Unknown virus/malware?

ELVIS7 · March 30, 2013

Last week while looking at my windows 8 startup items I noticed two unusual items: abcebcaafdacdaad.exe and iqewi.exe . searching online did not come up with anything and the reason for my looking at the startup items was because my laptop started playing a "vocal" add and I had no clue where it was coming from, it stopped after I ended those two tasks. when I went to open folder, they were located in c:users/....app data/roaming . Virus scans did not find anything,(Norton,microsoft,lavasoft,) but I managed to finally delete the files by disabling their startup and then restarting and deleting them. since then I downloaded the free version of Mbam (malwarebytes) and do a scan once a day and also check the roaming folder to see if they have reappeared. Today I ran a scan with mbam and it came back with nothing found, I looked at my startup items and the abcebcaafdacdaad.exe was back( although still disabled from starting), I located its file in roaming, in a folder named : 50ab9388-c7e1-4b6c-aa2f-98d6a44c1d4aad . I deleted it without trouble but am now unsecure for I cannot find any info on it online and mbam failed to find the threat. where do I go from here? I have the folder in the trash can, is there a way I can zip it and send it to some place where they study viruses and malware etc?

ELVIS7 · March 30, 2013

also, prior to my restarting the laptop ,disabling acb etc, when ever I would try to delete the file, I would get a message saying cannot delete, file is being used by.... and even when I would end that task, it would jump to a different task and say file is being used by that task.

Maurice Naggar · April 1, 2013

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

ELVIS7 · April 2, 2013

here is the mbam text, ill add dds when done

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16519 BrowserJavaVersion: 10.9.2

Run by Elvis at 23:40:34 on 2013-04-01

Microsoft Windows 8 Pro with Media Center 6.2.9200.0.1252.2.1033.18.8071.5091 [GMT -4:00]

.

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\dwm.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe

C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

C:\Windows\system32\AdminService.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Windows\system32\dashost.exe

C:\Windows\SysWOW64\irstrtsv.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Windows\SysWOW64\rpcnet.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Windows Defender\MsMpEng.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Windows\system32\taskhostex.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\Synaptics\SynTP\DellTouchpad.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Stardock\ObjectDockPlus2\ObjectDock.exe

C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifier.exe

C:\Program Files (x86)\Stardock\ObjectDockPlus2\Dock64.exe

C:\Program Files (x86)\Stardock\ObjectDockPlus2\ObjectDockTray.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files\Zune\ZuneNss.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\MetaGeek\inSSIDer 3\inSSIDer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\WinStore\WSHost.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Windows\notepad.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.ustart.org/

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

uRun: [skyDrive] "C:\Users\Elvis\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background

uRun: [Rogers One Number] "C:\Program Files (x86)\Rogers\Rogers One Number\RogersOneNumber.exe" /startup

uRunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil64_11_6_602_168_Plugin.exe -update plugin

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [FAStartup] <no file>

StartupFolder: C:\Users\Elvis\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\ObjectDockPlus2\ObjectDock.exe

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.11.0.cab

TCP: NameServer = 192.168.1.7

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A} : DHCPNameServer = 192.168.1.7

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A}\34963736F61323238373 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A}\4456E6E69772370275962756C6563737 : DHCPNameServer = 10.0.1.1

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A}\45865602741627C69636B602B496E676 : DHCPNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A}\5414 : DHCPNameServer = 192.168.1.7

TCP: Interfaces\{138FBE68-E408-4D0A-912C-AAF02AFA367A}\7594E444D2D4F62696C656D244130353D223242454 : DHCPNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{799B4C83-AB4E-4794-9AD0-5CE7A5164CA2} : DHCPNameServer = 192.168.1.7

TCP: Interfaces\{799B4C83-AB4E-4794-9AD0-5CE7A5164CA2}\5414 : DHCPNameServer = 192.168.1.7

TCP: Interfaces\{799B4C83-AB4E-4794-9AD0-5CE7A5164CA2}\541423 : DHCPNameServer = 192.168.1.7

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs= C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll, C:\Windows\SysWOW64\nvinit.dll

SSODL: WebCheck - <orphaned>

mASetup: {A6EADE66-0000-0000-484E-7E8A45000000} - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Adobe\Reader 11.0\Esl\AiodLite.dll",CreateReaderUserSettings

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX4

x64-Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"

x64-Run: [DellWPF] C:\Program Files (x86)\Synaptics\SynTP\DellTouchpad.exe /hidegui

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe

x64-mPolicies-System: PromptOnSecureDesktop = dword:0

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

x64-STS: ObjectDockShlExt Class - {1984D045-52CF-49cd-DB77-08F378FEA4DB} - C:\Program Files (x86)\Stardock\ObjectDockPlus2\ODMenu64.dll

.

