Jump to content

MDoll

Members
 View Profile  See their activity

  • Posts

    3

  • Joined

  • Last visited

 Content Type 

Posts posted by MDoll

    Computer freezes for long periods of time randomly.

    in Resolved Malware Removal Logs

    Posted

    Ok here's what it said:

    .

    DDS (Ver_2011-06-23.01) - NTFSAMD64

    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.2.0

    Run by lulutina at 7:03:05 on 2012-05-02

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1787.580 [GMT -4:00]

    .

    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\wininit.exe

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    c:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\Windows\system32\atiesrxx.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Program Files\Tablet\Pen\Pen_TouchService.exe

    C:\Windows\system32\atieclxx.exe

    C:\Windows\SYSTEM32\WISPTIS.EXE

    C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    C:\Windows\system32\WLANExt.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Windows\System32\svchost.exe -k NetworkService

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Windows\SYSTEM32\WISPTIS.EXE

    C:\Program Files\Tablet\Pen\Pen_TouchUser.exe

    C:\Windows\system32\Dwm.exe

    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\ccSvcHst.exe

    C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files\Tablet\Pen\Pen_Tablet.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files\Tablet\Pen\Pen_TabletUser.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    C:\Program Files\Tablet\Pen\Pen_Tablet.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\Trillian\trillian.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    C:\Program Files\AVAST Software\Avast\AvastUI.exe

    C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

    C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe

    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\ccSvcHst.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files (x86)\Bamboo Dock\BambooCore.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    c:\program files (x86)\trillian\plugins\skypekit.exe

    C:\Windows\system32\conhost.exe

    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

    C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe

    C:\Program Files\Realtek\RtVOsd\RtVOsd.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe

    C:\Windows\explorer.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Program Files\Windows NT\Accessories\wordpad.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

    C:\Windows\system32\atibtmon.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Windows\SysWOW64\ctfmon.exe

    C:\Windows\SysWOW64\cmd.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\SysWOW64\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uWindow Title = Internet Explorer, optimized for Bing and MSN

    uInternet Settings,ProxyOverride = *.local

    uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    mWinlogon: Userinit=userinit.exe

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll

    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\coIEPlg.dll

    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\IPS\IPSBHO.DLL

    BHO: PageFont.BHO: {88888888-81ea-4850-9911-13ba2d71efbd} - mscoree.dll

    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\coIEPlg.dll

    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll

    uRun: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe

    uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US

    uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    uRun: [EPSON WorkForce 610 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFJA.EXE /FU "C:\Windows\TEMP\E_SDB56.tmp" /EF "HKCU"

    uRun: [AdobeBridge]

    uRun: [Google Update] "C:\Users\lulutina\AppData\Local\Google\Update\GoogleUpdate.exe" /c

    uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

    uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

    mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe

    mRun: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"

    mRun: [LTCM Client] C:\Program Files (x86)\LTCM Client\ltcmClient.exe /startup

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRun: [bambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    StartupFolder: C:\Users\lulutina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EPSONA~1.LNK - E:\Common\EpsonReg\EpsonReg.exe

    StartupFolder: C:\Users\lulutina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\FLIPTO~1.LNK - C:\Program Files (x86)\fliptoast\fliptoast.exe

    StartupFolder: C:\Users\lulutina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe

    mPolicies-explorer: NoActiveDesktop = 1 (0x1)

    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

    DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab

    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    TCP: DhcpNameServer = 192.168.1.1

    TCP: Interfaces\{E964939F-260B-46D0-8A1F-0D65ECDADFBC} : DhcpNameServer = 192.168.1.1

    TCP: Interfaces\{E964939F-260B-46D0-8A1F-0D65ECDADFBC}\A4F6E65637 : DhcpNameServer = 192.168.1.1

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO-X64: AcroIEHelperStub - No File

    BHO-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll

    BHO-X64: Conduit Engine - No File

    BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

    BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\coIEPlg.dll

    BHO-X64: Symantec NCO BHO - No File

    BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\IPS\IPSBHO.DLL

    BHO-X64: Symantec Intrusion Prevention - No File

    BHO-X64: PageFont.BHO: {88888888-81ea-4850-9911-13ba2d71efbd} - mscoree.dll

    BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO-X64: SkypeIEPluginBHO - No File

    BHO-X64: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    BHO-X64: Vuze Remote - No File

    BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.1.3\coIEPlg.dll

    TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    TB-X64: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

    TB-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll

    mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

    mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    mRun-x64: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

    mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

    mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe

    mRun-x64: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"

    mRun-x64: [LTCM Client] C:\Program Files (x86)\LTCM Client\ltcmClient.exe /startup

    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRun-x64: [bambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe

    mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\lulutina\AppData\Roaming\Mozilla\Firefox\Profiles\rhp6b96d.default\

    FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

    FF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dll

    FF - plugin: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\lulutina\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll

    FF - plugin: C:\Users\lulutina\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll

    FF - plugin: C:\Users\lulutina\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

    FF - plugin: C:\Users\lulutina\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

    FF - plugin: C:\Windows\system32\npdeployJava1.dll

    FF - plugin: C:\Windows\system32\npmproxy.dll

    FF - plugin: C:\Windows\system32\npOGPPlugin.dll

    FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

    .

