Hijacked_Help Posted March 30, 2013 ID:662943 Share Posted March 30, 2013 Everytime I am on my chrome browser, a warning comes up saying malware has been detected and stopped.I believe that my browser is infected and maybe hijacked.DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 10.17.2Run by Son at 15:33:17 on 2013-03-30Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.3959.2452 [GMT -4:00].AV: AVG Internet Security 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AV: McAfee VirusScan *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: McAfee VirusScan *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}SP: AVG Internet Security 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}FW: McAfee Personal Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}FW: AVG Internet Security 2013 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}.============== Running Processes ===============.C:\PROGRA~2\AVG\AVG2013\avgrsa.exeC:\Program Files (x86)\AVG\AVG2013\avgcsrva.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\AVG\AVG2013\avgfws.exeC:\Program Files (x86)\AVG\AVG2013\avgidsagent.exeC:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Acer\Registration\GREGsvc.exeC:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeC:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exeC:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exeC:\Windows\SYSTEM32\WISPTIS.EXEC:\Windows\system32\rundll32.exeC:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exeC:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\Windows\SysWOW64\rundll32.exeC:\Program Files\Acer\Acer Updater\UpdaterService.exeC:\Program Files (x86)\AVG\AVG2013\avgnsa.exeC:\OEM\USBDECTION\USBS3S4Detection.exeC:\Program Files (x86)\AVG\AVG2013\avgemca.exeC:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exeC:\Program Files\Common Files\McAfee\SystemCore\mcshield.exeC:\Program Files\Common Files\McAfee\SystemCore\mfefire.exeC:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\WUDFHost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\system32\Dwm.exeC:\Windows\SYSTEM32\WISPTIS.EXEC:\Program Files\Common Files\microsoft shared\ink\TabTip.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exeC:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exeC:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exeC:\Program Files (x86)\TouchSettings\TouchPortalOBR.exeC:\Windows\System32\igfxtray.exeC:\Windows\System32\hkcmd.exeC:\Windows\system32\wbem\unsecapp.exeC:\Windows\System32\igfxpers.exeC:\Program Files (x86)\AVG\AVG2013\avgcsrva.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files\Realtek\Audio\HDA\RAVBg64.exeC:\Program Files (x86)\Acer\Acer TouchPortal\TouchPortalLauncher.exeC:\Program Files\mcafee.com\agent\mcagent.exeC:\Program Files (x86)\EgisTec IPS\PmmUpdate.exeC:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exeC:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\TouchMovieService.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files (x86)\AVG\AVG2013\avgui.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files (x86)\AVG Secure Search\vprot.exeC:\Program Files (x86)\EgisTec IPS\EgisUpdate.exeC:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\mswinext.exeC:\OEM\USBDECTION\FixIt.exeC:\Program Files (x86)\Ask.com\Updater\Updater.exeC:\Program Files (x86)\Java\jre7\bin\java.exeC:\Windows\system32\taskhost.exeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Program Files (x86)\Google\Chrome\Application\chrome.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\System32\cscript.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://acer.msn.comuDefault_Page_URL = hxxp://acer.msn.commStart Page = hxxp://acer.msn.commDefault_Page_URL = hxxp://acer.msn.comuURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dlluURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dllmWinlogon: Userinit = userinit.exeBHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\mcafee\msk\mskapbho.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dllBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dllBHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20100929223255.dllBHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.0.0.2\AVG Secure Search_toolbar.dllBHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dllBHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dllBHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dllBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dllTB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dllTB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dllTB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.0.0.2\AVG Secure Search_toolbar.dllTB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dllmRun: [uCam_Menu] "C:\Program Files (x86)\Acer\Acer Touch Suite\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer\Acer Touch Suite\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeymRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -dmRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exemRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"mRun: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exemRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumemRun: [MDS_Menu] "C:\Program Files (x86)\Acer\Acer TouchPortal\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer\Acer TouchPortal\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6"mRun: [TouchMovieService] "C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\TouchMovieService.exe"mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLYmRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentmPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-Explorer: NoActiveDesktopChanges = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:5mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllTCP: NameServer = 192.168.0.1TCP: Interfaces\{7E4F44A4-545C-4ED7-A811-7593EC57B9E7} : DHCPNameServer = 192.168.0.1TCP: Interfaces\{D2A87263-F6A9-4A7E-B91C-5E9D9C48C5FE} : DHCPNameServer = 192.168.0.1Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dllHandler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dllHandler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dllSSODL: WebCheck - <orphaned>mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chromex64-mStart Page = hxxp://acer.msn.comx64-mDefault_Page_URL = hxxp://acer.msn.comx64-BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\mcafee\msk\mskapbho64.dllx64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\SystemCore\ScriptSn.20100929223255.dllx64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dllx64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dllx64-Run: [iAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exex64-Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exex64-Run: [TouchORB] C:\Program Files (x86)\TouchSettings\TouchPortalOBR.exex64-Run: [igfxTray] C:\Windows\System32\igfxtray.exex64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exex64-Run: [Persistence] C:\Windows\System32\igfxpers.exex64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -sx64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 x64-Run: [TouchPortal] C:\Program Files (x86)\Acer\Acer TouchPortal\TouchPortalLauncher.exe nax64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dllx64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dllx64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>x64-Notify: igfxcui - igfxdev.dllx64-SSODL: WebCheck - <orphaned>.============= SERVICES / DRIVERS ===============.R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-2-8 71480]R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-2-8 311096]R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-2-8 116536]R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-2-8 45880]R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-1-5 528232]R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2010-1-5 279752]R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2012-9-4 50296]R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-2-26 246072]R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-2-8 206136]R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-2-14 239416]R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-3-30 39768]R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\System32\drivers\mfenlfk.sys [2010-1-5 75288]R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\System32\drivers\mwlPSDFilter.sys [2009-6-2 22576]R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\System32\drivers\mwlPSDNserv.sys [2009-6-2 20016]R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\System32\drivers\mwlPSDVDisk.sys [2009-6-2 60464]R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [2013-2-19 1418184]R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-2-27 4937264]R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-2-19 282624]R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-3-30 398184]R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-3-30 682344]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2009-12-15 355440]R2 McMPFSvc;McAfee Personal Firewall;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2009-12-15 355440]R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2009-12-15 355440]R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2009-12-15 355440]R2 McShield;McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2010-9-30 199032]R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2010-9-30 244840]R2 mfevtp;McAfee Validation Trust Protection Service;C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe [2010-9-30 148520]R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-9-30 243232]R2 USBS3S4Detection;USBS3S4Detection;C:\OEM\USBDECTION\USBS3S4Detection.exe [2010-9-30 76320]R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [2013-3-30 990896]R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2010-1-5 62416]R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-3-30 24176]R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-1-5 189880]R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2010-1-5 440688]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-9-30 347680]R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8192su.sys [2010-9-30 694888]S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2010-1-5 93840]S3 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-5-26 305520]S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2009-12-15 355440].