============= SERVICES / DRIVERS ===============

.

R0 gfibto;gfibto;C:\Windows\System32\Drivers\gfibto.sys [2013-3-24 14456]

R0 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2012-10-27 651832]

R0 nvpciflt;nvpciflt;C:\Windows\System32\Drivers\nvpciflt.sys [2013-3-26 30496]

R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\Drivers\stdcfltn.sys [2012-10-29 22168]

R1 nvkflt;nvkflt;C:\Windows\System32\Drivers\nvkflt.sys [2013-3-26 284448]

R1 SABI;SAMSUNG Kernel Driver For Windows 7;C:\Windows\System32\Drivers\SABI.sys [2012-10-30 13824]

R2 AbsoluteNotifier;Absolute Notifier;C:\Program Files (x86)\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2011-5-10 10920]

R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-10-30 98208]

R2 AtherosSvc;AtherosSvc;C:\Windows\System32\AdminService.exe [2012-8-29 208384]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-10-29 14904]

R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-10-30 2445968]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]

R2 irstrtsv;Intel® Rapid Start Technology Service;C:\Windows\SysWOW64\irstrtsv.exe [2012-11-2 193576]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2012-10-29 165760]

R2 RtkAudioService;Realtek Audio Service;C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [2012-10-30 201360]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-3-14 383264]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-10-29 364416]

R3 akw8x64;Killer Wireless-N 1102 device driver;C:\Windows\System32\Drivers\akw8x64.sys [2012-11-8 3203440]

R3 BtFilter;BtFilter;C:\Windows\System32\Drivers\btfilter.sys [2012-8-29 565760]

R3 BthLEEnum;Bluetooth Low Energy Driver;C:\Windows\System32\Drivers\BthLEEnum.sys [2012-7-25 202752]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-1-10 169752]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\Drivers\IntcDAud.sys [2012-6-19 342528]

R3 irstrtdv;Intel® Rapid Start Technology Driver;C:\Windows\System32\Drivers\irstrtdv.sys [2012-11-2 43800]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\Drivers\RtsPStor.sys [2012-3-29 339600]

R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2013-3-30 723088]

R3 SmbDrvI;SmbDrvI;C:\Windows\System32\Drivers\Smb_driver_Intel.sys [2013-1-10 31032]

R3 ST_ACCEL;STMicroelectronics Accelerometer Service;C:\Windows\System32\Drivers\ST_Accel.sys [2012-10-29 71832]

R3 WSDScan;WSD Scan Support;C:\Windows\System32\Drivers\WSDScan.sys [2012-11-16 23552]

S2 PRTGProbeService;PRTG Probe Service;"C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe" --> C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe [?]

S2 Qualcomm Atheros Killer Service;Qualcomm Atheros Killer Service;"C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe" --> C:\Program Files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [?]

S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed Virtual Adapter;C:\Windows\System32\Drivers\AmpPal.sys [2012-9-13 162344]

S3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;C:\Windows\System32\Drivers\btath_flt.sys [2013-3-19 88728]

S3 BthA2DP;Bluetooth Stereo;C:\Windows\System32\Drivers\BthA2DP.sys [2013-3-13 117632]

S3 BthHFAud;Bluetooth Hands-Free;C:\Windows\System32\Drivers\BthHfAud.sys [2013-3-13 30720]

S3 BthHFSrv;Bluetooth Handsfree Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2012-10-30 29696]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudbus.sys [2012-9-19 102368]

S3 FACAP;facap, FastAccess Video Capture;C:\Windows\System32\Drivers\facap.sys [2008-9-24 238848]

S3 GenericMount;Generic Mount Driver;C:\Windows\System32\Drivers\GenericMount.sys [2009-9-21 66608]

