scvhost and Adobe Flash player Virus

Ghostshell · August 10, 2012

Hello, recently i was infected with an scvhost and adobe flash player virus. Under task manager i can see from 2-8 scvhosts running, and adobe flash player constantly crashes, asks to try and update which i always cancel. I cannot get rid of this virus myself, i appreciate any sort of assistance in cleaning up my system.

Thank you, i have pasted DDS log, attached the attach log, and also a malwarebytes log at the bottom

(PS no matter how many times i run malwarebytes the rootkits/trojans keep showing up)

DDS log

============

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_31

Run by Ghostshell at 12:05:25 on 2012-08-10

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8180.3951 [GMT -7:00]

.

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\PROGRA~2\AVG\AVG2012\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files (x86)\Stardock\MyColors\VistaSrv.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\Stardock\MyColors\WBVista.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe

C:\Program Files\Alienware\Command Center\AlienFusionService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files (x86)\OSD\OSD_Service.exe

c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe

C:\Program Files (x86)\AVG\AVG2012\avgemca.exe

C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Alienware\Command Center\AlienFusionController.exe

C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\AVG\AVG2012\avgtray.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Alienware\Command Center\AlienSense\FATrayAlert.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Alienware\Command Center\AlienFXHook32Mngr.exe

C:\Program Files\Alienware\Command Center\AlienFXHook64Mngr.exe

C:\Windows\system32\conhost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

-netsvcs

C:\Windows\system32\conhost.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDns

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\DllHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://isearch.avg.com/?cid={66452CD3-7FAD-429C-82D2-C6A90D55E54A}&mid=500452e994ba47d1b4dd787cac9f0712-48643e70690374b37bf2810e9fd57bd51de19c8a〈=en&ds=ft011&pr=sa&d=2012-07-06 23:20:37&v=11.1.0.12&sap=hp

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll

BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: SSOIEAddonBHO Class: {da5bce70-d057-4d63-943d-5f3927ec59f1} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: Microsoft Web Test Recorder 10.0 Helper: {dda57003-0068-4ed2-9d32-4d1ec707d94d} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

mRun: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe

mRun: [YouCam Mirage] "C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"

mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

mRun: [FAStartup]

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\MyColors\SDDelayedLaunch.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A}\2375942554632333 : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A}\2375942554638383 : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A}\4586560224164736166756 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A}\46C696E6B602231333 : DhcpNameServer = 128.54.16.2 132.239.0.252

TCP: Interfaces\{3DE8CC97-3A1E-4A03-BC04-24E47C25F59A}\C696E6B6379737 : DhcpNameServer = 209.18.47.61 209.18.47.62

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Notify: FastAccess - C:\Program Files\Alienware\Command Center\AlienSense\FALogNot.dll

LSA: Notification Packages = scecli FAPassSync

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll

BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File

BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: SSOIEAddonBHO Class: {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - C:\Program Files\Alienware\Command Center\AlienSense\FAIESSO.dll

BHO-X64: SSOIEAddonBHO - No File

BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: Microsoft Web Test Recorder 10.0 Helper: {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll

TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

mRun-x64: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe

mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"

mRun-x64: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

mRun-x64: [FAStartup]

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRunOnce-x64: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Ghostshell\AppData\Roaming\Mozilla\Firefox\Profiles\r5k9gv91.default\

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: C:\Users\Ghostshell\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\Ghostshell\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8fAMlSQM&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - 32b459e3000000000000c446192559ba

FF - user.js: extensions.incredibar_i.hardId - 32b459e3000000000000c446192559ba

FF - user.js: extensions.incredibar_i.instlDay - 15341

FF - user.js: extensions.incredibar_i.vrsn - 1.5.3.27

FF - user.js: extensions.incredibar_i.vrsni - 1.5.3.27

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.3.2721:50:50

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6R8fAMlSQM

FF - user.js: extensions.incredibar_i.upn2n - 92823603489226040

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10589

FF - user.js: extensions.incredibar_i.ppd -

user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]

R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]

R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe [2011-6-29 89600]

R2 AlienFusionService;Alienware Fusion Service;C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2010-5-21 14648]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2011-8-2 192776]

R2 FAService;FAService;C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe [2010-4-4 2409800]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-6-27 2369960]

R2 HappyOSD;HappyOSD;C:\Program Files (x86)\OSD\OSD_Service.exe [2010-1-4 16384]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-7-16 1262400]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-5-15 382272]

R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\system32\DRIVERS\TurboB.sys --> C:\Windows\system32\DRIVERS\TurboB.sys [?]

