Jump to content

maxpayne

Members
 View Profile  See their activity

  • Posts

    2

  • Joined

  • Last visited

 Content Type 

Posts posted by maxpayne

    Google search redirects

    in Resolved Malware Removal Logs

    Posted

    I've been having google search redirects on my browser which is Google Chrome 13 beta.

    The virus is also preventing me from using Microsoft Security Essentials whenever I click on it on my desktop it opens and then immediately closes.

    SO please help, i can't get rid of this virus and I dont know what else to do.

    Here is the MBAM quick scan log as requested:

    Malwarebytes' Anti-Malware 1.51.1.1800

    www.malwarebytes.org

    Database version: 7430

    Windows 6.1.7600

    Internet Explorer 8.0.7600.16385

    8/10/2011 7:09:16 PM

    mbam-log-2011-08-10 (19-09-16).txt

    Scan type: Quick scan

    Objects scanned: 170990

    Time elapsed: 7 minute(s), 3 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    Also here is the Dds.txt and the attach.txt zipped and attached as requested:

    .

    DDS (Ver_2011-06-23.01) - NTFSAMD64

    Internet Explorer: 8.0.7600.16385

    Run by User at 19:13:43 on 2011-08-10

    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3894.1441 [GMT -7:00]

    .

    AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}

    FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\wininit.exe

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\WLANExt.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

    C:\Windows\system32\Dwm.exe

    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

    C:\Program Files (x86)\Bonjour\mDNSResponder.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

    C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files (x86)\AWS\WeatherBug\Weather.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe

    C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

    C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe

    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

    C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe

    C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\system32\wuauclt.exe

    C:\Windows\servicing\TrustedInstaller.exe

    C:\Windows\system32\wuauclt.exe

    C:\Windows\system32\msiexec.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Windows\System32\svchost.exe -k swprv

    C:\Windows\SoftwareDistribution\Download\Install\NDP40-KB2533523-x64.exe

    c:\1ddb3f89440267bdabc9ae59540b\Setup.exe

    C:\Windows\system32\MsiExec.exe

    C:\Windows\syswow64\MsiExec.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

    C:\Windows\system32\conhost.exe

    C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe

    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    C:\Windows\system32\DllHost.exe

    C:\Windows\system32\DllHost.exe

    C:\Windows\system32\DllHost.exe

    C:\Windows\SysWOW64\cmd.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\SysWOW64\cscript.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = about:blank

    uWindow Title = Internet Explorer, optimized for Bing and MSN

    mStart Page = about:blank

    uInternet Settings,ProxyOverride = *.local

    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

    uRun: [Google Update] "C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe" /c

    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

    uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    uRun: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1

    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    uRun: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW

    mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

    mRun: [<NO NAME>]

    mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

    mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

    StartupFolder: C:\Users\User\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LIMEWI~1.LNK - C:\Program Files (x86)\LimeWire\LimeWire.exe

    StartupFolder: C:\Users\User\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

    StartupFolder: C:\Users\User\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\PDANET~1.LNK - C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHILIP~1.LNK - C:\Philips\GoGear VIBE Device Manager\GoGear_Vibe_DeviceManager.exe

    mPolicies-explorer: NoActiveDesktop = 1 (0x1)

    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL

    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    TCP: DhcpNameServer = 192.168.1.254

    TCP: Interfaces\{54F24114-29AF-42BD-B7D8-E75507F6D442} : DhcpNameServer = 192.168.1.254

    TCP: Interfaces\{54F24114-29AF-42BD-B7D8-E75507F6D442}\3474442343740353 : DhcpNameServer = 209.18.47.61 209.18.47.62

    TCP: Interfaces\{54F24114-29AF-42BD-B7D8-E75507F6D442}\3596C6163724C61636B6D27657563747 : DhcpNameServer = 192.168.33.1 209.18.47.61 209.18.47.62