=============== Created Last 30 ================.2013-03-30 19:05:15 -------- d-----w- C:\Windows\NAPP_Dism_Log2013-03-30 17:44:42 -------- d-----w- C:\Users\Son\AppData\Local\APN2013-03-30 17:44:42 -------- d-----w- C:\Program Files (x86)\Ask.com2013-03-30 17:44:42 -------- d-----w- C:\Firefox2013-03-30 17:35:51 -------- d-----w- C:\Windows\.jagex_cache_322013-03-30 17:34:34 -------- d-----w- C:\Windows\.soulsplit2013-03-30 17:34:30 -------- d-----w- C:\ProgramData\Ask2013-03-30 17:34:23 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll2013-03-30 17:34:22 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll2013-03-30 17:34:13 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll2013-03-30 17:31:07 -------- d-----w- C:\Users\Son\jagexcache2013-03-30 17:27:57 -------- d-----w- C:\Users\Son\AppData\Local\Google2013-03-30 17:27:43 -------- d-----w- C:\Users\Son\AppData\Local\Deployment2013-03-30 17:27:43 -------- d-----w- C:\Users\Son\AppData\Local\Apps2013-03-30 16:31:57 -------- d-----w- C:\Users\Son\AppData\Roaming\Malwarebytes2013-03-30 16:31:51 -------- d-----w- C:\ProgramData\Malwarebytes2013-03-30 16:31:50 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys2013-03-30 16:31:50 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2013-03-30 16:31:41 -------- d-----w- C:\Users\Son\AppData\Local\Programs2013-03-30 16:30:55 -------- d-----w- C:\ProgramData\AVG Secure Search2013-03-30 15:54:42 -------- d-----w- C:\Users\Son\AppData\Roaming\AVG20132013-03-30 15:54:18 -------- d-----w- C:\Users\Son\AppData\Local\AVG Secure Search2013-03-30 15:54:14 -------- d-----w- C:\Users\Son\AppData\Roaming\TuneUp Software2013-03-30 15:54:08 39768 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys2013-03-30 15:54:06 -------- d-----w- C:\Program Files (x86)\Common Files\AVG Secure Search2013-03-30 15:54:06 -------- d-----w- C:\Program Files (x86)\AVG Secure Search2013-03-30 15:53:40 -------- d--h--w- C:\$AVG2013-03-30 15:53:40 -------- d-----w- C:\ProgramData\AVG20132013-03-30 15:53:18 -------- d-----w- C:\Program Files (x86)\AVG2013-03-30 15:51:50 -------- d--h--w- C:\ProgramData\Common Files2013-03-30 15:51:49 -------- d-----w- C:\Users\Son\AppData\Local\MFAData2013-03-30 15:51:49 -------- d-----w- C:\Users\Son\AppData\Local\Avg20132013-03-30 15:51:49 -------- d-----w- C:\ProgramData\MFAData2013-03-30 15:51:28 826368 ----a-w- C:\Windows\SysWow64\rdpcore.dll2013-03-30 15:51:28 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys2013-03-30 15:51:28 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys2013-03-30 15:51:28 1031680 ----a-w- C:\Windows\System32\rdpcore.dll2013-03-30 15:50:07 -------- d-----w- C:\Users\Son\AppData\Roaming\OEM2013-03-30 15:50:05 -------- d-----w- C:\Users\Son\AppData\Local\EgisTec IPS2013-03-30 15:49:37 -------- d-----w- C:\Users\Son\AppData\Local\VirtualStore2013-03-30 15:48:23 -------- d-----w- C:\Program Files (x86)\OEM2013-03-30 15:46:54 -------- d-sh--w- C:\Recovery2013-03-30 15:31:58 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll2013-03-30 15:31:58 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll2013-03-30 15:31:56 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition2013-03-30 15:31:04 -------- d-----w- C:\Program Files (x86)\Windows Live SkyDrive2013-03-30 15:30:41 -------- d-----w- C:\Windows\PCHEALTH2013-03-30 15:30:32 74520 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\83fee34f1ce2d5b\DSETUP.dll2013-03-30 15:30:32 484632 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\83fee34f1ce2d5b\DXSETUP.exe2013-03-30 15:30:32 1670936 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\83fee34f1ce2d5b\dsetup32.dll2013-03-30 15:30:15 141399376 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\wlc2685.tmp2013-03-30 15:30:10 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live2013-03-30 15:20:16 -------- d-----w- C:\Program Files (x86)\Microsoft2013-03-30 15:20:15 -------- d-----w- C:\Program Files (x86)\MSN Toolbar2013-03-30 15:19:55 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer2013-03-30 15:16:30 -------- d---a-w- C:\book2013-03-30 15:14:21 3 ----a-w- C:\Windows\System32\PLD_Framework.cmd2013-03-30 15:11:59 1251944 ----a-w- C:\Windows\RtlExUpd.dll2013-03-30 15:11:59 -------- d--h--w- C:\Program Files (x86)\Temp2013-03-30 15:11:58 757760 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll2013-03-30 15:11:58 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll2013-03-30 15:11:58 65024 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe2013-03-30 15:11:58 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe2013-03-30 15:11:58 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll2013-03-30 15:11:58 274432 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll2013-03-30 15:11:58 204800 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll2013-03-30 15:11:57 331908 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll2013-03-30 15:11:57 200836 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll2013-03-30 15:08:40 -------- d-----w- C:\Program Files\Common Files\Intel2013-03-30 15:08:39 -------- d-----w- C:\Program Files (x86)\Common Files\Intel.==================== Find3M ====================.2013-02-27 03:40:46 246072 ----a-w- C:\Windows\System32\drivers\avgidsdrivera.sys2013-02-14 07:52:46 239416 ----a-w- C:\Windows\System32\drivers\avgtdia.sys2013-02-08 08:37:56 116536 ----a-w- C:\Windows\System32\drivers\avgmfx64.sys2013-02-08 08:37:54 311096 ----a-w- C:\Windows\System32\drivers\avgloga.sys2013-02-08 08:37:50 71480 ----a-w- C:\Windows\System32\drivers\avgidsha.sys2013-02-08 08:37:42 206136 ----a-w- C:\Windows\System32\drivers\avgldx64.sys2013-02-08 08:37:40 45880 ----a-w- C:\Windows\System32\drivers\avgrkx64.sys.============= FINISH: 15:33:44.62 =============== Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 30, 2013 Staff ID:662949 Share Posted March 30, 2013 Hello Hijacked_Help I would like to welcome you to the Malware Removal section of the forum.Around here they call me Gringo and I will be glad to help you with your malware problems.Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!Please do not run any tools unless instructed to do so.We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.[*]Please do not attach logs or use code boxes, just copy and paste the text.Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.[*]Please read every post completely before doing anything.Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.[*]Please provide feedback about your experience as we go.A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.-Security Check-Download Security Check by screen317 from here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.-AdwCleaner-Please download AdwCleaner by Xplode onto your desktop.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click on Delete.Confirm each time with Ok.Your computer will be rebooted automatically. A text file will open after the restart.Please post the content of that logfile with your next answer.You can find the logfile at C:\AdwCleaner[s1].txt as well.--RogueKiller-- Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit Quit all programs that you may have started. Please disconnect any USB or external drives from the computer before you run this scan! For Vista or Windows 7, right-click and select "Run as Administrator to start"For Windows XP, double-click to start. Wait until Prescan has finished ... Then Click on "Scan" button Wait until the Status box shows "Scan Finished"click on "delete" Wait until the Status box shows "Deleting Finished" Click on "Report" and copy/paste the content of the Notepad into your next reply.The log should be found in RKreport[1].txt on your DesktopExit/Close RogueKiller+Gringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 30, 2013 Author ID:662957 Share Posted March 30, 2013 -Security Check- Results of screen317's Security Check version 0.99.61 Windows 7 x64 (UAC is enabled) Out of date service pack!! Internet Explorer 8 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Disabled! AVG Internet Security 2013 McAfee VirusScan Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 Java 7 Update 17 Adobe Flash Player 10 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! Google Chrome 26.0.1410.43 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe AVG avgwdsvc.exe Malwarebytes' Anti-Malware mbamscheduler.exe Symantec Norton Online Backup NOBuAgent.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 3% ````````````````````End of Log`````````````````````` -AdwCleaner-# AdwCleaner v2.115 - Logfile created 03/30/2013 at 15:58:03# Updated 17/03/2013 by Xplode# Operating system : Windows 7 Home Premium (64 bits)# User : Son - SON-PC# Boot Mode : Normal# Running from : C:\Users\Son\Downloads\adwcleaner (1).exe# Option [Delete]***** [services] ********** [Files / Folders] *****Deleted on reboot : C:\Program Files (x86)\Ask.comDeleted on reboot : C:\Program Files (x86)\AVG Secure SearchDeleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure SearchDeleted on reboot : C:\ProgramData\AskDeleted on reboot : C:\ProgramData\AVG Secure SearchDeleted on reboot : C:\Users\Son\AppData\Local\APNDeleted on reboot : C:\Users\Son\AppData\Local\AVG Secure SearchDeleted on reboot : C:\Users\Son\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmloDeleted on reboot : C:\Users\Son\AppData\LocalLow\AskToolbarDeleted on reboot : C:\Users\Son\AppData\LocalLow\AVG Secure SearchDeleted on reboot : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}File Deleted : C:\Users\Public\Desktop\eBay.lnk***** [Registry] *****Key Deleted : HKCU\Software\APNKey Deleted : HKCU\Software\AppDataLow\Software\AskToolbarKey Deleted : HKCU\Software\Ask.comKey Deleted : HKCU\Software\AVG Secure SearchKey Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}Key Deleted : HKLM\Software\APNKey Deleted : HKLM\Software\AskToolbarKey Deleted : HKLM\Software\AVG Secure SearchKey Deleted : HKLM\Software\AVG Security ToolbarKey Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLLKey Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXEKey Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLLKey Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPIKey Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObjKey Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWndKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEFKey Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEFKey Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocolKey Deleted : HKLM\SOFTWARE\Classes\SKey Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApiKey Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLEKey Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-pluginKey Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEFValue Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]***** [internet Browsers] *****-\\ Internet Explorer v8.0.7600.16385[OK] Registry is clean.