R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]

R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]

R3 BcmVWL;Broadcom Virtual Wireless;C:\Windows\system32\DRIVERS\bcmvwl64.sys --> C:\Windows\system32\DRIVERS\bcmvwl64.sys [?]

R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;C:\Windows\system32\DRIVERS\e1k62x64.sys --> C:\Windows\system32\DRIVERS\e1k62x64.sys [?]

R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys --> C:\Windows\system32\DRIVERS\itecir.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944]

S3 DAdderFltr;DeathAdder Mouse;C:\Windows\system32\drivers\dadder.sys --> C:\Windows\system32\drivers\dadder.sys [?]

S3 FACAP;facap, FastAccess Video Capture;C:\Windows\system32\DRIVERS\facap.sys --> C:\Windows\system32\DRIVERS\facap.sys [?]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\system32\DRIVERS\ManyCam_x64.sys --> C:\Windows\system32\DRIVERS\ManyCam_x64.sys [?]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 113120]

S3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 VSPerfDrv100;Performance Tools Driver 10.0;C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-3-17 68440]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-22 61976]

S4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys --> C:\Windows\system32\DRIVERS\RsFx0103.sys [?]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-3-30 427880]

.

=============== Created Last 30 ================

.

2012-08-10 00:19:55 20480 ------w- C:\Windows\svchost.exe

2012-08-04 02:45:28 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\EBFC.tmp

2012-08-04 02:45:28 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\EBFB.tmp

2012-08-02 03:48:59 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\4158.tmp

2012-08-01 18:18:44 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-01 18:18:44 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-07-30 22:36:50 -------- d-----w- C:\Users\Ghostshell\AppData\Local\Macromedia

2012-07-21 18:44:30 -------- d-----w- C:\Users\Ghostshell\AppData\Roaming\libimobiledevice

2012-07-21 18:44:19 -------- d-----w- C:\Program Files (x86)\Tansee iPhone Transfer Contact

2012-07-21 18:43:39 -------- d-----w- C:\Users\Ghostshell\AppData\Roaming\GetRightToGo

2012-07-21 16:10:28 -------- d-----w- C:\Program Files\iPod

2012-07-21 16:10:27 -------- d-----w- C:\Program Files\iTunes

2012-07-21 16:10:27 -------- d-----w- C:\Program Files (x86)\iTunes

2012-07-21 16:08:01 -------- d-----w- C:\Program Files\Bonjour

2012-07-21 16:08:01 -------- d-----w- C:\Program Files (x86)\Bonjour

2012-07-20 09:17:03 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\692D.tmp

2012-07-19 04:54:25 -------- d-----w- C:\Program Files (x86)\MALWAREBYTES ANTI-MALWARE

2012-07-18 21:09:20 -------- d-----w- C:\Users\Ghostshell\AppData\Roaming\Clipdiary

2012-07-18 06:03:09 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\C2B3.tmp

2012-07-18 04:45:27 -------- d-----w- C:\$RECYCLE.BIN

2012-07-18 04:22:32 -------- d-----w- C:\TDSSKiller_Quarantine

2012-07-18 03:06:01 -------- d-----w- C:\Program Files (x86)\Diablo III

2012-07-18 03:05:18 -------- d-----w- C:\ProgramData\Battle.net

2012-07-16 20:44:47 889664 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-07-16 20:44:47 63296 ----a-w- C:\Windows\System32\nvshext.dll

2012-07-16 20:44:47 6151488 ----a-w- C:\Windows\System32\nvcpl.dll

2012-07-16 20:44:47 3149632 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-07-16 20:44:47 2561856 ----a-w- C:\Windows\System32\nvsvcr.dll