    TCP: Interfaces\{54F24114-29AF-42BD-B7D8-E75507F6D442}\452554E444E65647 : DhcpNameServer = 192.168.1.1

    TCP: Interfaces\{54F24114-29AF-42BD-B7D8-E75507F6D442}\A474652563 : DhcpNameServer = 192.168.1.1 68.238.64.12

    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    BHO-X64: HP Print Enhancer - No File

    BHO-X64: IEPlugin Class: {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~2\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL

    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO-X64: AcroIEHelperStub - No File

    BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

    BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    BHO-X64: HP Smart BHO Class - No File

    TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

    TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

    TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

    EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File

    mRun-x64: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

    mRun-x64: [(Default)]

    mRun-x64: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

    mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun-x64: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

    SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\rs727dqm.default\

    FF - prefs.js: browser.search.selectedEngine - Bing

    FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z170&install_date=20110802

    FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z170&form=ZGAADF&install_date=20110802&q=

    FF - prefs.js: network.proxy.type - 0

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\User\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 SmartDefragDriver;SmartDefragDriver;C:\Windows\system32\Drivers\SmartDefragDriver.sys --> C:\Windows\system32\Drivers\SmartDefragDriver.sys [?]

    R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

    R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

    R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

    R1 SBRE;SBRE;\??\C:\Windows\system32\drivers\SBREdrv.sys --> C:\Windows\system32\drivers\SBREdrv.sys [?]

    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-7-18 146816]

    R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-1-30 98208]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    R2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-24 315392]

    R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-1-30 2320920]

    R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-1-15 228408]

    R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

    R3 pnetmdm;PdaNet Modem;C:\Windows\system32\DRIVERS\pnetmdm64.sys --> C:\Windows\system32\DRIVERS\pnetmdm64.sys [?]

    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\androidusb.sys --> C:\Windows\system32\Drivers\androidusb.sys [?]

    S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

    S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

    S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

    S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-30 225280]

    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

    S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

    S3 VBoxUSB;VirtualBox USB;C:\Windows\system32\Drivers\VBoxUSB.sys --> C:\Windows\system32\Drivers\VBoxUSB.sys [?]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

    S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

    .

    =============== Created Last 30 ================

    .

    2011-08-11 02:09:24 -------- d-----w- C:\1ddb3f89440267bdabc9ae59540b

    2011-08-11 01:06:54 -------- d-----w- C:\Program Files (x86)\ESET

    2011-08-10 17:03:35 601424 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    2011-08-10 17:03:34 601424 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{968978C2-827F-4ADC-AE75-51FBEE451B9C}\gapaengine.dll

    2011-08-10 17:03:09 8578896 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9E18AFCE-5905-447E-BB95-32FE4B8350A8}\mpengine.dll

    2011-08-10 16:48:46 -------- d-----w- C:\SDFix

    2011-08-10 16:25:14 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

    2011-08-10 16:25:05 -------- d-----w- C:\Program Files\Microsoft Security Client

    2011-08-10 04:57:53 25160 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys

    2011-08-10 04:57:31 -------- d-----w- C:\ProgramData\Hitman Pro

    2011-08-10 04:34:19 -------- d-----w- C:\Program Files\COMODO

    2011-08-09 16:07:14 -------- d-----w- C:\Users\User\AppData\Local\NPE

    2011-08-09 00:28:57 -------- d-----w- C:\Users\User\AppData\Roaming\SUPERAntiSpyware.com

    2011-08-09 00:27:04 -------- d-----w- C:\ProgramData\!SASCORE

    2011-08-09 00:26:54 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

    2011-08-09 00:26:54 -------- d-----w- C:\Program Files\SUPERAntiSpyware

    2011-08-08 22:11:12 -------- d-----w- C:\Windows\System32\drivers\NISx64\1300000.080