    ---- FIREFOX POLICIES ----

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false

    ============= SERVICES / DRIVERS ===============

    .

    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

    R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]

    R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]

    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\BASHDefs\20110415.001\BHDrvx64.sys [2011-4-15 1127032]

    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.0.0.128\Definitions\IPSDefs\20110419.001\IDSviA64.sys [2011-4-19 476792]

    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]

    R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]

    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-4-19 132656]

    S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

    .

    =============== Created Last 30 ================

    .

    2012-05-02 01:11:24 8917360 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{13973088-5B39-45A6-A0E1-9EF18FA754F7}\mpengine.dll

    2012-05-01 00:38:53 8917360 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-04-30 01:18:04 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service

    2012-04-30 01:17:29 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe

    2012-04-30 01:17:29 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe

    2012-04-25 07:11:13 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

    2012-04-20 07:51:17 -------- d-----w- C:\Program Files (x86)\KRU

    2012-04-11 07:16:59 887296 ----a-w- C:\Program Files\Internet Explorer\iedvtool.dll

    2012-04-11 07:15:31 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2012-04-11 07:15:25 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2012-04-11 07:15:21 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2012-04-11 07:03:41 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys

    2012-04-11 07:03:39 81408 ----a-w- C:\Windows\System32\imagehlp.dll

    2012-04-11 07:03:38 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll

    2012-04-11 07:03:27 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

    2012-04-11 07:03:18 5120 ----a-w- C:\Windows\System32\wmi.dll

    2012-04-11 07:03:18 220672 ----a-w- C:\Windows\System32\wintrust.dll

    2012-04-11 07:03:16 5120 ----a-w- C:\Windows\SysWow64\wmi.dll

    2012-04-04 00:55:45 386168 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\symnets.sys

    2012-04-04 00:55:44 912504 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\symefa64.sys

    2012-04-04 00:55:43 744568 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\srtsp64.sys

    2012-04-04 00:55:43 450680 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\symds64.sys

    2012-04-04 00:55:43 40568 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\srtspx64.sys

    2012-04-04 00:55:43 171128 ----a-w- C:\Windows\System32\drivers\NISx64\1207010.003\ironx64.sys

    2012-04-04 00:54:43 -------- d-----w- C:\Windows\System32\drivers\NISx64\1207010.003

    .

    ==================== Find3M ====================

    .

    2012-03-21 00:44:12 98688 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys

    2012-03-21 00:44:12 203888 ----a-w- C:\Windows\System32\drivers\MpFilter.sys

    2012-03-06 23:15:19 41184 ----a-w- C:\Windows\avastSS.scr

    2012-03-06 23:04:06 819032 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

    2012-03-06 23:02:20 53080 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys

    2012-03-06 23:01:52 69976 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

    2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll

    2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll

    2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-02-26 05:58:33 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll

    2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll

    2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys

    2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys

    2012-02-16 03:39:10 0 ----a-w- C:\Windows\SysWow64\sho78AA.tmp

    2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll

    2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll

    2012-02-09 13:33:39 86584 ----a-w- C:\Windows\SysWow64\drivers\adfs.sys

    2012-02-09 13:33:39 86584 ----a-w- C:\Windows\System32\drivers\adfs.sys

    2012-02-03 04:34:34 3145728 ----a-w- C:\Windows\System32\win32k.sys

    .

    ============= FINISH: 7:05:49.16 ===============

    Computer freezes for long periods of time randomly.

    in Resolved Malware Removal Logs

    Posted

    Basically my computer is often freezing up, and I forcibly shut it down as it doesn't respond to anything. Is something wrong with Avast? I gave it a try and it isn't picking up anything an at this rate, I feel like I'm probably not going to renew my subscription. I'm at my wits end with this...!! I suspect a virus. It's weird but even though Avast says the threat was blocked my computer sometimes freezes up as if a virus or malware still made it onto the computer. Another issue I notice I have is I can't change my host file. Like I turn on on the administrator settings, but everytime I try to edit the host file it keeps telling me its "read only."

    hijackthis.log

    The ever elusive redirect virus

    in Resolved Malware Removal Logs

    Posted

    ok so I went on google images and got a redirect virus. Trying to boot the computer up and get things moving took about 3 hours. Super Slow.

    I tried malwarebytes. Didn't find anything.

    I tried Avira. Didn't find anything.

    Tried Avira's bootscan. STILL nothing.

    GMER found nothing either, so it provided me with no log.

    So I did a System Restore from about 2 days before I got the virus. It still is taking the computer lightyears to start up.

    Its also saying when I try to produce a hijackthis log it says it can't hijackthis.log file.

    the DDS and Attach should be in attachments :)

    DDS.txt

    Attach.txt

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.