2012-07-16 20:44:47 118080 ----a-w- C:\Windows\System32\nvmctray.dll

2012-07-16 20:43:09 -------- d-----w- C:\ProgramData\NVIDIA Corporation

2012-07-16 09:48:12 -------- d-----w- C:\Program Files (x86)\OApps

2012-07-16 09:48:11 -------- d-----w- C:\Program Files (x86)\TorrentSearch

2012-07-16 09:47:05 -------- d-----w- C:\Program Files (x86)\smartdl

2012-07-13 20:07:47 978944 ----a-w- C:\Windows\System32\msvcp71.dll

2012-07-13 20:07:47 520192 ----a-w- C:\Windows\System32\msvcr71.dll

2012-07-13 20:07:47 403456 ----a-w- C:\Windows\System32\nvcpl.cpl

2012-07-13 20:07:47 381952 ----a-w- C:\Windows\System32\nvexpBar.dll

2012-07-13 20:07:47 372736 ----a-w- C:\Windows\System32\NVUNINST.EXE

2012-07-13 20:07:47 2065920 ----a-w- C:\Windows\System32\nvcplUI.exe

2012-07-13 20:07:47 1524736 ----a-w- C:\Windows\System32\MFC71.dll

2012-07-13 20:07:47 1064448 ----a-w- C:\Windows\System32\nvcplUIR.dll

2012-07-13 20:07:28 -------- d-----w- C:\Users\Ghostshell\AppData\Local\NVIDIA Corporation

2012-07-13 20:05:56 -------- d-----w- C:\Program Files (x86)\NVIDIA nTune Performance Application

2012-07-12 19:53:00 31040 ----a-w- C:\Windows\System32\nvhdap64.dll

2012-07-12 19:53:00 188736 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys

.

==================== Find3M ====================

.

2012-07-03 20:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-05-15 09:21:50 423744 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

.

============= FINISH: 12:06:54.26 ===============

=======

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.07.05

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Ghostshell :: GHOSTSHELL-PC [administrator]

8/10/2012 12:15:01 PM

mbam-log-2012-08-10 (12-15-01).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 245559

Time elapsed: 5 minute(s), 40 second(s)

Memory Processes Detected: 1

C:\Windows\svchost.exe (Trojan.Agent) -> 1852 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 4

C:\Windows\Installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.

C:\Windows\Installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\U\000000cb.@ (Rootkit.0Access) -> Quarantined and deleted successfully.

C:\Windows\Installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\U\80000032.@ (Rootkit.0Access) -> Quarantined and deleted successfully.

C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

(end)

Attach.txt

MrCharlie · August 10, 2012

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Ghostshell · August 10, 2012

thank you so much for helping me out

here is the report

=====================

RogueKiller V7.6.6 [08/10/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User: Ghostshell [Admin rights]

Mode: Scan -- Date: 08/10/2012 12:30:14

¤¤¤ Bad processes: 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 2 ¤¤¤

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : c:\windows\installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\windows\installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\windows\installer\{b0088f9a-acc5-2298-9acf-2528dd478996}\L --> FOUND

[ZeroAccess][FILE] @ : c:\users\ghostshell\appdata\local\{b0088f9a-acc5-2298-9acf-2528dd478996}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\users\ghostshell\appdata\local\{b0088f9a-acc5-2298-9acf-2528dd478996}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\users\ghostshell\appdata\local\{b0088f9a-acc5-2298-9acf-2528dd478996}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND

[susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> FOUND

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess|Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9250410AS ATA Device +++++

--- User ---

[MBR] 478efe6c5c618819af8753cb9435931d

[bSP] 7c235b53190a6021ae3d31243aeafecb : Windows 7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 238373 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] c46d375b88798304d258979fb76d4845

[bSP] 7c235b53190a6021ae3d31243aeafecb : Windows 7 MBR Code

Partition table:

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 238373 Mo

Finished : << RKreport[1].txt >>

RKreport[1].txt

MrCharlie · August 10, 2012

¤¤¤ Infection : ZeroAccess|Root.MBR ¤¤¤

Here you go......

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.
BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451
When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063
I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.
Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please make sure system restore is running and create a new restore point before continuing!