-\\ Google Chrome v26.0.1410.43File : C:\Users\Son\AppData\Local\Google\Chrome\User Data\Default\PreferencesDeleted [l.22] : icon_url = "hxxp://www.ask.com/favicon.ico",Deleted [l.25] : keyword = "ask.com",Deleted [l.29] : search_url = "hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=55[...]Deleted [l.30] : suggest_url = "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms[...]*************************AdwCleaner[s1].txt - [304 octets] - [30/03/2013 15:57:36]AdwCleaner[s2].txt - [8576 octets] - [30/03/2013 15:58:03]########## EOF - C:\AdwCleaner[s2].txt - [8636 octets] ##########-RougeKiler-RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/Website : http://tigzy.geekstogo.com/roguekiller.phpBlog : http://tigzyrk.blogspot.com/Operating System : Windows 7 (6.1.7600 ) 64 bits versionStarted in : Normal modeUser : Son [Admin rights]Mode : Scan -- Date : 03/30/2013 16:03:45| ARK || FAK || MBR |¤¤¤ Bad processes : 0 ¤¤¤¤¤¤ Registry Entries : 2 ¤¤¤[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND¤¤¤ Particular Files / Folders: ¤¤¤¤¤¤ Driver : [NOT LOADED] ¤¤¤¤¤¤ HOSTS File: ¤¤¤--> C:\Windows\system32\drivers\etc\hosts¤¤¤ MBR Check: ¤¤¤+++++ PhysicalDrive0: WDC WD5000AAKS-22V1A0 +++++--- User ---[MBR] d2e209fbd66dbc8bc2962b7be67b890c[bSP] fde1e412fd23a722c299ac0283fe1a74 : Windows 7/8 MBR CodePartition table:0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 18000 Mo1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 36866048 | Size: 100 Mo2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 37070848 | Size: 458838 MoUser = LL1 ... OK!User = LL2 ... OK!Finished : << RKreport[1]_S_03302013_02d1603.txt >>RKreport[1]_S_03302013_02d1603.txt Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 30, 2013 Staff ID:662966 Share Posted March 30, 2013 Hello Hijacked_Help I Would like you to do the following.Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.Link 1Link 2Link 3 1. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stallNote 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer"information and logs"In your next post I need the followingLog from Combofixlet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 30, 2013 Author ID:662974 Share Posted March 30, 2013 I am not sure if I should be turning off my security, malware bytes is blocking the malware from getting into my computer.. Are you sure about this? Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 30, 2013 Staff ID:662979 Share Posted March 30, 2013 just while running the scan - disconnect the computer from the net while you are running it if you are worriedgringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 30, 2013 Author ID:662982 Share Posted March 30, 2013 I will do this when I get home, thanks for the help so far... Before I realized that my computer was infected, it had been completely hacked through a website and the hacker had remote access to the computer and was able to access files.. Out of panic I restored my computer to factory date (was going to anyways) and I ran malware bytes once the computer was up and running again.. I am just wondering if doing this may have caused any problems may cause problems in the future? Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 30, 2013 Staff ID:662985 Share Posted March 30, 2013 by doing a factory restore it removed any of the virus anywaywhen did you do this?gringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 30, 2013 Author ID:662987 Share Posted March 30, 2013 This morning, approximately 6 hours ago.. Malwarebytes and AVG did not detect any malware, it's just that when I am on Chrome it dectects malware trying to get into my computer.The "website" is: 244.188.198.44 Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 30, 2013 Author ID:662988 Share Posted March 30, 2013 I made a mistake in that..The IP/Website is: 204.188.198.44 Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 30, 2013 Staff ID:662998 Share Posted March 30, 2013 OK go ahead and run CF for megringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663059 Share Posted March 31, 2013 I'm going to be home soon, but are you sure that turning security off is a safe option? Just a bit nervous ill have adware generic5 and hidden drives again.. Was quite the hassle last time Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663086 Share Posted March 31, 2013 You can run it with the security but it will complaingringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663098 Share Posted March 31, 2013 I cannot figure out how to disable AVG 2013 :$ Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663105 Share Posted March 31, 2013 Hellosee if this helps - http://www.avg.com/ww-en/faq.num-4497 Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663108 Share Posted March 31, 2013 I decided to do a quick anti-virus run with AVG while I was trying to figure this out.. It found a hidden driver? Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663109 Share Posted March 31, 2013 I also ran netstat and found a weird connection?server-204-246-169-159:httpa72-246-43-10:httpI am not sure if these are suppose to appear, but they are both connected to my router Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663110 Share Posted March 31, 2013 Hellothat does not bother me at this time as we are nowhere near done - that is also why I ask at in my first post not to run any scans as it will only confuse things while we are working together Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663113 Share Posted March 31, 2013 Figured it was McAffee- I can run combofix tonight as I have to go.. Sorry but can you remind me of what I need to do? I understand I am making this confusing, sorry. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663119 Share Posted March 31, 2013 Hello Hijacked_Help I Would like you to do the following.Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.Link 1Link 2Link 3 1. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stallNote 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer"information and logs"In your next post I need the followingLog from Combofixlet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663120 Share Posted March 31, 2013 Thanks, I'll get back to you tomorrow. I also messaged you if you could read that, thanks. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663122 Share Posted March 31, 2013 OK see you thengringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663301 Share Posted March 31, 2013 ComboFix 13-03-30.01 - Son 31/03/2013 14:00:27.1.2 - x64Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.3959.1809 [GMT -4:00]Running from: c:\users\Son\Downloads\ComboFix.exeAV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}FW: AVG Internet Security 2013 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\SysWow64\ptc:\windows\SysWow64\pt\Lagoon.resources.dll..((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-31 )))))))))))))))))))))))))))))))..2013-03-31 18:03 . 2013-03-31 18:03 -------- d-----w- c:\users\Default\AppData\Local\temp2013-03-30 19:05 . 2013-03-30 19:05 -------- d-----w- c:\windows\NAPP_Dism_Log2013-03-30 17:44 . 2013-03-30 17:44 -------- d-----w- c:\program files (x86)\Ask.com2013-03-30 17:44 . 2013-03-30 17:44 -------- d-----w- C:\Firefox2013-03-30 17:35 . 2013-03-30 17:35 -------- d-----w- c:\windows\.jagex_cache_322013-03-30 17:34 . 2013-03-30 17:34 -------- d-----w- c:\windows\.soulsplit2013-03-30 17:34 . 2013-03-30 17:34 -------- d-----w- c:\programdata\Ask2013-03-30 17:34 . 2013-03-30 17:34 -------- d-----w- c:\program files (x86)\Common Files\Java2013-03-30 17:34 . 2013-03-30 17:34 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll2013-03-30 17:34 . 2013-03-30 17:34 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll2013-03-30 17:34 . 2013-03-30 17:34 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll2013-03-30 17:34 . 2013-03-30 17:34 -------- d-----w- c:\program files (x86)\Java2013-03-30 17:28 . 2013-03-30 17:28 -------- d-----w- c:\program files (x86)\Google2013-03-30 16:31 . 2013-03-30 16:31 -------- d-----w- c:\programdata\Malwarebytes2013-03-30 16:31 . 2013-03-30 16:31 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware2013-03-30 16:31 . 2012-12-14 20:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys2013-03-30 15:54 . 2013-03-30 15:54 39768 ----a-w- c:\windows\system32\drivers\avgtpx64.sys2013-03-30 15:54 . 2013-03-30 15:54 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search2013-03-30 15:54 . 2013-03-30 15:54 -------- d-----w- c:\program files (x86)\AVG Secure Search2013-03-30 15:53 . 2013-03-30 16:27 -------- d-----w- c:\programdata\AVG20132013-03-30 15:53 . 2013-03-30 15:53 -------- d-----w- C:\$AVG2013-03-30 15:53 . 2013-03-30 15:53 -------- d-----w- c:\program files (x86)\AVG2013-03-30 15:51 . 2013-03-30 15:51 -------- d--h--w- c:\programdata\Common Files2013-03-30 15:51 . 2013-03-31 16:54 -------- d-----w- c:\programdata\MFAData2013-03-30 15:51 . 2012-02-15 06:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll2013-03-30 15:51 . 2012-02-15 05:44 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll2013-03-30 15:51 . 2012-02-15 04:47 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys2013-03-30 15:51 . 