    2011-08-08 22:11:12 -------- d-----w- C:\Windows\System32\drivers\NISx64

    2011-08-08 21:17:53 151933 ----a-w- C:\ProgramData\1312838169.bdinstall.bin

    2011-08-08 14:27:47 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

    2011-08-08 14:27:43 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2011-08-08 14:25:02 374664 ----a-w- C:\Windows\System32\drivers\netio.sys

    2011-08-07 19:20:11 193267 ----a-w- C:\ProgramData\1312744570.bdinstall.bin

    2011-08-07 19:18:35 65024 --sha-r- C:\Windows\SysWow64\KBDDIV2S.dll

    2011-08-07 19:16:31 -------- d-----w- C:\Users\User\AppData\Roaming\QuickScan

    2011-08-07 19:15:46 -------- d-----w- C:\Program Files (x86)\Common Files\Bitdefender

    2011-08-04 16:00:12 134104 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll

    2011-08-03 20:33:46 628224 ----a-w- C:\Windows\system\lame_enc.dll

    2011-08-03 20:31:25 517632 ----a-w- C:\Windows\SysWow64\7za.exe

    2011-08-02 23:09:35 -------- d-----w- C:\Users\User\AppData\Local\Native Instruments

    2011-08-02 23:02:29 -------- d-----w- C:\Program Files\Common Files\Native Instruments

    2011-08-02 23:01:36 -------- d-----w- C:\Users\User\New folder

    2011-08-02 22:32:26 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Lite

    2011-08-02 19:25:33 -------- d-----w- C:\Users\User\AppData\Local\uTorrent

    2011-08-02 18:15:52 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll

    2011-08-02 16:38:12 -------- d-----w- C:\Users\User\AppData\Roaming\Image-Line

    2011-08-02 16:23:46 -------- d-----w- C:\Users\User\AppData\Roaming\SynthMaker

    2011-08-02 16:01:17 -------- d-----w- C:\Program Files (x86)\ASIO4ALL v2

    2011-08-02 16:00:47 1554944 ----a-w- C:\Windows\SysWow64\vorbis.acm

    2011-07-29 22:59:35 -------- d-----w- C:\Users\User\AppData\Local\{BC342347-B062-497C-9475-BEE97A111847}

    2011-07-29 21:21:39 14336 ------w- C:\Windows\System32\drivers\sffp_sd.sys

    2011-07-29 21:21:39 109056 ----a-w- C:\Windows\System32\drivers\sdbus.sys

    2011-07-27 23:27:41 -------- d-----w- C:\Users\User\SAVEDATA

    2011-07-22 22:55:06 -------- d-----w- C:\Users\User\AppData\Local\{AF1D4A1B-1ECB-43A8-9DF4-22E01C44C1BD}

    2011-07-21 17:12:18 -------- d-----w- C:\Users\User\AppData\Local\{A22A6108-11F1-4621-9978-985295FA9B12}

    2011-07-21 13:45:11 -------- d-----w- C:\Users\User\AppData\Roaming\Fighters

    2011-07-18 17:46:43 -------- d-----w- C:\Program Files (x86)\Lame For Audacity

    2011-07-18 04:45:36 -------- d-----w- C:\Users\User\AppData\Local\WeatherBug

    2011-07-18 04:45:27 -------- d-----w- C:\Users\User\AppData\Roaming\WeatherBug

    2011-07-18 04:45:26 18944 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe

    2011-07-18 04:45:26 11264 ----a-r- C:\Users\User\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A1630.exe

    2011-07-18 04:45:22 -------- d-----w- C:\Program Files (x86)\AWS

    2011-07-18 04:43:34 -------- d-----w- C:\Program Files (x86)\Audacity

    2011-07-18 04:43:33 -------- d-----w- C:\Program Files\Fighters

    2011-07-18 04:43:27 -------- d-----w- C:\ProgramData\Fighters

    2011-07-15 23:12:46 550208 ----a-w- C:\Windows\System32\drivers\avckf.sys

    2011-07-15 23:12:44 258224 ------w- C:\Windows\System32\drivers\avchv.sys

    2011-07-15 18:22:11 -------- d-----w- C:\Users\User\AppData\Local\{6185E1DB-12BF-4977-80C5-C4E4B340FE0C}

    2011-07-13 15:21:56 3134464 ----a-w- C:\Windows\System32\win32k.sys

    2011-07-13 03:42:21 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine

    2011-07-12 16:48:50 -------- d-----w- C:\Users\User\AppData\Local\{C437954F-376C-4362-B241-634EAF740347}

    .