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
services.exe
[*]Now press the Search button
[*]When the search is complete, search.txt will also be written to your USB
[*]Type exit and reboot the computer normally
[*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

MrC

Ghostshell · August 10, 2012

Going to go through with the clean up now, i will post the logs after doing the steps above, thank you

Ghostshell · August 10, 2012

Alright here is the FRST.txt

Scan result of Farbar Recovery Scan Tool Version: 09-08-2012

Ran by SYSTEM at 10-08-2012 13:08:36

Running from F:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AlienFX Controller] "C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe" [63304 2010-05-21] (Alienware Corporation)

HKLM\...\Run: [broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [5712896 2010-02-02] (Dell Inc.)

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-09-15] (IDT, Inc.)

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2108200 2010-04-01] (Synaptics Incorporated)

HKLM\...\Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()

HKLM-x32\...\Run: [FATrayAlert] C:\Program Files\Alienware\Command Center\AlienSense\FATrayMon.exe [95560 2010-04-04] (Sensible Vision )

HKLM-x32\...\Run: [YouCam Mirage] "C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe" [136488 2011-02-25] (CyberLink)

HKLM-x32\...\Run: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe" [2416480 2012-01-24] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [FAStartup] [x]

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)

HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1085000 2012-07-03] (Malwarebytes Corporation)

Winlogon\Notify\WB: C:\Program Files (x86)\Stardock\MyColors\fast64.dll [X]

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Lsa: [Notification Packages] scecli

FAPassSync

Startup: C:\Users\All Users\Start Menu\Programs\Startup\Stardock MyColors.lnk

ShortcutTarget: Stardock MyColors.lnk -> C:\Program Files (x86)\Stardock\MyColors\SDDelayedLaunch.exe ()

Startup: C:\Users\UpdatusUser\Start Menu\Programs\Startup\IconPackager.lnk

ShortcutTarget: IconPackager.lnk -> C:\Program Files (x86)\Stardock\MyColors\IconPackager.exe (Stardock Corporation)

==================== Services (Whitelisted) ======

2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe" [4433248 2011-10-12] (AVG Technologies CZ, s.r.o.)

2 avgwd; "C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe" [192776 2011-08-02] (AVG Technologies CZ, s.r.o.)

2 FAService; C:\Program Files\Alienware\Command Center\AlienSense\FAService.exe [2409800 2010-04-04] (Sensible Vision )

2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [2369960 2012-06-27] (LogMeIn Inc.)

2 HappyOSD; C:\Program Files (x86)\OSD\OSD_Service.exe [16384 2010-01-04] ()

2 MSSQL$SQLEXPRESS; "C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS [57617752 2009-03-30] (Microsoft Corporation)

2 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe /StartService [180224 2007-09-04] (NVIDIA)

4 SQLAgent$SQLEXPRESS; "C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -i SQLEXPRESS [427880 2009-03-30] (Microsoft Corporation)

2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_056607ee0106e5e8\STacSV64.exe [240640 2009-09-15] (IDT, Inc.)

2 WindowBlinds; C:\Program Files (x86)\Stardock\MyColors\VistaSrv.exe [337200 2009-06-09] (Stardock Corporation)

========================== Drivers (Whitelisted) =============

3 AVGIDSDriver; C:\Windows\System32\Drivers\AVGIDSDriver.sys [120400 2011-07-11] (AVG Technologies CZ, s.r.o. )

0 AVGIDSEH; C:\Windows\System32\Drivers\AVGIDSEH.sys [26704 2011-07-11] (AVG Technologies CZ, s.r.o. )

3 AVGIDSFilter; C:\Windows\System32\Drivers\AVGIDSFilter.sys [29776 2011-07-11] (AVG Technologies CZ, s.r.o. )

1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [283728 2011-10-07] (AVG Technologies CZ, s.r.o.)

1 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [46672 2011-08-08] (AVG Technologies CZ, s.r.o.)

0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [37456 2011-09-13] (AVG Technologies CZ, s.r.o.)

1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [375376 2011-07-11] (AVG Technologies CZ, s.r.o.)

3 DAdderFltr; C:\Windows\System32\drivers\dadder.sys [12672 2007-08-02] (Razer (Asia-Pacific) Pte Ltd)

3 e1kexpress; C:\Windows\System32\DRIVERS\e1k62x64.sys [273072 2009-06-22] (Intel Corporation)

3 hamachi; C:\Windows\System32\Drivers\hamachi.sys [33856 2009-03-18] (LogMeIn, Inc.)