2012-02-15 04:46 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys2013-03-30 15:48 . 2013-03-30 15:48 -------- d-----w- c:\program files (x86)\OEM2013-03-30 15:47 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll2013-03-30 15:47 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe2013-03-30 15:47 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll2013-03-30 15:47 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll2013-03-30 15:47 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll2013-03-30 15:47 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll2013-03-30 15:47 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll2013-03-30 15:47 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll2013-03-30 15:47 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe2013-03-30 15:47 . 2013-03-30 17:35 -------- d-----w- c:\users\Son2013-03-30 15:46 . 2013-03-30 15:46 -------- d-----w- C:\Recovery2013-03-30 15:31 . 2006-11-29 17:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll2013-03-30 15:31 . 2006-11-29 17:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll2013-03-30 15:31 . 2013-03-30 15:31 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition2013-03-30 15:31 . 2013-03-30 15:31 -------- d-----w- c:\program files (x86)\Windows Live SkyDrive2013-03-30 15:30 . 2013-03-30 15:32 -------- d-----w- c:\program files (x86)\Windows Live2013-03-30 15:30 . 2013-03-30 15:30 -------- d-----w- c:\windows\PCHEALTH2013-03-30 15:30 . 2013-03-30 15:30 -------- d-----w- c:\program files (x86)\Common Files\Windows Live2013-03-30 15:20 . 2013-03-30 15:28 -------- d-----w- c:\programdata\CyberLink2013-03-30 15:20 . 2013-03-30 15:20 -------- d-----w- c:\program files (x86)\Microsoft2013-03-30 15:20 . 2013-03-30 15:20 -------- d-----w- c:\program files (x86)\MSN Toolbar2013-03-30 15:19 . 2013-03-30 15:20 -------- d-----w- c:\program files (x86)\Bing Bar Installer2013-03-30 15:16 . 2013-03-30 15:16 -------- d---a-w- C:\book2013-03-30 15:14 . 2013-03-30 15:14 3 ----a-w- c:\windows\system32\PLD_Framework.cmd2013-03-30 15:11 . 2010-06-24 03:13 1251944 ----a-w- c:\windows\RtlExUpd.dll2013-03-30 15:08 . 2013-03-30 15:08 -------- d-----w- c:\program files\Common Files\Intel2013-03-30 15:08 . 2013-03-30 15:08 -------- d-----w- c:\program files (x86)\Common Files\Intel...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-02-27 03:40 . 2013-02-27 03:40 246072 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys2013-02-14 07:52 . 2013-02-14 07:52 239416 ----a-w- c:\windows\system32\drivers\avgtdia.sys2013-02-08 08:37 . 2013-02-08 08:37 116536 ----a-w- c:\windows\system32\drivers\avgmfx64.sys2013-02-08 08:37 . 2013-02-08 08:37 311096 ----a-w- c:\windows\system32\drivers\avgloga.sys2013-02-08 08:37 . 2013-02-08 08:37 71480 ----a-w- c:\windows\system32\drivers\avgidsha.sys2013-02-08 08:37 . 2013-02-08 08:37 206136 ----a-w- c:\windows\system32\drivers\avgldx64.sys2013-02-08 08:37 . 2013-02-08 08:37 45880 ----a-w- c:\windows\system32\drivers\avgrkx64.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]2010-05-27 02:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"UCam_Menu"="c:\program files (x86)\Acer\Acer Touch Suite\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2010-08-04 611872]"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]"MDS_Menu"="c:\program files (x86)\Acer\Acer TouchPortal\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"TouchMovieService"="c:\program files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\TouchMovieService.exe" [2010-05-13 124136]"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-03-13 4394032]"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2013-03-30 1219248]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"aux"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2013-02-28 4937264]R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2013-02-08 71480]S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2013-02-08 311096]S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2013-02-08 116536]S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2013-02-08 45880]S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys [2012-09-04 50296]S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2013-02-27 246072]S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2013-02-08 206136]S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2013-02-14 239416]S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-03-30 39768]S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2013\avgfws.exe [2013-02-19 1418184]S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-02-19 282624]S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]S2 USBS3S4Detection;USBS3S4Detection;c:\oem\USBDECTION\USBS3S4Detection.exe [2009-12-09 76320]S2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [2013-03-30 990896]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-03-22 347680]S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-07-08 694888]..[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2013-03-30 17:28 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe.Contents of the 'Scheduled Tasks' folder.2013-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-30 17:28].2013-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-30 17:28]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]2010-05-27 02:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]"TouchORB"="c:\program files (x86)\TouchSettings\TouchPortalOBR.exe" [2010-05-06 153416]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-02 161304]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-02 386584]"Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-02 414744]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-09 11045480]"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-07-09 2103912]"TouchPortal"="c:\program files (x86)\Acer\Acer TouchPortal\TouchPortalLauncher.exe" [2010-07-08 436256].------- Supplementary Scan -------.uStart Page = hxxp://acer.msn.comuLocal Page = c:\windows\system32\blank.htmmDefault_Page_URL = hxxp://acer.msn.commStart Page = hxxp://acer.msn.commLocal Page = c:\windows\SysWOW64\blank.htmTCP: DhcpNameServer = 192.168.0.1.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)Wow6432Node-HKLM-Run-<NO NAME> - (no file)Toolbar-Locked - (no file)...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.10".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2013-03-31 14:04:37ComboFix-quarantined-files.txt 2013-03-31 18:04.Pre-Run: 445,631,250,432 bytes freePost-Run: 445,346,357,248 bytes free.- - End Of File - - 39B7E72659D1F89A739870A719706D02Had no problems running it, other then having to disable my Anti-Virus (AVG) But it's all good. What's next? Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2013 Staff ID:663315 Share Posted March 31, 2013 Hello Hijacked_Help I would like you to try and run these next.TDSSKillerPlease download the latest version of TDSSKiller from here and save it to your Desktop.Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.Put a checkmark beside loaded modules.A reboot will be needed to apply the changes. Do it.TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.Then click on Change parameters in TDSSKiller.Check all boxes then click OK.Click the Start Scan button.The scan should take no longer than 2 minutes.If a suspicious object is detected, the default action will be Skip, click on Continue. If malicious objects are found, they will show in the Scan resultsEnsure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it If the forum still complains about it being to long send me everything that is at the end of the report after where it says================== Scan finished==================and I will see if I want to see the whole reportMalwarebytes Anti-Rootkit1.Download Malwarebytes Anti-Rootkit2.Unzip the contents to a folder in a convenient location.3.Open the folder where the contents were unzipped and run mbar.exe4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.6.Wait while the system shuts down and the cleanup process is performed.7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:•Internet access•Windows Update•Windows Firewall9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.10.Verify that your system is now functioning normally.If you have any problems running either one come back and let me knowplease reply with the reports from TDSSKiller and MBARGringo Link to post Share on other sites More sharing options...
Hijacked_Help Posted March 31, 2013 Author ID:663325 Share Posted March 31, 2013 -TDSSKILLER- TOO LONG DELETED SOME15:38:50.0167 1128 [ 89E3317708F167AE4BAE0000842C8CE7 ] C:\Windows\System32\UIHub.dll15:38:50.0168 1128 C:\Windows\System32\UIHub.dll - ok15:38:50.0171 1128 [ 12916E0642E92561C98B18A2A2D01B14 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe15:38:50.0171 1128 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe - ok15:38:50.0173 1128 [ F32077DF74EFD435A1DCDF415E189DF1 ] C:\Windows\SysWOW64\mfc100u.dll15:38:50.0173 1128 C:\Windows\SysWOW64\mfc100u.dll - ok15:38:50.0177 1128 [ 856CFFCD835528136367BB1A8FE1DB87 ] C:\Windows\SysWOW64\Syncreg.dll15:38:50.0177 1128 C:\Windows\SysWOW64\Syncreg.dll - ok15:38:50.0181 1128 [ 622D95520182F6D3D05310D5810CA8B3 ] C:\Windows\SysWOW64\SearchIndexer.exe15:38:50.0181 1128 C:\Windows\SysWOW64\SearchIndexer.exe - ok15:38:50.0184 1128 [ 86F1895AE8C5E8B17D99ECE768A70732 ] C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\msvcr71.dll15:38:50.0184 1128 C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\msvcr71.dll - ok15:38:50.0188 1128 [ 15F00DBCA9A868B4DDA651EC47798D5F ] C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\wpfgfx_v0300.dll15:38:50.0188 1128 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\wpfgfx_v0300.dll - ok15:38:50.0193 1128 [ 2BC7C9FD0A9F2C9AFC373F3AD1EE3891 ] C:\Windows\System32\Syncreg.dll15:38:50.0193 1128 C:\Windows\System32\Syncreg.dll - ok15:38:50.0196 1128 [ AD31942BDF3D594C404874613BC2FE4D ] C:\Windows\System32\SearchIndexer.exe15:38:50.0196 1128 C:\Windows\System32\SearchIndexer.exe - ok15:38:50.0200 1128 [ F4055BF49A90375FD7672A604F3B0B8E ] C:\Windows\SysWOW64\ActionCenter.dll15:38:50.0200 1128 C:\Windows\SysWOW64\ActionCenter.dll - ok15:38:50.0202 1128 [ 5B7EF79233382D0DF3D2C28DB453AEE9 ] C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll15:38:50.0202 1128 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll - ok15:38:50.0205 1128 [ 8BC00C736E67A75D936E5B440917359B ] C:\Windows\System32\ActionCenter.dll15:38:50.0205 1128 C:\Windows\System32\ActionCenter.dll - ok15:38:50.0209 1128 [ 561FA2ABB31DFA8FAB762145F81667C2 ] C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\msvcp71.dll15:38:50.0209 1128 C:\Program Files (x86)\Acer\Acer TouchPortal\Acer Touch Movie\msvcp71.dll - ok15:38:50.0213 1128 [ 2D1830A62EE573E1BFFCBCBEFDE921AF ] C:\Windows\SysWOW64\browcli.dll15:38:50.0213 1128 C:\Windows\SysWOW64\browcli.dll - ok15:38:50.0217 1128 [ D64D99EC088B54FFE8EE67A480386C20 ] C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Culture.dll15:38:50.0217 1128 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Culture.dll - ok15:38:50.0220 1128 [ 2862A3819BBC9757DD27BAC41A4E0A3E ] C:\Windows\SysWOW64\pnidui.dll15:38:50.0220 1128 C:\Windows\SysWOW64\pnidui.dll - ok15:38:50.0224 1128 [ 781BAB24F81C216FB02A6DB7BDBCA3A1 ] C:\Windows\System32\gfxSrvc.dll15:38:50.0224 1128 C:\Windows\System32\gfxSrvc.dll - ok15:38:50.0227 1128 [ 7C6A2CCF98024A5EF8740162701CE3E7 ] C:\Windows\SysWOW64\tquery.dll15:38:50.0227 1128 C:\Windows\SysWOW64\tquery.dll - ok15:38:50.0231 1128 [ 7F87FEBFBCEE844A080A76C83A1B013F ] C:\Windows\SysWOW64\schedcli.dll15:38:50.0231 1128 C:\Windows\SysWOW64\schedcli.dll - ok15:38:50.0234 1128 [ FD4F95ABDE5603478C929B6CB0BDCFFF ] C:\Windows\System32\pnidui.dll15:38:50.0234 1128 C:\Windows\System32\pnidui.dll - ok15:38:50.0238 1128 [ F908FE45F8FE9E0D4CBE65F9FF5DF6DA ] C:\Windows\SysWOW64\mfc100enu.dll15:38:50.0238 1128 C:\Windows\SysWOW64\mfc100enu.dll - ok15:38:50.0241 1128 [ 0D5CC53EAA50F56AB171F91E7E995176 ] C:\Program Files (x86)\EgisTec IPS\LiveUpdateUI.dll15:38:50.0241 1128 C:\Program Files (x86)\EgisTec IPS\LiveUpdateUI.dll - ok15:38:50.0245 1128 [ 539C49CEBB3C50957AC8A09D95ECD880 ] C:\Windows\SysWOW64\shfolder.dll15:38:50.0245 1128 C:\Windows\SysWOW64\shfolder.dll - ok15:38:50.0248 1128 [ 0CE7A0FFBBA93810384B6794C6901F4C ] C:\Windows\SysWOW64\mssrch.dll15:38:50.0248 1128 C:\Windows\SysWOW64\mssrch.dll - ok15:38:50.0252 1128 [ 45F0F12A11861CE0FB682B87A310FE41 ] C:\Windows\SysWOW64\QUTIL.DLL15:38:50.0252 1128 C:\Windows\SysWOW64\QUTIL.DLL - ok15:38:50.0254 1128 [ 05E265383710D6135A248DEED73CD59E ] C:\Windows\System32\wbem\en-US\cimwin32.dll.mui15:38:50.0254 1128 C:\Windows\System32\wbem\en-US\cimwin32.dll.mui - ok15:38:50.0258 1128 [ BD03C64C4B1F34D1F330BF6C4AC8113D ] C:\Windows\System32\QUTIL.DLL15:38:50.0258 1128 C:\Windows\System32\QUTIL.DLL - ok15:38:50.0261 1128 [ 31C2ADCC585BF23219EAC12923EC4B8C ] C:\Windows\SysWOW64\msxml3r.dll15:38:50.0261 1128 C:\Windows\SysWOW64\msxml3r.dll - ok15:38:50.0265 1128 [ 53EC01707439C113AA7B495FFB24A0AB ] C:\Windows\SysWOW64\en-US\SearchIndexer.exe.mui15:38:50.0265 1128 C:\Windows\SysWOW64\en-US\SearchIndexer.exe.mui - ok15:38:50.0267 1128 [ 439509D86940BD613C5D25FC44F39263 ] C:\Windows\System32\IGFXDEVLib.dll15:38:50.0267 1128 C:\Windows\System32\IGFXDEVLib.dll - ok15:38:50.0271 1128 [ 7849250D8EC5FEEA33A3C37331F56793 ] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\dmres.dll15:38:50.0271 1128 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\dmres.dll - ok15:38:50.0275 1128 [ C836175870E00ACC546066632E15BD10 ] C:\Windows\ehome\ehSSO.dll15:38:50.0275 1128 C:\Windows\ehome\ehSSO.dll - ok15:38:50.0277 1128 [ 98E9CB23C8E9A8A0E5CEBC8EEF07F3C1 ] C:\Windows\SysWOW64\igdumdx32.dll15:38:50.0277 1128 C:\Windows\SysWOW64\igdumdx32.dll - ok15:38:50.0281 1128 [ 6EDBF91C10EE47AC4AC1C58E71F0245A ] C:\Program Files (x86)\AVG\AVG2013\avgkrnlapix.dll15:38:50.0281 1128 C:\Program Files (x86)\AVG\AVG2013\avgkrnlapix.dll - ok15:38:50.0284 1128 [ F5EB1E039498D6F1D106E96CE7C1F3C6 ] C:\Windows\SysWOW64\WPDShServiceObj.dll15:38:50.0284 1128 C:\Windows\SysWOW64\WPDShServiceObj.dll - ok15:38:50.0286 1128 [ AB01C36BCC34CCFE5B0BB5FFB2605135 ] C:\Windows\System32\WPDShServiceObj.dll15:38:50.0286 1128 C:\Windows\System32\WPDShServiceObj.dll - ok15:38:50.0290 1128 [ 8413A4BD6E2F7224E6378EC22E3E3875 ] C:\Windows\System32\igdumd64.dll15:38:50.0290 1128 C:\Windows\System32\igdumd64.dll - ok15:38:50.0294 1128 [ 81600E2E27ED61427AAD865B9BCDDB9D ] C:\Windows\SysWOW64\msidle.dll15:38:50.0294 1128 C:\Windows\SysWOW64\msidle.dll - ok15:38:50.0296 1128 [ 8F1BAE0A35F3ED80C0859BF05E4EF6ED ] C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll15:38:50.0296 1128 C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll - ok15:38:50.0298 1128 [ C0A9D2F9B548C7DC3750D513566A31FE ] C:\Program Files (x86)\EgisTec IPS\LicenseCenter.dll15:38:50.0298 1128 C:\Program Files (x86)\EgisTec IPS\LicenseCenter.dll - ok15:38:50.0302 1128 [ 8A5BCAA97D2ADA3E11E5D5B13A870982 ] C:\Program Files (x86)\EgisTec IPS\UpdateModel.dll15:38:50.0302 1128 C:\Program Files (x86)\EgisTec IPS\UpdateModel.dll - ok15:38:50.0305 1128 [ B63E24E9271E99FD4540E3CA22A937DA ] C:\Windows\SysWOW64\en-US\tquery.dll.mui15:38:50.0305 1128 C:\Windows\SysWOW64\en-US\tquery.dll.mui - ok15:38:50.0308 1128 [ C746F3BF98E92FB137B5BD2B8B5925BD ] C:\Windows\System32\FXSST.dll15:38:50.0308 1128 C:\Windows\System32\FXSST.dll - ok15:38:50.0311 1128 [ 304D35722507447B133CBD606A020850 ] C:\Windows\SysWOW64\igdumd32.dll15:38:50.0311 1128 C:\Windows\SysWOW64\igdumd32.dll - ok15:38:50.0315 1128 [ 942E57152F1CD0533644AB30EF1A4728 ] C:\Windows\SysWOW64\FXSAPI.dll15:38:50.0315 1128 C:\Windows\SysWOW64\FXSAPI.dll - ok15:38:50.0318 1128 [ 5D89D063A4CB036C258685C8E057E768 ] C:\Windows\System32\framedynos.dll15:38:50.0318 1128 C:\Windows\System32\framedynos.dll - ok15:38:50.0321 1128 [ 34E6D8C67E7FD7C917BECFECA326B168 ] C:\Windows\System32\FXSAPI.dll15:38:50.0321 1128 C:\Windows\System32\FXSAPI.dll - ok15:38:50.0325 1128 [ 031C6782F2D50336FC2C72F8D14A4C13 ] C:\Windows\System32\wbem\wmiprov.dll15:38:50.0325 1128 C:\Windows\System32\wbem\wmiprov.dll - ok15:38:50.0328 1128 [ 205B7034B64DE5A68DEB96B47B7E889B ] C:\Windows\SysWOW64\mscms.dll15:38:50.0328 1128 C:\Windows\SysWOW64\mscms.dll - ok15:38:50.0331 1128 [ 5F16C07CFA97228DB5AC98D61D770827 ] C:\Windows\SysWOW64\imapi2.dll15:38:50.0331 1128 C:\Windows\SysWOW64\imapi2.dll - ok15:38:50.0334 1128 [ C4096CA42199428B3D63DC206C197F0E ] C:\Windows\SysWOW64\FXSRESM.dll15:38:50.0334 1128 C:\Windows\SysWOW64\FXSRESM.dll - ok15:38:50.0337 1128 [ C8E8B8239FCF17BEA10E751BE5854631 ] C:\Windows\System32\FXSRESM.dll15:38:50.0337 1128 C:\Windows\System32\FXSRESM.dll - ok15:38:50.0339 1128 [ 9B7221AA291A7BCB581E5A601BFCA8C3 ] C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\1fb1b14199d6aec70df1a0626a3ae5f2\System.Xml.ni.dll15:38:50.0339 1128 C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\1fb1b14199d6aec70df1a0626a3ae5f2\System.Xml.ni.dll - ok15:38:50.0343 1128 [ 8B886A0AC14EAA8599142887991A5A2E ] C:\Windows\System32\imapi2.dll15:38:50.0343 1128 C:\Windows\System32\imapi2.dll - ok15:38:50.0347 1128 [ 2D15C41214F518FC3C72A4C01C30882F ] C:\Windows\SysWOW64\bthprops.cpl15:38:50.0347 1128 C:\Windows\SysWOW64\bthprops.cpl - ok15:38:50.0350 1128 [ 92AAF75C3EB344A098DC026BC9DDF42A ] C:\Windows\System32\bthprops.cpl15:38:50.0350 1128 C:\Windows\System32\bthprops.cpl - ok15:38:50.0354 1128 [ 411356B3DAF2C8BA1E325F976B60F9B6 ] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll15:38:50.0354 1128 C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll - ok15:38:50.0358 1128 [ 5AE88135C6A86FCD67BA16AFBB1C8389 ] C:\Windows\SysWOW64\wbem\esscli.dll15:38:50.0358 1128 C:\Windows\SysWOW64\wbem\esscli.dll - ok15:38:50.0361 1128 [ 9EED448E2C6306BFD8B2B19063FC21A1 ] C:\Program Files (x86)\AVG\AVG2013\avgidpmx.dll15:38:50.0361 1128 C:\Program Files (x86)\AVG\AVG2013\avgidpmx.dll - ok15:38:50.0365 1128 [ D4C438883154C3D082FB2E629191C45F ] C:\Windows\SysWOW64\srchadmin.dll15:38:50.0365 1128 C:\Windows\SysWOW64\srchadmin.dll - ok15:38:50.0368 1128 [ 1FDFC4E9E7405E08FCFF224B49359D61 ] C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\907b2b3dae591e0484acfc0ea63e8caa\System.Configuration.ni.dll15:38:50.0369 1128 C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\907b2b3dae591e0484acfc0ea63e8caa\System.Configuration.ni.dll - ok15:38:50.0372 1128 [ EFBC1DD333C99CA52A1371C74D4BA7A7 ] C:\Windows\SysWOW64\vssapi.dll15:38:50.0372 1128 C:\Windows\SysWOW64\vssapi.dll - ok15:38:50.0375 1128 [ 2C5B8A680A90E96B1EC0D6DA0505E685 ] C:\Windows\System32\srchadmin.dll15:38:50.0375 1128 C:\Windows\System32\srchadmin.dll - ok15:38:50.0379 1128 [ 39E9AACC4C5FB3C3C0B12DE6D491553D ] C:\Windows\SysWOW64\WindowsCodecsExt.dll15:38:50.0379 1128 C:\Windows\SysWOW64\WindowsCodecsExt.dll - ok15:38:50.0383 1128 [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] C:\Windows\System32\FXSSVC.exe15:38:50.0383 1128 C:\Windows\System32\FXSSVC.exe - ok15:38:50.0386 1128 [ B940289C83121046BD6A60ACC6028593 ] C:\Windows\SysWOW64\vsstrace.dll15:38:50.0386 1128 C:\Windows\SysWOW64\vsstrace.dll - ok15:38:50.0389 1128 [ 80C834BA6B844C4B717F2465C4E8EC0F ] C:\Windows\System32\WindowsCodecsExt.dll15:38:50.0390 1128 C:\Windows\System32\WindowsCodecsExt.dll - ok15:38:50.0393 1128 [ F343D80C26B3BDFCA8066BD5FD397E73 ] C:\Windows\SysWOW64\en-US\vsstrace.dll.mui15:38:50.0393 1128 C:\Windows\SysWOW64\en-US\vsstrace.dll.mui - ok15:38:50.0397 1128 [ 2FEF21EEE9934BB10165AA02E530183C ] C:\Program Files (x86)\AVG\AVG2013\avglngx.dll15:38:50.0397 1128 C:\Program Files (x86)\AVG\AVG2013\avglngx.dll - ok15:38:50.0400 1128 [ 816B681CC308FAA128EDCB90643DCED7 ] C:\Windows\SysWOW64\icm32.dll15:38:50.0400 1128 C:\Windows\SysWOW64\icm32.dll - ok15:38:50.0403 1128 [ 1D296F090ED401967B30BD2B970DC306 ] C:\Windows\System32\icm32.dll15:38:50.0404 1128 C:\Windows\System32\icm32.dll - ok15:38:50.0407 1128 [ D39DA70FEA6BD713682F70635587DA9E ] C:\Windows\SysWOW64\rasdlg.dll15:38:50.0407 1128 C:\Windows\SysWOW64\rasdlg.dll - ok15:38:50.0411 1128 [ F87A7BB428E4AC68D348DF600F1EA1A2 ] C:\Windows\System32\tquery.dll15:38:50.0411 1128 C:\Windows\System32\tquery.dll - ok15:38:50.0414 1128 [ 859CCB2DF98EF1548C70E2D2B34001C8 ] C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsFormsIntegra#\76290827c2b696a500a7f59a2cdb51d8\WindowsFormsIntegration.ni.dll15:38:50.0414 1128 