S3 iscFlash;iscFlash;C:\Users\Elvis\AppData\Local\Temp\7zS1F6A.tmp\iscflashx64.sys [2013-1-10 58464]

S3 NETwNe64;@oem35.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit;C:\Windows\System32\Drivers\NETwew00.sys [2012-10-10 4309032]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudmdm.sys [2012-9-19 203104]

S3 SymSnapService;SymSnapService;"C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe" --> C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-7-9 52736]

S3 vmbusr;Virtual Machine Bus Provider;C:\Windows\System32\Drivers\vmbusr.sys [2012-7-25 117248]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\Drivers\wdcsam64.sys [2008-5-6 14464]

S3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]

S3 xusb22;Xbox 360 Wireless Receiver Driver Service 22;C:\Windows\System32\Drivers\xusb22.sys [2012-7-25 89088]

S4 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2012-7-13 769432]

S4 SamsungDeviceConfigurationWinService;SamsungDeviceConfiguration;C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe --> C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [?]

.

=============== Created Last 30 ================

.

2013-04-02 03:09:00 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E1477ECF-4C20-4B26-B0E1-36B21020E782}\offreg.dll

2013-04-02 01:22:30 9311288 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E1477ECF-4C20-4B26-B0E1-36B21020E782}\mpengine.dll

2013-04-01 07:09:29 -------- d-----w- C:\Users\Elvis\AppData\Local\MetaGeek,_LLC

2013-04-01 07:09:29 -------- d-----w- C:\Users\Elvis\AppData\Local\IsolatedStorage

2013-04-01 07:09:23 -------- d-----w- C:\Program Files (x86)\MetaGeek

2013-04-01 05:00:03 9311288 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2013-03-31 02:45:07 -------- d-----w- C:\Windows\LastGood.Tmp

2013-03-31 02:44:23 74344 ----a-w- C:\Windows\System32\RtNicProp64.dll

2013-03-31 02:44:23 723088 ----a-w- C:\Windows\System32\drivers\Rt630x64.sys

2013-03-31 02:37:40 -------- d-----w- C:\Program Files\Dell

2013-03-30 01:37:08 17408 ----a-w- C:\Windows\SysWow64\rpcnetp.dll

2013-03-28 11:44:46 187152 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10197.bin

2013-03-26 05:40:30 873448 ----a-w- C:\Program Files\Windows Defender\MpClient.dll

2013-03-25 03:36:21 -------- d-----w- C:\Users\Elvis\AppData\Roaming\Malwarebytes

2013-03-25 03:35:28 -------- d-----w- C:\ProgramData\Malwarebytes

2013-03-25 03:35:25 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-25 03:35:25 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-25 01:07:27 -------- d-----w- C:\Program Files (x86)\MSECache

2013-03-25 00:56:18 -------- d-----w- C:\Users\Elvis\AppData\Roaming\LavasoftStatistics

2013-03-25 00:53:59 -------- d-----w- C:\ProgramData\Downloaded Installations

2013-03-25 00:53:45 -------- d-----w- C:\Program Files (x86)\adawaretb

2013-03-25 00:53:41 -------- d-----w- C:\Program Files (x86)\Toolbar Cleaner

2013-03-25 00:52:13 14456 ----a-w- C:\Windows\System32\drivers\gfibto.sys

2013-03-22 03:43:44 -------- d-----w- C:\Program Files\iPod

2013-03-22 03:43:43 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-03-22 03:43:43 -------- d-----w- C:\Program Files\iTunes

2013-03-22 03:43:43 -------- d-----w- C:\Program Files (x86)\iTunes

2013-03-21 18:26:58 20992 ----a-w- C:\Windows\System32\drivers\usb8023.sys

2013-03-19 23:32:43 88728 ----a-w- C:\Windows\System32\drivers\btath_flt.sys

2013-03-19 21:38:42 1122664 ----a-w- C:\Windows\System32\wdfcoinstaller01009.dll

2013-03-15 02:07:52 559904 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2013-03-14 01:31:53 468992 ----a-w- C:\Windows\System32\MFMediaEngine.dll