3 netr28ux; C:\Windows\System32\Drivers\netr28ux.sys [966144 2009-05-25] (Ralink Technology Corp.)

3 NVR0Dev; \??\C:\Windows\nvoclk64.sys [39968 2007-09-04] (NVidia Corp.)

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-10 12:02 - 2012-08-10 12:02 - 01439703 ____A (Farbar) C:\Users\Ghostshell\Desktop\FRST64.exe

2012-08-10 11:30 - 2012-08-10 11:30 - 00002501 ____A C:\Users\Ghostshell\Desktop\RKreport[1].txt

2012-08-10 11:28 - 2012-08-10 11:30 - 00000000 ____D C:\Users\Ghostshell\Desktop\RK_Quarantine

2012-08-10 11:28 - 2012-08-10 11:28 - 01558528 ____A C:\Users\Ghostshell\Desktop\RogueKiller.exe

2012-08-10 11:11 - 2012-08-10 11:11 - 00027720 ____A C:\Users\Ghostshell\Desktop\Attach.txt

2012-08-10 11:11 - 2012-08-10 11:11 - 00021645 ____A C:\Users\Ghostshell\Desktop\DDS.txt

2012-08-09 17:44 - 2012-08-09 17:44 - 00607260 ____R (Swearware) C:\Users\Ghostshell\Desktop\dds.scr

2012-08-09 16:57 - 2012-08-09 16:57 - 00000000 ____A C:\Users\Ghostshell\CD

2012-08-09 16:19 - 2009-07-13 17:14 - 00020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe

2012-08-08 10:19 - 2012-08-08 10:20 - 00000600 ____A C:\Users\Ghostshell\AppData\Local\PUTTY.RND

2012-08-08 10:16 - 2012-08-08 10:20 - 00000000 ____D C:\Users\Ghostshell\AppData\Roaming\FileZilla

2012-08-08 10:15 - 2012-08-08 10:16 - 04518720 ____A (FileZilla Project) C:\Users\Ghostshell\Downloads\FileZilla_3.5.3_win32-setup.exe

2012-08-08 10:13 - 2012-08-08 21:06 - 00000000 ____D C:\Users\Ghostshell\Desktop\Chicken

2012-08-08 09:10 - 2012-08-09 17:01 - 00000560 ____A C:\Windows\setupact.log

2012-08-08 09:10 - 2012-08-08 09:10 - 00001040 ____A C:\Windows\PFRO.log

2012-08-08 09:10 - 2012-08-08 09:10 - 00000000 ____A C:\Windows\setuperr.log

2012-08-07 12:37 - 2012-08-07 12:37 - 00034818 ____A C:\Users\Ghostshell\Documents\cc_20120807_133730.reg

2012-08-03 19:17 - 2012-08-03 19:18 - 05021143 ____A C:\Windows\System32\Drivers\Cat.DB

2012-08-03 19:06 - 2012-08-03 19:06 - 00367272 ____A (RegNow.com) C:\Users\Ghostshell\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial.exe

2012-08-01 10:18 - 2012-08-01 10:18 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-01 10:18 - 2012-08-01 10:18 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-07-30 14:36 - 2012-07-30 14:36 - 00000000 ____D C:\Users\Ghostshell\AppData\Local\Macromedia

2012-07-30 14:28 - 2012-07-30 14:28 - 00290816 ____A (SUPERAntiSpyware.com) C:\Users\Ghostshell\Downloads\SASUNINST64.EXE

2012-07-29 19:51 - 2012-07-29 19:53 - 76637445 ____A C:\Users\Ghostshell\Downloads\iLoL_Open_Beta_1.1.2_installer.dmg

2012-07-28 16:33 - 2012-07-31 10:51 - 00000000 ____D C:\Users\Ghostshell\AppData\Local\Apps\Apple Computer

2012-07-21 10:44 - 2012-08-01 17:43 - 00000000 ____D C:\Program Files (x86)\Tansee iPhone Transfer Contact

2012-07-21 10:44 - 2012-07-21 10:44 - 00000000 ____D C:\Users\Ghostshell\Documents\Tansee

2012-07-21 10:44 - 2012-07-21 10:44 - 00000000 ____D C:\Users\Ghostshell\AppData\Roaming\libimobiledevice