C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsFormsIntegra#\76290827c2b696a500a7f59a2cdb51d8\WindowsFormsIntegration.ni.dll - ok15:38:50.0418 1128 [ D2155709E336C3BC15729EB87FEC6064 ] C:\Windows\System32\rasdlg.dll15:38:50.0418 1128 C:\Windows\System32\rasdlg.dll - ok15:38:50.0421 1128 [ 1384E081DCC7F44F524C24256C25F706 ] C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\8e063806944330786c030e486a6f4dbd\PresentationFramework.Aero.ni.dll15:38:50.0422 1128 C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\8e063806944330786c030e486a6f4dbd\PresentationFramework.Aero.ni.dll - ok15:38:50.0425 1128 [ 6699A112A3BDC9B52338512894EBA9D6 ] C:\Program Files\Windows Media Player\wmpnscfg.exe15:38:50.0426 1128 C:\Program Files\Windows Media Player\wmpnscfg.exe - ok15:38:50.0429 1128 [ 78A6501E4E37118C568A606623A275BB ] C:\Windows\System32\mssrch.dll15:38:50.0429 1128 C:\Windows\System32\mssrch.dll - ok15:38:50.0433 1128 [ 12395E528456DFE82979ACFEA96D290C ] C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui15:38:50.0433 1128 C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui - ok15:38:50.0436 1128 [ C7494C67A6BF6FE914808E42F8265FEF ] C:\Program Files\Windows Media Player\wmpnssci.dll15:38:50.0436 1128 C:\Program Files\Windows Media Player\wmpnssci.dll - ok15:38:50.0440 1128 [ 1D6A771D1D702AE07919DB52C889A249 ] C:\Windows\SysWOW64\wlanutil.dll15:38:50.0440 1128 C:\Windows\SysWOW64\wlanutil.dll - ok15:38:50.0444 1128 [ ECE9B82C7696AD211F9BD64E41DF598B ] C:\Program Files (x86)\AVG\AVG2013\avguires.dll15:38:50.0444 1128 C:\Program Files (x86)\AVG\AVG2013\avguires.dll - ok15:38:50.0447 1128 [ C02AA67276FEE0C15CC4D6D616BDE95E ] C:\Windows\SysWOW64\WWanAPI.dll15:38:50.0447 1128 C:\Windows\SysWOW64\WWanAPI.dll - ok15:38:50.0450 1128 [ 5DA219F57A9076FB6FBD3C9C3713A672 ] C:\Windows\System32\WWanAPI.dll15:38:50.0450 1128 C:\Windows\System32\WWanAPI.dll - ok15:38:50.0454 1128 [ F2ED6D00921CA138289E5E0CCB9ABF87 ] C:\Windows\SysWOW64\wwapi.dll15:38:50.0454 1128 C:\Windows\SysWOW64\wwapi.dll - ok15:38:50.0457 1128 [ 3121A79D13A61562BE9CC902CD46B542 ] C:\Windows\System32\msidle.dll15:38:50.0458 1128 C:\Windows\System32\msidle.dll - ok15:38:50.0461 1128 [ 62C7AACC746C9723468A8F2169ED3E85 ] C:\Windows\System32\wwapi.dll15:38:50.0461 1128 C:\Windows\System32\wwapi.dll - ok15:38:50.0465 1128 [ 6F743071BA9C86EFE805152B45B9EC35 ] C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\10f1e1ffca16e550af8a8fd7685a48ef\System.Drawing.ni.dll15:38:50.0465 1128 C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\10f1e1ffca16e550af8a8fd7685a48ef\System.Drawing.ni.dll - ok15:38:50.0468 1128 [ 730E90935150048A4E5F392FCDD49DA3 ] C:\Program Files (x86)\AVG\AVG2013\avgapps.dll15:38:50.0468 1128 C:\Program Files (x86)\AVG\AVG2013\avgapps.dll - ok15:38:50.0472 1128 [ 99BD4B9B15A823A6C46B561329178122 ] C:\Windows\SysWOW64\QAGENT.DLL15:38:50.0472 1128 C:\Windows\SysWOW64\QAGENT.DLL - ok15:38:50.0475 1128 [ E898B024C5406C4A067FA26D5DE0E6DF ] C:\Windows\SysWOW64\wmp.dll15:38:50.0475 1128 C:\Windows\SysWOW64\wmp.dll - ok15:38:50.0479 1128 [ ACE1BB07E0377E37A2C514CD2EC119B1 ] C:\Windows\System32\mssprxy.dll15:38:50.0479 1128 C:\Windows\System32\mssprxy.dll - ok15:38:50.0482 1128 [ E26C32401A6CC046C7AEFAE3A287D842 ] C:\Windows\SysWOW64\en-US\wmploc.DLL.mui15:38:50.0482 1128 C:\Windows\SysWOW64\en-US\wmploc.DLL.mui - ok15:38:50.0486 1128 [ 0B9F7D42D745038437FAE70D97F9AD5A ] C:\Windows\System32\QAGENT.DLL15:38:50.0486 1128 C:\Windows\System32\QAGENT.DLL - ok15:38:50.0489 1128 [ C9FB9038B15036CA28CF0B4BE2BED9BD ] C:\Windows\System32\en-US\tquery.dll.mui15:38:50.0489 1128 C:\Windows\System32\en-US\tquery.dll.mui - ok15:38:50.0493 1128 [ 5893EBDCE371174AC89ECD7731DD6D77 ] C:\Windows\SysWOW64\pcwum.dll15:38:50.0493 1128 C:\Windows\SysWOW64\pcwum.dll - ok15:38:50.0497 1128 [ 9BF014C20F91D97055532F2F5496E7BD ] C:\Program Files\Windows Media Player\wmpnetwk.exe15:38:50.0497 1128 C:\Program Files\Windows Media Player\wmpnetwk.exe - ok15:38:50.0500 1128 [ 833FBB672460EFCE8011D262175FAD33 ] C:\Windows\SysWOW64\upnphost.dll15:38:50.0500 1128 C:\Windows\SysWOW64\upnphost.dll - ok15:38:50.0504 1128 [ 89ED7C028A487340B7D93D5A38FDCB54 ] C:\Windows\SysWOW64\SearchProtocolHost.exe15:38:50.0504 1128 C:\Windows\SysWOW64\SearchProtocolHost.exe - ok15:38:50.0508 1128 [ 177DF28315BF4300ECB5CBEEEE961292 ] C:\Windows\SysWOW64\webcheck.dll15:38:50.0508 1128 C:\Windows\SysWOW64\webcheck.dll - ok15:38:50.0511 1128 [ 42EC9065D9BF266ADE924B066C783A56 ] C:\Windows\System32\SearchProtocolHost.exe15:38:50.0511 1128 C:\Windows\System32\SearchProtocolHost.exe - ok15:38:50.0515 1128 [ D7D7EB64B7DE14A783329805E5AC0031 ] C:\Windows\System32\webcheck.dll15:38:50.0515 1128 C:\Windows\System32\webcheck.dll - ok15:38:50.0518 1128 [ 8EE6BDE1D572677AA35707C52C585F75 ] C:\Windows\SysWOW64\mlang.dll15:38:50.0518 1128 C:\Windows\SysWOW64\mlang.dll - ok15:38:50.0522 1128 [ DE76461D3E5EBE1C762967D21C17B8C0 ] C:\Windows\SysWOW64\wmdrmdev.dll15:38:50.0522 1128 C:\Windows\SysWOW64\wmdrmdev.dll - ok15:38:50.0525 1128 [ 8494E126F0B10180F3293AF861CE1F7A ] C:\Windows\System32\mlang.dll15:38:50.0525 1128 C:\Windows\System32\mlang.dll - ok15:38:50.0528 1128 [ 47D052D9EE1FD3BA2A55D13F61E3EF24 ] C:\Windows\SysWOW64\drmv2clt.dll15:38:50.0529 1128 C:\Windows\SysWOW64\drmv2clt.dll - ok15:38:50.0532 1128 [ 8C7FE6B9559204765849BFF308764FA5 ] C:\Windows\SysWOW64\SyncCenter.dll15:38:50.0532 1128 C:\Windows\SysWOW64\SyncCenter.dll - ok15:38:50.0535 1128 [ A5D237B8673025B052C0E6FDB6A883E8 ] C:\Windows\SysWOW64\msshooks.dll15:38:50.0535 1128 C:\Windows\SysWOW64\msshooks.dll - ok15:38:50.0539 1128 [ D2A5B2B09F2AF5ED13BF494508B09788 ] C:\Windows\System32\msshooks.dll15:38:50.0539 1128 C:\Windows\System32\msshooks.dll - ok15:38:50.0542 1128 [ 40B82688907A7DBA4DB3B5ADDE3EAB3B ] C:\Windows\SysWOW64\mfplat.dll15:38:50.0543 1128 C:\Windows\SysWOW64\mfplat.dll - ok15:38:50.0546 1128 [ E6F66F31422C44EDC00D9C9329E7DF60 ] C:\Windows\System32\SyncCenter.dll15:38:50.0546 1128 C:\Windows\System32\SyncCenter.dll - ok15:38:50.0549 1128 [ 8A674F9AB20B4937357BF6F5A0938EBF ] C:\Windows\SysWOW64\SearchFilterHost.exe15:38:50.0549 1128 C:\Windows\SysWOW64\SearchFilterHost.exe - ok15:38:50.0553 1128 [ DE92625114A5A02C715F7E03CA3F6016 ] C:\Windows\SysWOW64\blackbox.dll15:38:50.0553 1128 C:\Windows\SysWOW64\blackbox.dll - ok15:38:50.0556 1128 [ 52D56D1013D4F1B99102679314CC5325 ] C:\Windows\System32\SearchFilterHost.exe15:38:50.0556 1128 C:\Windows\System32\SearchFilterHost.exe - ok15:38:50.0559 1128 [ 7372A79A5F906CD959A74A32E6FEDB1F ] C:\Windows\SysWOW64\upnp.dll15:38:50.0559 1128 C:\Windows\SysWOW64\upnp.dll - ok15:38:50.0562 1128 [ 8CC4ECA2177510674DB92BB8F1CEBBEE ] C:\Windows\SysWOW64\hgcpl.dll15:38:50.0562 1128 C:\Windows\SysWOW64\hgcpl.dll - ok15:38:50.0566 1128 [ 9DA78C1F1F15CE5424EDF18CE4728C01 ] C:\Windows\SysWOW64\wmpps.dll15:38:50.0566 1128 C:\Windows\SysWOW64\wmpps.dll - ok15:38:50.0569 1128 [ AB303E17CD72B3A65AE0E5CDA80307F0 ] C:\Windows\SysWOW64\wmpmde.dll15:38:50.0569 1128 C:\Windows\SysWOW64\wmpmde.dll - ok15:38:50.0571 1128 [ F0AAB2A76A7AF04C70A818E96BAF3E64 ] C:\Windows\System32\hgcpl.dll15:38:50.0571 1128 C:\Windows\System32\hgcpl.dll - ok15:38:50.0575 1128 [ 5BB8C06EB5EA4BA22EE8A678F2D79B25 ] C:\Windows\SysWOW64\devenum.dll15:38:50.0575 1128 C:\Windows\SysWOW64\devenum.dll - ok15:38:50.0577 1128 [ FB08DEC5EF43D0C66D83B8E9694E7549 ] C:\Windows\SysWOW64\provsvc.dll15:38:50.0577 1128 C:\Windows\SysWOW64\provsvc.dll - ok15:38:50.0581 1128 [ 01C7F6D51C93148D2B74B34C4D29FD0E ] C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui15:38:50.0581 1128 C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui - ok15:38:50.0583 1128 [ 32AAEABFF6299834E5D38C3A442CCF36 ] C:\Windows\SysWOW64\mssph.dll15:38:50.0583 1128 C:\Windows\SysWOW64\mssph.dll - ok15:38:50.0587 1128 [ ABDBABE3A7D2222B3A0DB1B8B9CAD16E ] C:\Windows\System32\mssph.dll15:38:50.0587 1128 C:\Windows\System32\mssph.dll - ok15:38:50.0590 1128 [ 000B3A704234C202D4D788A171B02243 ] C:\Windows\SysWOW64\mapi32.dll15:38:50.0590 1128 C:\Windows\SysWOW64\mapi32.dll - ok15:38:50.0594 1128 [ 28E2231BD34A39C854BDF3923AB2FF86 ] C:\Windows\SysWOW64\ssdpapi.dll15:38:50.0594 1128 C:\Windows\SysWOW64\ssdpapi.dll - ok15:38:50.0598 1128 [ 89F4D0DD6606A2FE15931E6888DBBC8D ] C:\Windows\SysWOW64\stdole2.tlb15:38:50.0598 1128 C:\Windows\SysWOW64\stdole2.tlb - ok15:38:50.0601 1128 [ 2A556E2D703DED03186C596B90AC6869 ] C:\Windows\System32\mapi32.dll15:38:50.0601 1128 C:\Windows\System32\mapi32.dll - ok15:38:50.0605 1128 [ 9EA9D567B250EA92BA333F8B26646610 ] C:\Program Files\Internet Explorer\ieproxy.dll15:38:50.0605 1128 C:\Program Files\Internet Explorer\ieproxy.dll - ok15:38:50.0608 1128 [ 8E33E2B24306C5249154322BC99493F5 ] C:\Windows\SysWOW64\httpapi.dll15:38:50.0609 1128 C:\Windows\SysWOW64\httpapi.dll - ok15:38:50.0611 1128 [ 25FC9E3237D9DC8F7511AF13E70C49BC ] C:\Windows\SysWOW64\MSMPEG2ENC.DLL15:38:50.0611 1128 C:\Windows\SysWOW64\MSMPEG2ENC.DLL - ok15:38:50.0614 1128 [ 70F03B29A62194E69911952B3640D9D2 ] C:\Windows\SysWOW64\msdmo.dll15:38:50.0614 1128 C:\Windows\SysWOW64\msdmo.dll - ok15:38:50.0618 1128 [ 5B5A3218962C2BEA0E80788BD345D29A ] C:\Windows\SysWOW64\en-US\FirewallAPI.dll.mui15:38:50.0618 1128 C:\Windows\SysWOW64\en-US\FirewallAPI.dll.mui - ok15:38:50.0621 1128 [ 2D5AFA7F81D3EE061990E78613357C14 ] C:\Windows\SysWOW64\en-US\urlmon.dll.mui15:38:50.0621 1128 C:\Windows\SysWOW64\en-US\urlmon.dll.mui - ok15:38:50.0623 1128 [ E36112A8A6C7F840169A7E92C12F4203 ] C:\Windows\System32\wsock32.dll15:38:50.0623 1128 C:\Windows\System32\wsock32.dll - ok15:38:50.0625 1128 [ 0438CAB2E03F4FB61455A7956026FE86 ] C:\Windows\System32\fdPHost.dll15:38:50.0625 1128 C:\Windows\System32\fdPHost.dll - ok15:38:50.0629 1128 [ 302B93586DFA480545C320EBA5BA6572 ] C:\Windows\System32\wmdrmdev.dll15:38:50.0629 1128 C:\Windows\System32\wmdrmdev.dll - ok15:38:50.0631 1128 [ 2C1055E2C6D42753241FB2A129136994 ] C:\Windows\System32\drmv2clt.dll15:38:50.0631 1128 C:\Windows\System32\drmv2clt.dll - ok15:38:50.0634 1128 [ DE6F4B7E62FDE776F3DE8E5FB5A05C48 ] C:\Windows\SysWOW64\fdWSD.dll15:38:50.0635 1128 C:\Windows\SysWOW64\fdWSD.dll - ok15:38:50.0638 1128 [ 171D7DB433314A868507C4326E8209DC ] C:\Windows\System32\fdWSD.dll15:38:50.0638 1128 C:\Windows\System32\fdWSD.dll - ok15:38:50.0640 1128 [ 