2013-03-14 01:31:53 361984 ----a-w- C:\Windows\SysWow64\MFMediaEngine.dll

2013-03-14 00:25:29 622080 ----a-w- C:\Windows\System32\drivers\srv2.sys

2013-03-14 00:25:29 370688 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys

2013-03-14 00:25:29 247808 ----a-w- C:\Windows\System32\drivers\srvnet.sys

2013-03-14 00:25:29 215552 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys

2013-03-13 23:05:12 1690624 ----a-w- C:\Windows\System32\GdiPlus.dll

2013-03-13 23:05:11 1437184 ----a-w- C:\Windows\SysWow64\GdiPlus.dll

2013-03-08 01:42:37 17536 ----a-w- C:\ProgramData\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin

.

==================== Find3M ====================

.

2013-04-02 01:20:57 17408 ----a-w- C:\Windows\System32\rpcnetp.exe

2013-03-31 16:02:26 69792 ----a-w- C:\Windows\SysWow64\rpcnet.dll

2013-03-31 16:02:21 17408 ------w- C:\Windows\SysWow64\rpcnetp.exe

2013-03-31 16:02:19 29336 ----a-w- C:\Windows\System32\wpbbin.exe

2013-03-31 02:41:40 1536 ----a-w- C:\Windows\SysWow64\RtkMsgs.dll

2013-03-29 20:51:51 69792 ------w- C:\Windows\SysWow64\rpcnet.exe

2013-03-15 04:16:18 3477280 ----a-w- C:\Windows\System32\nvsvc64.dll

2013-03-15 04:16:17 6398240 ----a-w- C:\Windows\System32\nvcpl.dll

2013-03-15 04:16:10 877856 ----a-w- C:\Windows\System32\nvvsvc.exe

2013-03-15 04:16:10 76064 ----a-w- C:\Windows\System32\nv3dappshextr.dll

2013-03-15 04:16:10 63776 ----a-w- C:\Windows\System32\nvshext.dll

2013-03-15 04:16:10 2555680 ----a-w- C:\Windows\System32\nvsvcr.dll

2013-03-15 04:16:10 237856 ----a-w- C:\Windows\System32\nvmctray.dll

2013-03-15 04:16:10 1016096 ----a-w- C:\Windows\System32\nv3dappshext.dll

2013-03-13 16:24:01 3065455 ----a-w- C:\Windows\System32\nvcoproc.bin

2013-03-05 23:07:25 78168 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-03-05 23:07:25 692568 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-02-15 07:58:59 39936 ----a-w- C:\Windows\apppatch\apppatch64\acspecfc.dll

2013-02-15 06:35:40 444416 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

2013-02-12 01:30:04 44032 ----a-w- C:\Windows\SysWow64\UXInit.dll

2013-02-12 00:56:19 53760 ----a-w- C:\Windows\System32\UXInit.dll

2013-02-12 00:25:18 4041728 ----a-w- C:\Windows\System32\win32k.sys

2013-02-10 03:25:27 1807136 ----a-w- C:\Windows\System32\nvdispco6420294.dll

2013-02-10 03:25:27 1510176 ----a-w- C:\Windows\System32\nvdispgenco6420162.dll

2013-02-07 04:09:56 69864 ----a-w- C:\Windows\System32\drivers\pdc.sys

2013-02-07 03:34:58 10115072 ----a-w- C:\Windows\System32\twinui.dll

2013-02-07 03:33:47 2302464 ----a-w- C:\Windows\System32\authui.dll

2013-02-07 03:33:42 2146816 ----a-w- C:\Windows\System32\actxprxy.dll

2013-02-07 01:34:00 8856576 ----a-w- C:\Windows\SysWow64\twinui.dll

2013-02-07 01:33:03 2033664 ----a-w- C:\Windows\SysWow64\authui.dll

2013-02-07 01:33:01 754176 ----a-w- C:\Windows\SysWow64\actxprxy.dll

2013-02-05 04:58:01 1766912 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-02-05 04:56:33 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-02-05 04:56:27 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-02-05 04:56:27 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-02-05 03:55:27 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-02-05 01:44:50 534528 ----a-w- C:\Windows\SysWow64\uxtheme.dll