2012-07-21 10:43 - 2012-08-03 19:16 - 00000000 ____D C:\Users\Ghostshell\AppData\Roaming\GetRightToGo

2012-07-21 10:43 - 2012-07-21 10:43 - 00367272 ____A (RegNow.com) C:\Users\Ghostshell\Downloads\Download_tanseeiphonecontact_.exe

2012-07-21 08:11 - 2012-07-21 08:11 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk

2012-07-21 08:10 - 2012-07-21 08:11 - 00000000 ____D C:\Program Files\iTunes

2012-07-21 08:10 - 2012-07-21 08:11 - 00000000 ____D C:\Program Files (x86)\iTunes

2012-07-21 08:10 - 2012-07-21 08:10 - 00000000 ____D C:\Program Files\iPod

2012-07-21 08:08 - 2012-07-21 08:08 - 00000000 ____D C:\Program Files\Bonjour

2012-07-21 08:08 - 2012-07-21 08:08 - 00000000 ____D C:\Program Files (x86)\Bonjour

2012-07-21 08:07 - 2012-07-21 08:07 - 00001845 ____A C:\Users\Public\Desktop\QuickTime Player.lnk

2012-07-21 08:07 - 2012-07-21 08:07 - 00000000 ____D C:\Program Files (x86)\QuickTime

2012-07-18 21:58 - 2012-07-18 21:58 - 02686176 ____A (McAfee, Inc.) C:\Users\Ghostshell\Downloads\McAfeeScanAndRepair3_Release.exe

2012-07-18 21:05 - 2012-07-18 21:05 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\Ghostshell\Desktop\tdsskiller.exe

2012-07-18 20:54 - 2012-07-18 20:54 - 00000000 ____D C:\Program Files (x86)\MALWAREBYTES ANTI-MALWARE

2012-07-18 13:09 - 2012-07-18 20:52 - 00000000 ____D C:\Users\Ghostshell\AppData\Roaming\Clipdiary

2012-07-18 13:08 - 2012-07-18 13:08 - 02689442 ____A C:\Users\Ghostshell\Downloads\clipdiary_3.4.exe

2012-07-18 12:36 - 2012-07-18 12:36 - 18651528 ____A (SUPERAntiSpyware.com) C:\Users\Ghostshell\Downloads\SUPERAntiSpyware(1).exe

2012-07-18 09:10 - 2012-07-18 09:10 - 18646144 ____A (SUPERAntiSpyware.com) C:\Users\Ghostshell\Downloads\SUPERAntiSpyware.exe

2012-07-17 22:28 - 2012-07-17 22:28 - 00000000 ____D C:\Users\Ghostshell\Documents\Diablo III

2012-07-17 20:31 - 2012-07-17 21:04 - 00000000 ____D C:\Windows\erdnt

2012-07-17 20:22 - 2012-07-18 21:09 - 00000000 ____D C:\TDSSKiller_Quarantine

2012-07-17 19:06 - 2012-07-17 21:22 - 00000000 ____D C:\Program Files (x86)\Diablo III

2012-07-17 19:06 - 2012-07-17 19:06 - 00001189 ____A C:\Users\Public\Desktop\Diablo III.lnk

2012-07-17 19:05 - 2012-07-17 19:05 - 00000000 ____D C:\Users\All Users\Battle.net

2012-07-17 19:04 - 2012-07-17 19:05 - 40048208 ____A (Blizzard Entertainment) C:\Users\Ghostshell\Downloads\Diablo-III-Setup-enUS.exe

2012-07-17 15:37 - 2012-07-17 15:37 - 00130802 ____A C:\Users\Ghostshell\Documents\cc_20120717_163659.reg

2012-07-17 13:39 - 2012-07-17 13:39 - 00001127 ____A C:\Users\Ghostshell\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 19:15 - 2012-07-16 19:41 - 00000000 ____D C:\Users\Ghostshell\Downloads\Katy Perry - Teenage Dream

2012-07-16 15:15 - 2012-07-16 15:15 - 00226433 ____A C:\Users\Ghostshell\Desktop\D3UnidPredict.zip

2012-07-16 12:49 - 2012-05-15 02:48 - 25743168 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv64.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 25248064 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 19607872 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 18044224 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dumx.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 17551680 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 15322432 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 14298944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys

2012-07-16 12:49 - 2012-05-15 02:48 - 10194752 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2umx.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 08139072 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 08105280 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 05982528 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 02881856 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 02741568 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi64.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 02681664 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 02524992 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2012-07-16 12:49 - 2012-05-15 02:48 - 02445120 ____A (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2012-07-16 12:46 - 2012-07-16 12:48 - 214613632 ____A (NVIDIA Corporation) C:\Users\Ghostshell\Downloads\301.42-notebook-win7-winvista-64bit-international-whql(1).exe

2012-07-16 12:45 - 2012-07-16 12:45 - 00000020 ___SH C:\Users\UpdatusUser.Ghostshell-PC\ntuser.ini

2012-07-16 12:45 - 2012-07-16 12:45 - 00000000 ____D C:\users\UpdatusUser.Ghostshell-PC

2012-07-16 12:44 - 2012-05-15 01:29 - 03149632 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc64.dll

2012-07-16 12:44 - 2012-05-15 01:29 - 02561856 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll

2012-07-16 12:44 - 2012-05-15 01:29 - 00889664 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

2012-07-16 12:44 - 2012-05-15 01:29 - 00118080 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll

2012-07-16 12:44 - 2012-05-15 01:29 - 00063296 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll

2012-07-16 12:44 - 2012-05-15 01:28 - 06151488 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll

2012-07-16 12:43 - 2012-07-16 12:43 - 00000000 ____D C:\Users\All Users\NVIDIA Corporation

2012-07-16 01:48 - 2012-07-16 01:48 - 00000000 ____D C:\Program Files (x86)\TorrentSearch

2012-07-16 01:47 - 2012-07-18 14:02 - 00000000 ____D C:\Program Files (x86)\smartdl

2012-07-14 11:23 - 2012-07-14 11:23 - 03216374 ____A (Blizzard Entertainment) C:\Users\Ghostshell\Downloads\StarCraft_2_NA_en-US(2).exe

2012-07-14 11:18 - 2012-07-14 11:18 - 03216374 ____A (Blizzard Entertainment) C:\Users\Ghostshell\Downloads\StarCraft_2_NA_en-US(1).exe

2012-07-14 11:17 - 2012-07-14 11:17 - 00604032 ____A (SlimWare Utilities, Inc.) C:\Users\Ghostshell\Downloads\FixCleanerSetup.exe

2012-07-13 12:07 - 2012-07-13 12:07 - 00000000 ____D C:\Users\Ghostshell\AppData\Local\NVIDIA Corporation

2012-07-13 12:07 - 2012-07-13 12:06 - 00372736 ____A (NVIDIA Corporation) C:\Windows\System32\NVUNINST.EXE

2012-07-13 12:07 - 2007-07-03 15:41 - 01524736 ____A (Microsoft Corporation) C:\Windows\System32\MFC71.dll

2012-07-13 12:07 - 2007-07-03 15:41 - 00978944 ____A (Microsoft Corporation) C:\Windows\System32\msvcp71.dll

2012-07-13 12:07 - 2007-07-03 15:41 - 00520192 ____A C:\Windows\System32\msvcr71.dll

2012-07-13 12:07 - 2007-06-25 21:21 - 02065920 ____A C:\Windows\System32\nvcplUI.exe

2012-07-13 12:07 - 2007-06-25 21:21 - 01064448 ____A (NVIDIA Corporation) C:\Windows\System32\nvcplUIR.dll

2012-07-13 12:07 - 2007-06-25 21:21 - 00403456 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.cpl

2012-07-13 12:07 - 2007-06-25 21:21 - 00381952 ____A (NVIDIA Corporation) C:\Windows\System32\nvexpBar.dll

2012-07-13 12:05 - 2012-07-13 12:05 - 43265912 ____A (NVIDIA Corporation ) C:\Users\Ghostshell\Downloads\5.05.54.00_ntune_winxp_international.exe

2012-07-13 12:05 - 2012-07-13 12:05 - 00000000 ____D C:\Program Files (x86)\NVIDIA nTune Performance Application

2012-07-12 11:53 - 2012-04-18 09:08 - 00188736 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvhda64v.sys