54B5DCD55B223BC5DF50B82E1E9E86B1 ] C:\Windows\System32\mfplat.dll15:38:50.0640 1128 C:\Windows\System32\mfplat.dll - ok15:38:50.0644 1128 [ 674611721264013DB169EC12AFC9C3B6 ] C:\Windows\SysWOW64\fdSSDP.dll15:38:50.0644 1128 C:\Windows\SysWOW64\fdSSDP.dll - ok15:38:50.0647 1128 [ A2E5B2D20954210DCE1A75A1FC8CC36D ] C:\Windows\System32\fdSSDP.dll15:38:50.0647 1128 C:\Windows\System32\fdSSDP.dll - ok15:38:50.0649 1128 [ 4F20D081F9C9B91730EE5CB84E9AC8C4 ] C:\Windows\System32\blackbox.dll15:38:50.0649 1128 C:\Windows\System32\blackbox.dll - ok15:38:50.0653 1128 [ 3FF0FA0A81910617739644A06D06D016 ] C:\Windows\SysWOW64\fdProxy.dll15:38:50.0653 1128 C:\Windows\SysWOW64\fdProxy.dll - ok15:38:50.0656 1128 [ DB8BF64BE3932ADC407505D21C4F2C2C ] C:\Windows\System32\fdProxy.dll15:38:50.0656 1128 C:\Windows\System32\fdProxy.dll - ok15:38:50.0660 1128 [ 46EA507EE79269C0272F10BFBE9316C9 ] C:\Windows\System32\upnp.dll15:38:50.0660 1128 C:\Windows\System32\upnp.dll - ok15:38:50.0663 1128 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] C:\Windows\System32\ssdpsrv.dll15:38:50.0663 1128 C:\Windows\System32\ssdpsrv.dll - ok15:38:50.0667 1128 [ 046B2673767CA626E2CFB7FDF735E9E8 ] C:\Windows\System32\ListSvc.dll15:38:50.0667 1128 C:\Windows\System32\ListSvc.dll - ok15:38:50.0670 1128 [ 08DF1B8C9C0754A7069E80A986373F52 ] C:\Windows\SysWOW64\P2P.dll15:38:50.0670 1128 C:\Windows\SysWOW64\P2P.dll - ok15:38:50.0674 1128 [ 4A82EA2807B16FF577AEAF8ADB8779FF ] C:\Windows\System32\IdListen.dll15:38:50.0674 1128 C:\Windows\System32\IdListen.dll - ok15:38:50.0677 1128 [ B9C7F88D85369548A69F2EDD1A40441E ] C:\Windows\System32\hgprint.dll15:38:50.0678 1128 C:\Windows\System32\hgprint.dll - ok15:38:50.0681 1128 [ B6411CED931AFD059E48C52DBFBA95B4 ] C:\Windows\System32\P2P.dll15:38:50.0681 1128 C:\Windows\System32\P2P.dll - ok15:38:50.0684 1128 [ 1B0EC94520CAB89A9CE1B2DA405166AF ] C:\Windows\SysWOW64\p2pcollab.dll15:38:50.0684 1128 C:\Windows\SysWOW64\p2pcollab.dll - ok15:38:50.0688 1128 [ 3EAC4455472CC2C97107B5291E0DCAFE ] C:\Windows\System32\pnrpsvc.dll15:38:50.0688 1128 C:\Windows\System32\pnrpsvc.dll - ok15:38:50.0691 1128 [ FBC18BEE67E9179F02E7894EB548F18D ] C:\Windows\SysWOW64\en-US\svchost.exe.mui15:38:50.0691 1128 C:\Windows\SysWOW64\en-US\svchost.exe.mui - ok15:38:50.0695 1128 [ FC20E8E70AE0E2A521EA11B63AFF63BC ] C:\Windows\SysWOW64\en-US\crypt32.dll.mui15:38:50.0695 1128 C:\Windows\SysWOW64\en-US\crypt32.dll.mui - ok15:38:50.0698 1128 [ C486E495C352FD6CA5168A1050F1A828 ] C:\Windows\SysWOW64\en-US\p2pcollab.dll.mui15:38:50.0698 1128 C:\Windows\SysWOW64\en-US\p2pcollab.dll.mui - ok15:38:50.0702 1128 [ DA4F4927E92DC21B14A42EE59F7038D4 ] C:\Windows\SysWOW64\en-US\dnsapi.dll.mui15:38:50.0702 1128 C:\Windows\SysWOW64\en-US\dnsapi.dll.mui - ok15:38:50.0705 1128 [ CC6975CAC67B3112C8059A64713BF232 ] C:\Windows\SysWOW64\en-US\QAgentRT.dll.mui15:38:50.0705 1128 C:\Windows\SysWOW64\en-US\QAgentRT.dll.mui - ok15:38:50.0709 1128 [ D7BB0BA60B5910CBD644FBF8526AA936 ] C:\Windows\System32\en-US\fveui.dll.mui15:38:50.0709 1128 C:\Windows\System32\en-US\fveui.dll.mui - ok15:38:50.0713 1128 [ 927463ECB02179F88E4B9A17568C63C3 ] C:\Windows\System32\p2psvc.dll15:38:50.0713 1128 C:\Windows\System32\p2psvc.dll - ok15:38:50.0716 1128 [ AD888613E7BE5CCD7BF25CA8EBDA4E7C ] C:\Windows\System32\wmp.dll15:38:50.0716 1128 C:\Windows\System32\wmp.dll - ok15:38:50.0719 1128 [ 1372E8E8FD066002131E3D509275E697 ] C:\Windows\SysWOW64\P2PGraph.dll15:38:50.0719 1128 C:\Windows\SysWOW64\P2PGraph.dll - ok15:38:50.0723 1128 [ 937FE1D6BBD29A35139746E93806D7EF ] C:\Windows\System32\en-US\p2psvc.dll.mui15:38:50.0723 1128 C:\Windows\System32\en-US\p2psvc.dll.mui - ok15:38:50.0727 1128 [ D62840B33B87BC2ED8D7060D7C66096C ] C:\Windows\System32\wmploc.DLL15:38:50.0727 1128 C:\Windows\System32\wmploc.DLL - ok15:38:50.0730 1128 [ 3AEE02CEDAA3ACD14F9D7E038E44D6D1 ] C:\Windows\System32\P2PGraph.dll15:38:50.0730 1128 C:\Windows\System32\P2PGraph.dll - ok15:38:50.0734 1128 [ 2D444C361F758D6CC4B2F51655ECF528 ] C:\Windows\System32\wmpps.dll15:38:50.0734 1128 C:\Windows\System32\wmpps.dll - ok15:38:50.0737 1128 [ AF5D4C95BCF1C002461637E5DDA95609 ] C:\Windows\System32\wmpmde.dll15:38:50.0737 1128 C:\Windows\System32\wmpmde.dll - ok15:38:50.0740 1128 [ EC7EB038EA11E0D04214D143E0CB6002 ] C:\Windows\System32\WinSATAPI.dll15:38:50.0742 1128 C:\Windows\System32\WinSATAPI.dll - ok15:38:50.0744 1128 [ 2BF5A09197251572A74C426EE3E35117 ] C:\Windows\System32\MSMPEG2ENC.DLL15:38:50.0744 1128 C:\Windows\System32\MSMPEG2ENC.DLL - ok15:38:50.0747 1128 [ 46767946E7B559D981C1DC04EC0AB36F ] C:\Windows\System32\devenum.dll15:38:50.0747 1128 C:\Windows\System32\devenum.dll - ok15:38:50.0751 1128 [ 0B0604BC02CA5F77A1F23C6B0D86AE8C ] C:\Windows\System32\msdmo.dll15:38:50.0751 1128 C:\Windows\System32\msdmo.dll - ok15:38:50.0754 1128 [ D47EC6A8E81633DD18D2436B19BAF6DE ] C:\Windows\System32\upnphost.dll15:38:50.0754 1128 C:\Windows\System32\upnphost.dll - ok15:38:50.0758 1128 [ 98417DB5BF5777BC6C60D7317CB781C4 ] C:\Windows\System32\msxml3.dll15:38:50.0758 1128 C:\Windows\System32\msxml3.dll - ok15:38:50.0761 1128 [ 230EA9ABBC3432CDE388F4891E76E867 ] C:\Windows\SysWOW64\udhisapi.dll15:38:50.0761 1128 C:\Windows\SysWOW64\udhisapi.dll - ok15:38:50.0765 1128 [ 71E68F2443A80BD4DA89181889C457EA ] C:\Windows\System32\udhisapi.dll15:38:50.0765 1128 C:\Windows\System32\udhisapi.dll - ok15:38:50.0769 1128 [ C88E03805311A599F22B00015AA0F548 ] C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\SiteSafety.dll15:38:50.0769 1128 C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\SiteSafety.dll - ok15:38:50.0773 1128 [ F5818C723320704BA25D580F61ABD772 ] C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\15.0.0\avgdttbx.dll15:38:50.0773 1128 C:\Program Files (x86)\Common Files\AVG Secure Search\DNTInstaller\15.0.0\avgdttbx.dll - ok15:38:50.0777 1128 [ D6692338B985D4A0CA52B828314D897D ] C:\Windows\SysWOW64\drprov.dll15:38:50.0777 1128 C:\Windows\SysWOW64\drprov.dll - ok15:38:50.0781 1128 [ 5F639198C4137075DA50E61C23963C11 ] C:\Windows\System32\drprov.dll15:38:50.0781 1128 C:\Windows\System32\drprov.dll - ok15:38:50.0784 1128 [ 06018B349666595970E15397E78A0D77 ] C:\Windows\SysWOW64\ntlanman.dll15:38:50.0784 1128 C:\Windows\SysWOW64\ntlanman.dll - ok15:38:50.0787 1128 [ 7273921B6DDFEFF3A8567B9800C5673A ] C:\Windows\System32\ntlanman.dll15:38:50.0788 1128 C:\Windows\System32\ntlanman.dll - ok15:38:50.0791 1128 [ 44F7AC99B73AF64884A67F17D9E0A773 ] C:\Windows\SysWOW64\davclnt.dll15:38:50.0791 1128 C:\Windows\SysWOW64\davclnt.dll - ok15:38:50.0794 1128 [ 016544B452E6FDB54CD108D0248DB2B1 ] C:\Windows\System32\davclnt.dll15:38:50.0794 1128 C:\Windows\System32\davclnt.dll - ok15:38:50.0798 1128 [ 179BECE8D1A4C488DDB7191FF9BE3FB0 ] C:\Windows\SysWOW64\davhlpr.dll15:38:50.0798 1128 C:\Windows\SysWOW64\davhlpr.dll - ok15:38:50.0801 1128 [ 45B24A357C801CE62052FE0CDC8BD4D2 ] C:\Windows\System32\davhlpr.dll15:38:50.0801 1128 C:\Windows\System32\davhlpr.dll - ok15:38:50.0805 1128 [ 0A53FD4EBBD92002CCC362A9B8087885 ] C:\Windows\SysWOW64\schannel.dll15:38:50.0805 1128 C:\Windows\SysWOW64\schannel.dll - ok15:38:50.0809 1128 [ F11A57E91FDAECFB41A5CB21EB1EBC8E ] C:\Windows\System32\dssenh.dll15:38:50.0809 1128 C:\Windows\System32\dssenh.dll - ok15:38:50.0812 1128 [ 99B9343280AF6A4C0F27CF2E28E94BBF ] C:\Windows\SysWOW64\dssenh.dll15:38:50.0812 1128 C:\Windows\SysWOW64\dssenh.dll - ok15:38:50.0816 1128 [ 68F6725B4A59E16C04B3F3AC514D6724 ] C:\Program Files (x86)\AVG\AVG2013\fixcfg.exe15:38:50.0816 1128 C:\Program Files (x86)\AVG\AVG2013\fixcfg.exe - ok15:38:50.0819 1128 [ AA3B91B70E79BCE70AD3B190789B9574 ] C:\Windows\SysWOW64\drttransport.dll15:38:50.0819 1128 C:\Windows\SysWOW64\drttransport.dll - ok15:38:50.0823 1128 [ 2E7ADF9B0389CD94605717784D7E416A ] C:\Windows\System32\drttransport.dll15:38:50.0823 1128 C:\Windows\System32\drttransport.dll - ok15:38:50.0827 1128 [ EE29FCC244C8033E2F748D863DCBF378 ] C:\Windows\SysWOW64\drt.dll15:38:50.0827 1128 C:\Windows\SysWOW64\drt.dll - ok15:38:50.0831 1128 [ C57BC99A4467B3E8F1CC2184A3F46729 ] C:\Windows\System32\drt.dll15:38:50.0831 1128 C:\Windows\System32\drt.dll - ok15:38:50.0835 1128 [ 139677BB4CA72DBB99FDF80E74FA0B95 ] C:\Program Files\Windows Media Player\WMPMediaSharing.dll15:38:50.0835 1128 C:\Program Files\Windows Media Player\WMPMediaSharing.dll - ok15:38:50.0838 1128 [ 0DCA6A11D09D4C2CBE6B898B897EA915 ] C:\Windows\SysWOW64\UIAnimation.dll15:38:50.0839 1128 C:\Windows\SysWOW64\UIAnimation.dll - ok15:38:50.0842 1128 [ 3819AD4329303EAC88480CA16A650735 ] C:\Windows\System32\UIAnimation.dll15:38:50.0842 1128 C:\Windows\System32\UIAnimation.dll - ok15:38:50.0846 1128 [ B0BF698030DB6561393AE753C6D3F936 ] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe15:38:50.0846 1128 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - ok15:38:50.0850 1128 [ 27352AAC3B0CCE5C325CEC3BE4D83A9B ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\chrome.dll15:38:50.0850 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\chrome.dll - ok15:38:50.0854 1128 [ 20B2FD7BA7B16B5B0297062F2DDE5296 ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\icudt.dll15:38:50.0854 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\icudt.dll - ok15:38:50.0858 1128 [ 236360CE5E4C3F063AC110533747C0A8 ] C:\Windows\SysWOW64\Wpc.dll15:38:50.0858 1128 C:\Windows\SysWOW64\Wpc.dll - ok15:38:50.0861 1128 [ 5BF8E37FA1E25227480F9CD2ACA21FB6 ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\d3dcompiler_46.dll15:38:50.0861 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\d3dcompiler_46.dll - ok15:38:50.0865 1128 [ 6FF1689E63D2EBCAB1456EC19F6C2C7C ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\libglesv2.dll15:38:50.0865 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\libglesv2.dll - ok15:38:50.0870 1128 [ 9159A49B13B5D4DA262415D87A5F7212 ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\libegl.dll15:38:50.0870 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\libegl.dll - ok15:38:50.0873 1128 [ 1F27643C4C626457FCE8F047AE1CD7E1 ] C:\Windows\SysWOW64\dxva2.dll15:38:50.0873 1128 C:\Windows\SysWOW64\dxva2.dll - ok15:38:50.0876 1128 [ 80EFBCAFBD26956B69EE9CEFC93423B0 ] C:\Windows\SysWOW64\mf.dll15:38:50.0876 1128 C:\Windows\SysWOW64\mf.dll - ok15:38:50.0879 1128 [ 