2013-02-04 22:39:47 2246656 ----a-w- C:\Windows\System32\wininet.dll

2013-02-04 22:39:39 907776 ----a-w- C:\Windows\System32\uxtheme.dll

2013-02-04 22:38:55 3966464 ----a-w- C:\Windows\System32\jscript9.dll

2013-02-04 22:38:53 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-02-02 11:19:44 496872 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2013-02-02 11:19:44 446184 ----a-w- C:\Windows\System32\drivers\USBHUB3.SYS

2013-02-02 11:19:41 329960 ----a-w- C:\Windows\System32\drivers\storport.sys

2013-02-02 11:19:33 61672 ----a-w- C:\Windows\System32\drivers\crashdmp.sys

2013-02-02 10:54:54 1933544 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-02-02 10:28:54 993512 ----a-w- C:\Windows\System32\drivers\ndis.sys

2013-02-02 10:28:54 2226408 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-02-02 09:42:07 2207232 ----a-w- C:\Windows\SysWow64\PrintConfig.dll

2013-02-02 08:40:58 375808 ----a-w- C:\Windows\SysWow64\wbem\WmiPrvSE.exe

2013-02-02 08:40:55 80896 ----a-w- C:\Windows\SysWow64\tasklist.exe

2013-02-02 08:40:55 79360 ----a-w- C:\Windows\SysWow64\taskkill.exe

2013-02-02 08:40:36 155136 ----a-w- C:\Windows\SysWow64\XpsRasterService.dll

2013-02-02 08:40:35 370688 ----a-w- C:\Windows\SysWow64\WWanAPI.dll

2013-02-02 08:40:27 131072 ----a-w- C:\Windows\SysWow64\wbem\WmiDcPrv.dll

2013-02-02 08:40:26 410624 ----a-w- C:\Windows\SysWow64\wlroamextension.dll

2013-02-02 08:40:22 197632 ----a-w- C:\Windows\SysWow64\Windows.Networking.Connectivity.dll

2013-02-02 08:40:22 10792448 ----a-w- C:\Windows\SysWow64\Windows.UI.Xaml.dll

2013-02-02 08:40:01 356352 ----a-w- C:\Windows\SysWow64\SettingSync.dll

2013-02-02 08:39:59 325632 ----a-w- C:\Windows\SysWow64\schannel.dll

2013-02-02 08:39:47 18432 ----a-w- C:\Windows\SysWow64\npmproxy.dll

2013-02-02 08:39:34 55296 ----a-w- C:\Windows\SysWow64\nlaapi.dll

2013-02-02 08:39:34 15872 ----a-w- C:\Windows\SysWow64\nlmproxy.dll

2013-02-02 08:39:34 12288 ----a-w- C:\Windows\SysWow64\nlmsprep.dll

2013-02-02 08:39:33 115712 ----a-w- C:\Windows\SysWow64\netprofm.dll

2013-02-02 08:39:28 5090816 ----a-w- C:\Windows\SysWow64\mstscax.dll

2013-02-02 08:39:15 157696 ----a-w- C:\Windows\SysWow64\mbsmsapi.dll

2013-02-02 08:38:54 567808 ----a-w- C:\Windows\SysWow64\duser.dll

2013-02-02 08:24:19 107520 ----a-w- C:\Windows\System32\taskkill.exe

2013-02-02 08:24:19 102400 ----a-w- C:\Windows\System32\tasklist.exe

2013-02-02 08:23:44 228352 ----a-w- C:\Windows\System32\XpsRasterService.dll

2013-02-02 08:23:43 475136 ----a-w- C:\Windows\System32\WWanAPI.dll

2013-02-02 08:23:37 611840 ----a-w- C:\Windows\System32\wpd_ci.dll

2013-02-02 08:23:37 105472 ----a-w- C:\Windows\System32\wpdbusenum.dll

2013-02-02 08:23:30 830464 ----a-w- C:\Windows\System32\wbem\WmiPrvSD.dll

2013-02-02 08:23:28 543232 ----a-w- C:\Windows\System32\wlroamextension.dll

2013-02-02 08:23:21 13643264 ----a-w- C:\Windows\System32\Windows.UI.Xaml.dll

2013-02-02 08:23:19 293376 ----a-w- C:\Windows\System32\Windows.Networking.Connectivity.dll