2012-07-12 11:53 - 2012-04-18 09:08 - 00031040 ____A (NVIDIA Corporation) C:\Windows\System32\nvhdap64.dll

2012-07-12 11:49 - 2012-07-12 11:51 - 214613632 ____A (NVIDIA Corporation) C:\Users\Ghostshell\Downloads\301.42-notebook-win7-winvista-64bit-international-whql.exe

============ 3 Months Modified Files ========================

2012-08-10 12:02 - 2012-08-10 12:02 - 01439703 ____A (Farbar) C:\Users\Ghostshell\Desktop\FRST64.exe

2012-08-10 11:56 - 2009-07-13 21:13 - 00869840 ____A C:\Windows\System32\PerfStringBackup.INI

2012-08-10 11:30 - 2012-08-10 11:30 - 00002501 ____A C:\Users\Ghostshell\Desktop\RKreport[1].txt

2012-08-10 11:28 - 2012-08-10 11:28 - 01558528 ____A C:\Users\Ghostshell\Desktop\RogueKiller.exe

2012-08-10 11:27 - 2012-06-26 17:17 - 00000928 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3283257569-265424493-2168791217-1000UA.job

2012-08-10 11:15 - 2011-10-24 14:05 - 00000948 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3283257569-265424493-2168791217-1000UA.job

2012-08-10 11:11 - 2012-08-10 11:11 - 00027720 ____A C:\Users\Ghostshell\Desktop\Attach.txt

2012-08-10 11:11 - 2012-08-10 11:11 - 00021645 ____A C:\Users\Ghostshell\Desktop\DDS.txt

2012-08-09 18:34 - 2012-05-02 22:02 - 00011611 ____A C:\Users\Ghostshell\Desktop\Playlist Start.txt

2012-08-09 17:44 - 2012-08-09 17:44 - 00607260 ____R (Swearware) C:\Users\Ghostshell\Desktop\dds.scr

2012-08-09 17:08 - 2009-07-13 20:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-09 17:08 - 2009-07-13 20:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-09 17:01 - 2012-08-08 09:10 - 00000560 ____A C:\Windows\setupact.log

2012-08-09 17:01 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-09 16:57 - 2012-08-09 16:57 - 00000000 ____A C:\Users\Ghostshell\CD

2012-08-09 16:46 - 2009-07-13 21:08 - 00032554 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2012-08-09 16:17 - 2011-06-29 11:33 - 01422051 ____A C:\Windows\WindowsUpdate.log

2012-08-09 15:27 - 2012-06-26 17:17 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3283257569-265424493-2168791217-1000Core.job

2012-08-09 14:27 - 2011-10-24 14:05 - 00000926 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3283257569-265424493-2168791217-1000Core.job

2012-08-08 10:20 - 2012-08-08 10:19 - 00000600 ____A C:\Users\Ghostshell\AppData\Local\PUTTY.RND

2012-08-08 10:16 - 2012-08-08 10:15 - 04518720 ____A (FileZilla Project) C:\Users\Ghostshell\Downloads\FileZilla_3.5.3_win32-setup.exe

2012-08-08 09:10 - 2012-08-08 09:10 - 00001040 ____A C:\Windows\PFRO.log

2012-08-08 09:10 - 2012-08-08 09:10 - 00000000 ____A C:\Windows\setuperr.log

2012-08-07 12:37 - 2012-08-07 12:37 - 00034818 ____A C:\Users\Ghostshell\Documents\cc_20120807_133730.reg

2012-08-03 19:18 - 2012-08-03 19:17 - 05021143 ____A C:\Windows\System32\Drivers\Cat.DB

2012-08-03 19:06 - 2012-08-03 19:06 - 00367272 ____A (RegNow.com) C:\Users\Ghostshell\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial.exe

2012-08-01 10:18 - 2012-08-01 10:18 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-08-01 10:18 - 2012-08-01 10:18 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-07-30 14:28 - 2012-07-30 14:28 - 00290816 ____A (SUPERAntiSpyware.com) C:\Users\Ghostshell\Downloads\SASUNINST64.EXE

2012-07-29 19:53 - 2012-07-29 19:51 - 76637445 ____A C:\Users\Ghostshell\Downloads\iLoL_Open_Beta_1.1.2_installer.dmg