3DE43BFDAF3F8979699650202AA18B12 ] C:\Windows\SysWOW64\msmpeg2vdec.dll15:38:50.0879 1128 C:\Windows\SysWOW64\msmpeg2vdec.dll - ok15:38:50.0883 1128 [ FF7E3A2EE80ADEE757021E967BBB77F0 ] C:\Windows\SysWOW64\evr.dll15:38:50.0883 1128 C:\Windows\SysWOW64\evr.dll - ok15:38:50.0886 1128 [ 689035D36092179300547AE4266A00EE ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\pdf.dll15:38:50.0886 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\pdf.dll - ok15:38:50.0890 1128 [ 1948BFFB626F0065BA6911FE970E8483 ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\ppgooglenaclpluginchrome.dll15:38:50.0890 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\ppgooglenaclpluginchrome.dll - ok15:38:50.0894 1128 [ E56FE56A51BC05E9CC367B3CC2BBFFA9 ] C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\ffmpegsumo.dll15:38:50.0894 1128 C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.43\ffmpegsumo.dll - ok15:38:50.0898 1128 [ C7DE4414D5F6F9373F913CB86262D512 ] C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe15:38:50.0898 1128 C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe - ok15:38:50.0902 1128 [ 518FF3876B04E4AB7D8C9ECAA60B4F1E ] C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll15:38:50.0902 1128 C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll - ok15:38:50.0906 1128 [ 88373275BF446644765F632D5249DC7C ] C:\Windows\SysWOW64\Speech\Common\sapi.dll15:38:50.0906 1128 C:\Windows\SysWOW64\Speech\Common\sapi.dll - ok15:38:50.0910 1128 [ B2D60B4B1D8C81731A925678F040B394 ] C:\Windows\System32\Speech\Common\sapi.dll15:38:50.0910 1128 C:\Windows\System32\Speech\Common\sapi.dll - ok15:38:50.0913 1128 [ CDAD3376DFF3D9AC7FDCBE2B94B0D3C8 ] C:\Windows\System32\shfolder.dll15:38:50.0913 1128 C:\Windows\System32\shfolder.dll - ok15:38:50.0917 1128 [ 35DB83C4DE9FA3889E937125D115EAA0 ] C:\Program Files (x86)\Google\Update\1.3.21.135\goopdateres_en.dll15:38:50.0917 1128 C:\Program Files (x86)\Google\Update\1.3.21.135\goopdateres_en.dll - ok15:38:50.0920 1128 [ 913D843498553A1BC8F8DBAD6358E49F ] C:\Windows\System32\sppsvc.exe15:38:50.0920 1128 C:\Windows\System32\sppsvc.exe - ok15:38:50.0924 1128 [ FFF95479C7AB1550F0750A5D01744211 ] C:\Windows\System32\drivers\spsys.sys15:38:50.0924 1128 C:\Windows\System32\drivers\spsys.sys - ok15:38:50.0928 1128 [ E8B1FE6669397D1772D8196DF0E57A9E ] C:\Windows\System32\wscsvc.dll15:38:50.0928 1128 C:\Windows\System32\wscsvc.dll - ok15:38:50.0931 1128 [ B7BDBEBC74105E68A3093073C30E3498 ] C:\Windows\System32\sppwinob.dll15:38:50.0931 1128 C:\Windows\System32\sppwinob.dll - ok15:38:50.0934 1128 [ DD4400813589985677A363F8A589CD02 ] C:\Windows\SysWOW64\wuapi.dll15:38:50.0934 1128 C:\Windows\SysWOW64\wuapi.dll - ok15:38:50.0938 1128 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] C:\Windows\System32\wuaueng.dll15:38:50.0938 1128 C:\Windows\System32\wuaueng.dll - ok15:38:50.0941 1128 [ C47F35CC6FA4F1BDBEF8F87AC1A46537 ] C:\Windows\System32\wuapi.dll15:38:50.0941 1128 C:\Windows\System32\wuapi.dll - ok15:38:50.0945 1128 [ 387A8A473ECC5BA02CF453277C1F3274 ] C:\Windows\SysWOW64\mspatcha.dll15:38:50.0945 1128 C:\Windows\SysWOW64\mspatcha.dll - ok15:38:50.0948 1128 [ 617F6EC0AC677C685479C1D0D1E76C6F ] C:\Windows\System32\mspatcha.dll15:38:50.0948 1128 C:\Windows\System32\mspatcha.dll - ok15:38:50.0952 1128 [ 2EA045FDD715FB03F65F6915B7FE8916 ] C:\Windows\SysWOW64\wups.dll15:38:50.0952 1128 C:\Windows\SysWOW64\wups.dll - ok15:38:50.0955 1128 [ E746ED90132C6B6313CE9179F56BD31D ] C:\Windows\System32\wups.dll15:38:50.0955 1128 C:\Windows\System32\wups.dll - ok15:38:50.0959 1128 [ D412B1B72C5AB020218E9A047D90CA05 ] C:\Windows\SysWOW64\wmsgapi.dll15:38:50.0959 1128 C:\Windows\SysWOW64\wmsgapi.dll - ok15:38:50.0963 1128 [ 7FE0D0C8F53735EA17C9AE93EFE7AD5A ] C:\Windows\System32\wups2.dll15:38:50.0963 1128 C:\Windows\System32\wups2.dll - ok15:38:50.0966 1128 [ 2F530C1448D4984F2A3F995895F2D532 ] C:\Windows\System32\sppobjs.dll15:38:50.0966 1128 C:\Windows\System32\sppobjs.dll - ok15:38:50.0970 1128 [ 28D2C5CE5944E1B027CF5C8004CF89A1 ] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll15:38:50.0970 1128 C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll - ok15:38:50.0973 1128 [ E0FF893763BA82BAABB869A351F0C455 ] C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll15:38:50.0973 1128 C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll - ok15:38:50.0977 1128 [ 05C4A7136F3012BB47107333B5D351D3 ] C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll15:38:50.0977 1128 C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll - ok15:38:50.0981 1128 [ B55019778B8BA4C91F47BBDA3F2CEFE6 ] C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll15:38:50.0981 1128 C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll - ok15:38:50.0985 1128 [ 1C8124B6A03A620EB0CBCA615666D2AE ] C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll15:38:50.0985 1128 C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll - ok15:38:50.0988 1128 [ D4BD9F86123C87ECA570418B69326F99 ] C:\Windows\SysWOW64\npDeployJava1.dll15:38:50.0988 1128 C:\Windows\SysWOW64\npDeployJava1.dll - ok15:38:50.0992 1128 [ 8006FC6A9A7C3168EF15DBA842C3AFC5 ] C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll15:38:50.0992 1128 C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll - ok15:38:50.0996 1128 [ 20308CF0675AD7CE5AAA6712DB823216 ] C:\Program Files (x86)\Windows Defender\MpClient.dll15:38:50.0996 1128 C:\Program Files (x86)\Windows Defender\MpClient.dll - ok15:38:50.0999 1128 [ 79E485E1361DA3CBE01FF760867F1D26 ] C:\Program Files (x86)\Windows Defender\MpOAV.dll15:38:50.0999 1128 C:\Program Files (x86)\Windows Defender\MpOAV.dll - ok15:38:51.0003 1128 [ 178A34E5554DCE485E1262DDF027960C ] C:\Users\Son\Downloads\tdsskiller (1).exe15:38:51.0003 1128 C:\Users\Son\Downloads\tdsskiller (1).exe - ok15:38:51.0006 1128 [ A018C8A668A4CC53EFF1070F84061800 ] C:\Windows\System32\consent.exe15:38:51.0006 1128 C:\Windows\System32\consent.exe - ok15:38:51.0010 1128 [ A0EC5976E86CEED540992CD634D3BCEE ] C:\Windows\System32\en-US\consent.exe.mui15:38:51.0010 1128 C:\Windows\System32\en-US\consent.exe.mui - ok15:38:51.0014 1128 [ C54E20766246F1033B38ABDFF8DE8B21 ] C:\Windows\SysWOW64\input.dll15:38:51.0014 1128 C:\Windows\SysWOW64\input.dll - ok15:38:51.0017 1128 [ 2A39583FE2AF77EBBC1DC34BE1F8299E ] C:\Windows\SysWOW64\en-US\input.dll.mui15:38:51.0017 1128 C:\Windows\SysWOW64\en-US\input.dll.mui - ok15:38:51.0021 1128 [ 83D6A4750D3A08EEF90FE4DF643F390C ] C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui15:38:51.0021 1128 C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui - ok15:38:51.0025 1128 [ D629F73E88B2DA7F5BDA2C06466DCCC4 ] C:\Windows\IME\SPTIP.DLL15:38:51.0025 1128 C:\Windows\IME\SPTIP.DLL - ok15:38:51.0028 1128 [ CE3602BA373CA549239AFC74B04A21DF ] C:\Windows\IME\en-US\SpTip.dll.mui15:38:51.0028 1128 C:\Windows\IME\en-US\SpTip.dll.mui - ok15:38:51.0032 1128 [ 3EE10E01F87C77690AAE39DA7B8FDC2D ] C:\Program Files\Windows NT\TableTextService\TableTextService.dll15:38:51.0032 1128 C:\Program Files\Windows NT\TableTextService\TableTextService.dll - ok15:38:51.0036 1128 [ 0DB03249DE5A282CC400AEC1D421CA9D ] C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui15:38:51.0036 1128 C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui - ok15:38:51.0039 1128 [ 58D05E0CD1D987A19059842B59F02358 ] C:\Windows\SysWOW64\en-US\msutb.dll.mui15:38:51.0039 1128 C:\Windows\SysWOW64\en-US\msutb.dll.mui - ok15:38:51.0043 1128 [ 2DDBE921502D32E87F181F65AFE77AF3 ] C:\Windows\SysWOW64\en-US\winmm.dll.mui15:38:51.0043 1128 C:\Windows\SysWOW64\en-US\winmm.dll.mui - ok15:38:51.0047 1128 [ EFE3A0EAFFE4A11C8EEEEB84D5A79936 ] C:\Windows\SysWOW64\en-US\authui.dll.mui15:38:51.0047 1128 C:\Windows\SysWOW64\en-US\authui.dll.mui - ok15:38:51.0051 1128 [ CD5A94572650CB80E05D52F9617A0D1B ] C:\Windows\SysWOW64\en-US\wdmaud.drv.mui15:38:51.0051 1128 C:\Windows\SysWOW64\en-US\wdmaud.drv.mui - ok15:38:51.0054 1128 [ 5704351536FDEACEBC4291D570826F17 ] C:\Windows\SysWOW64\en-US\imageres.dll.mui15:38:51.0054 1128 C:\Windows\SysWOW64\en-US\imageres.dll.mui - ok15:38:51.0058 1128 [ E0AD091B785EB541370660B0C3A4DCC4 ] C:\Windows\SysWOW64\en-US\MMDevAPI.dll.mui15:38:51.0058 1128 C:\Windows\SysWOW64\en-US\MMDevAPI.dll.mui - ok15:38:51.0062 1128 [ 339DFA98DDDA7DDF735CE21C82E6F1DD ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe15:38:51.0062 1128 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe - ok15:38:51.0065 1128 [ F146E2BA475893DD77B2370DC1211FC6 ] C:\Windows\System32\drivers\88248148.sys15:38:51.0065 1128 C:\Windows\System32\drivers\88248148.sys - ok15:38:51.0069 1128 [ 6EC594AB7EFA45EACDE65FD4040F53D9 ] C:\Windows\SysWOW64\riched20.dll15:38:51.0069 1128 C:\Windows\SysWOW64\riched20.dll - ok15:38:51.0072 1128 [ F175E53C7C3B25A9029A131FB578B155 ] C:\Windows\SysWOW64\wscinterop.dll15:38:51.0072 1128 C:\Windows\SysWOW64\wscinterop.dll - ok15:38:51.0076 1128 [ 81252AA3B13743020BCF2089A5A0D911 ] C:\Windows\System32\wscinterop.dll15:38:51.0076 1128 C:\Windows\System32\wscinterop.dll - ok15:38:51.0080 1128 [ 7FD5532C142DB6C9CC47AA4DCF71FDEC ] C:\Windows\SysWOW64\wscui.cpl15:38:51.0080 1128 C:\Windows\SysWOW64\wscui.cpl - ok15:38:51.0083 1128 [ DF50DAE4C547285E4997A0C61063B632 ] C:\Windows\System32\wscui.cpl15:38:51.0083 1128 C:\Windows\System32\wscui.cpl - ok15:38:51.0087 1128 [ C3626E674990EF003B6C94807E82B501 ] C:\Windows\System32\werconcpl.dll15:38:51.0087 1128 C:\Windows\System32\werconcpl.dll - ok15:38:51.0090 1128 [ 7E591867422DC788B9E5BD337A669A08 ] C:\Windows\System32\wercplsupport.dll15:38:51.0090 1128 C:\Windows\System32\wercplsupport.dll - ok15:38:51.0094 1128 [ 57CE9D8350B1DD76EEC596C423C3C0BC ] C:\Windows\SysWOW64\hcproviders.dll15:38:51.0094 1128 C:\Windows\SysWOW64\hcproviders.dll - ok15:38:51.0097 1128 [ 809AE7D4ACE06BBCF621E5C504BF6FC8 ] C:\Windows\System32\hcproviders.dll15:38:51.0097 1128 C:\Windows\System32\hcproviders.dll - ok15:38:51.0100 1128 ============================================================15:38:51.0100 1128 Scan finished15:38:51.0100 1128 ============================================================15:38:51.0107 3428 Detected object count: 015:38:51.0107 3428 Actual detected object count: 0 Link to post Share on other sites More sharing options...
Recommended Posts