2013-02-02 08:23:18 731648 ----a-w- C:\Windows\System32\win32spl.dll

2013-02-02 08:23:16 87552 ----a-w- C:\Windows\System32\wersvc.dll

2013-02-02 08:22:28 448512 ----a-w- C:\Windows\System32\SettingSync.dll

2013-02-02 08:22:22 416256 ----a-w- C:\Windows\System32\schannel.dll

2013-02-02 08:21:45 467456 ----a-w- C:\Windows\System32\netprofmsvc.dll

2013-02-02 08:21:44 385024 ----a-w- C:\Windows\System32\ncsi.dll

2013-02-02 08:21:38 5977600 ----a-w- C:\Windows\System32\mstscax.dll

2013-02-02 08:21:10 225280 ----a-w- C:\Windows\System32\mbsmsapi.dll

2013-02-02 08:20:47 260096 ----a-w- C:\Windows\System32\hotspotauth.dll

2013-02-02 08:20:31 729600 ----a-w- C:\Windows\System32\duser.dll

2013-02-02 07:30:05 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-02-02 07:26:24 18432 ----a-w- C:\Windows\System32\drivers\BtaMPM.sys

2013-02-02 07:25:52 297984 ----a-w- C:\Windows\System32\drivers\ks.sys

2013-02-02 07:25:26 82944 ----a-w- C:\Windows\System32\drivers\hidclass.sys

2013-02-02 07:25:23 37632 ----a-w- C:\Windows\System32\drivers\BthAvrcpTg.sys

2013-02-02 07:24:50 117632 ----a-w- C:\Windows\System32\drivers\BthA2DP.sys

2013-02-02 07:24:42 30720 ----a-w- C:\Windows\System32\drivers\BthHfAud.sys

2013-01-30 10:53:22 273840 ------w- C:\Windows\System32\MpSigStub.exe

2013-01-29 01:57:05 35232 ----a-w- C:\Windows\System32\drivers\WdBoot.sys

2013-01-28 23:08:22 230904 ----a-w- C:\Windows\System32\drivers\WdFilter.sys

2013-01-14 15:40:02 112128 ----a-w- C:\Windows\System32\SystemInfo.dll

2013-01-14 03:56:14 6967016 ----a-w- C:\Windows\System32\ntoskrnl.exe

.

============= FINISH: 23:41:02.99 ===============

mbam-log-2013-04-01 (22-37-06).txt

Edited April 2, 2013 by Maurice Naggar

ELVIS7 · April 2, 2013

also note, since then (prior to mbam/dds) I used roguekiller and adwcleaner . they both found files, temp files, and registry keys, I selected the remove/clean/continue and they removed all they had found. would you like the logs for those two as well?

Maurice Naggar · April 2, 2013

Please understand that I require that you -not- run tools on your own, while I am helping you & until I give the all clear.

Doing things on your own will over-complicate things.

I need a copy of Attach.txt from the run of DDS. It should be on your desktop.

Also, do not attach logs {unless they are way too huge to fit inside a given reply} but do a copy all of contents and then Paste directly into the main body of reply box.

Yes, I need a copy of the roguekiller log & the AdwCleaner log so I can review.

You may use a separate reply for each individual log.

To show all files:

Press and hold Windows-key & then press R key to get the RUN menu.
Type in
```
explorer.exe
```
and press Enter
When in Windows Explorer, press ALT-key then V key to get VIEW menu
Look at the top ribbon, right side. {the Show/Hide block}
Look at the line Hidden items. IF it has no checkmark, then Click the box one time so that it is checked.

On most all of the following programs and tools, you will need to do a right-click on the program link or shortcut or desktop icon (as appropriate) and then select "Run as Administrator". Please remember that as you go along and use these tools, each in turn.

Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe

Close all open windows on the Task Bar. Click the icon (for Vista, or Windows 7 or 8 Right click the icon and Run as Administrator) to start the program.
In the lower right corner, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
Exit OTL by clicking the X at top right.

Download Security Check by screen317 and save it to your Desktop: here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

Then copy/paste the following into your post (in order):

the contents of OTL.txt;
the contents of Extras.txt ; and
the contents of checkup.txt

Be sure to do a Preview prior to pressing Add Reply because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

ELVIS7 · April 3, 2013