSTEM, ODEON-PC, Protection, Malware Protection, Starting, Protection, 16.01.2015 20:30:57, SYSTEM, ODEON-PC, Protection, Malware Protection, Started, Protection, 16.01.2015 20:30:57, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Starting, Protection, 16.01.2015 20:30:58, SYSTEM, ODEON-PC, Protection, Malicious Website Protection, Started, (end) -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
Here is the scan log. Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 16.01.2015 Scan Time: 20:22:37 Logfile: scan.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2015.01.16.09 Rootkit Database: v2015.01.14.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Odeon Scan Type: Threat Scan Result: Completed Objects Scanned: 327453 Time Elapsed: 5 min, 58 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 Trojan.MSIL.ED, C:\Users\Odeon\AppData\Local\Temp\repfix.exe, Quarantined, [f45d12e53059a98d66217c8fac566799], Physical Sectors: 0 (No malicious items detected) (end) -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
btw in an hour i will re-scan with mbam and send you the result -
rundll32.exe - too many susbisious connections and ram usage
Odeon replied to Odeon's topic in Resolved Malware Removal Logs
i am using shadowplay to record sometimes. never used it for streaming . i dont have enough upload speed to stream -
Hello, I am a gamer and yesterday my ping was too high when i was playing online games. then i looked at the programs running behind and saw 2 rundll32 exes ( rundll32 *32 from directory C:\Windows\SysWOW64 and rundll32 from directory C:\Windows\System32) and they were using too much resource from ram. then i checked what is using my internet and saw rundll32 is trying to connect too many ip'es. i had only avira antivirus program and it didnt give me any reports about this problem. later i installed mbam and it began to block some of this ip'es but not all of them. here are some of this ip'es and frst.txt + addition.txt in attc. p 192.168.1.2:55218 54.77.207.254:80 rundll32.exe HTTP_C 976 1074 0 0 2m 29s high tcp 192.168.1.2:55227 54.77.207.254:443 rundll32.exe Unknown 1560 4875 0 0 2m 29s default tcp 192.168.1.2:55308 54.171.53.252:80 rundll32.exe HTTP_C 1100 1244 0 0 1m 11s high tcp 192.168.1.2:55250 185.29.133.242:9170 rundll32.exe HTTP_C 12324 3323 0 0 1m 28s high tcp 192.168.1.2:55248 173.193.255.240:80 rundll32.exe HTTP_C 4083 6104 0 0 1m 28s high tcp 192.168.1.2:55252 216.58.210.194:80 rundll32.exe HTTP_C 6851 4094 0 0 1m 28s high tcp 192.168.1.2:55284 216.58.210.194:80 rundll32.exe HTTP_C 680 769 0 0 1m 20s tcp 192.168.1.2:55198 216.58.210.193:443 chrome.exe Unknown 1229 4608 0 0 3m 34s default tcp 192.168.1.2:55278 54.76.84.191:80 rundll32.exe HTTP_C 724 929 0 0 1m 20s high tcp 192.168.1.2:55288 54.76.84.191:443 rundll32.exe Unknown 1400 4779 0 0 1m 19s default tcp 192.168.1.2:52548 64.233.167.188:5228 chrome.exe Unknown 3093 8156 0 0 32m 51s default tcp 192.168.1.2:55310 184.72.38.185:80 rundll32.exe HTTP_C 1490 1053 0 0 1m 8s high tcp 192.168.1.2:55271 23.50.148.174:80 rundll32.exe HTTP_C_BU 6353 50942 0 0 1m 21s low tcp 192.168.1.2:55273 23.50.148.174:80 rundll32.exe HTTP_C 3346 26263 0 0 1m 21s high tcp 192.168.1.2:55286 23.50.148.174:80 rundll32.exe HTTP_C 2983 296 0 0 1m 20s high tcp 192.168.1.2:55326 23.50.148.174:80 rundll32.exe HTTP_C_BU 25373 152K 0 0 29.031s low tcp 192.168.1.2:55327 23.50.148.174:80 rundll32.exe HTTP_C 16835 117K 0 0 28.704s high tcp 192.168.1.2:55329 23.50.148.174:80 rundll32.exe HTTP_C 10126 744 0 0 27.565s high tcp 192.168.1.2:55337 23.221.199.168:80 chrome.exe HTTP_C 620 396 0 0 20.982s tcp 192.168.1.2:55188 195.22.200.163:80 rundll32.exe HTTP_C 54826 108K 1789 571 4m 28s high tcp 192.168.1.2:55321 195.22.200.163:80 rundll32.exe HTTP_C 54852 46458 0 0 57.548s high tcp 192.168.1.2:55266 195.22.200.155:80 rundll32.exe HTTP_C_BU 14280 125K 0 0 1m 24s low tcp 192.168.1.2:55267 195.22.200.155:80 rundll32.exe HTTP_C_BU 19107 242K 0 0 1m 24s low tcp 192.168.1.2:55282 195.22.200.155:80 rundll32.exe HTTP_C 1557 1689 0 0 1m 20s high tcp 192.168.1.2:55249 23.21.75.138:80 rundll32.exe HTTP_C 28356 3852 0 0 1m 28s high tcp 192.168.1.2:55192 216.58.219.131:443 chrome.exe Unknown 1261 4970 0 0 3m 54s default tcp 192.168.1.2:55285 54.174.193.128:80 rundll32.exe HTTP_C 1165 1346 0 0 1m 20s high tcp 192.168.1.2:55233 23.50.146.116:80 rundll32.exe HTTP_C 786 703 0 0 2m 26s tcp 192.168.1.2:55235 23.50.146.116:80 rundll32.exe HTTP_C 581 775 0 0 2m 26s tcp 192.168.1.2:55357 37.252.170.113:80 rundll32.exe HTTP_C_BU 6321 6361 3954 3979 0.858s low tcp 192.168.1.2:55325 37.252.170.110:80 rundll32.exe HTTP_C_BU 5245 3896 0 0 29.531s low tcp 192.168.1.2:55220 23.50.149.109:80 rundll32.exe HTTP_C 5151 6738 0 0 2m 29s high tcp 192.168.1.2:55234 23.50.149.109:80 rundll32.exe HTTP_C 1192 1035 0 0 2m 26s tcp 192.168.1.2:55279 23.50.149.109:80 rundll32.exe HTTP_C 3768 5888 0 0 1m 20s high tcp 192.168.1.2:55295 23.50.149.109:80 rundll32.exe HTTP_C 2882 2488 0 0 1m 17s high tcp 192.168.1.2:55221 23.50.148.101:443 rundll32.exe Unknown 2202 32011 0 0 2m 29s default tcp 192.168.1.2:55280 23.50.148.101:443 rundll32.exe Unknown 2250 33923 0 0 1m 20s default tcp 192.168.1.2:55294 159.8.32.101:80 rundll32.exe HTTP_C 783 913 0 0 1m 17s high tcp 192.168.1.2:55251 159.8.37.100:80 rundll32.exe HTTP_C 1264 670 0 0 1m 28s high tcp 192.168.1.2:55247 162.13.61.90:80 rundll32.exe HTTP_C 5962 21884 0 0 1m 28s high tcp 192.168.1.2:55296 185.29.134.87:80 rundll32.exe HTTP_C 830 667 0 0 1m 17s tcp 192.168.1.2:55330 144.76.59.84:80 chrome.exe HTTP_C 864 1312 0 0 21.013s tcp 192.168.1.2:55246 54.76.70.81:80 rundll32.exe HTTP_C 5145 13250 0 0 1m 28s high Addition.txt FRST.txt