    ==================== Find3M ====================

    .

    2011-07-07 02:52:42 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2011-06-26 18:41:59 4770816 ----a-w- C:\unetbtin.exe

    2011-06-22 19:53:34 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2011-06-18 20:44:12 318000 ------w- C:\Windows\System32\drivers\SynTP.sys

    2011-06-18 20:44:12 214824 ----a-w- C:\Windows\System32\SynTPAPI.dll

    2011-06-18 20:44:12 147752 ----a-w- C:\Windows\System32\SynTPCo4.dll

    2011-06-18 20:44:12 107816 ------w- C:\Windows\SysWow64\SynTPCOM.dll

    2011-06-18 20:44:11 396584 ----a-w- C:\Windows\System32\SynCOM.dll

    2011-06-18 20:44:11 265000 ----a-w- C:\Windows\System32\SynCtrl.dll

    2011-06-18 20:44:11 210216 ----a-w- C:\Windows\SysWow64\SynCtrl.dll

    2011-06-18 20:44:11 173352 ----a-w- C:\Windows\SysWow64\SynCOM.dll

    2011-06-02 06:45:22 362496 ----a-w- C:\Windows\System32\wow64win.dll

    2011-06-02 06:45:22 243200 ----a-w- C:\Windows\System32\wow64.dll

    2011-06-02 06:45:22 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

    2011-06-02 06:44:54 214528 ----a-w- C:\Windows\System32\winsrv.dll

    2011-06-02 06:42:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

    2011-06-02 06:39:54 422400 ----a-w- C:\Windows\System32\KernelBase.dll

    2011-06-02 06:35:56 338944 ----a-w- C:\Windows\System32\conhost.exe

    2011-06-02 05:59:44 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

    2011-06-02 05:56:28 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

    2011-06-02 05:56:06 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

    2011-06-02 05:54:51 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

    2011-06-02 05:54:50 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll

    2011-06-02 03:51:00 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

    2011-06-02 03:50:59 2048 ----a-w- C:\Windows\SysWow64\user.exe

    2011-06-02 03:45:49 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

    2011-06-02 03:45:49 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

    2011-06-02 03:45:49 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

    2011-06-02 03:45:49 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

    2011-05-28 03:25:16 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

    2011-05-28 03:00:02 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2011-05-24 11:21:59 404992 ----a-w- C:\Windows\System32\umpnpmgr.dll

    2011-05-24 10:34:20 64512 ----a-w- C:\Windows\SysWow64\devobj.dll

    2011-05-24 10:34:20 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll

    2011-05-24 10:34:00 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll

    2011-05-24 10:32:46 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe

    2011-05-24 00:04:02 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

    2011-05-22 19:30:55 468480 ----a-w- C:\Windows\System32\deployJava1.dll

    2011-05-20 03:21:26 338432 ----a-w- C:\Windows\SysWow64\REX Shared Library.dll

    2011-05-20 03:21:25 406528 ----a-w- C:\Windows\SysWow64\ReWire.dll

    2011-05-17 01:35:14 56752 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys

    2011-05-17 01:35:14 156912 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys

    2011-05-17 01:35:12 44848 ----a-w- C:\Windows\System32\drivers\VBoxUSB.sys

    2011-05-17 01:35:12 231600 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys

    .

    ============= FINISH: 19:16:05.66 ===============

    Please ignore bitdefender I didnt uninstall it correctly but I fixed that and used the correct uninstall tool for it.

    Attach.zip

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.