Trojan banker found but deleted should i be worried ?

Exeagle · August 21, 2013

Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.08.19.06

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16660

Joe :: JOE-PC [administrator]

Protection: Enabled

8/20/2013 11:44:03 PM

mbam-log-2013-08-20 (23-44-03).txt

Scan type: Full scan (C:\|E:\|P:\|)

Scan options disabled: P2P

Objects scanned: 733680

Time elapsed: 1 hour(s), 49 minute(s), 12 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 2

HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Quarantined and deleted successfully.

HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> Quarantined and deleted successfully.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 1

HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bad: (http://feed.snap.do/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=AU&userid=62afa24a-eeb7-40d2-93ab-c722bca1ea66&searchtype=ds&q={searchTerms}&installDate=27/03/2013) Good: (http://www.google.com) -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 5

C:\Program Files (x86)\Origin Games\Command and Conquer Generals Zero Hour\Command and Conquer Generals Zero Hour\ROTR.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Origin Games\Command and Conquer Generals Zero Hour\Command and Conquer Generals Zero Hour\ROTR_Quick.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Origin Games\Command and Conquer Generals Zero Hour\Command and Conquer Generals Zero Hour\ROTR_QW.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Origin Games\Command and Conquer Generals Zero Hour\Command and Conquer Generals Zero Hour\ROTR_Win.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\Program Files (x86)\Origin Games\Command and Conquer Generals Zero Hour\Command and Conquer Generals Zero Hour\WorldBuilder_ROTR.exe (Trojan.Banker) -> Quarantined and deleted successfully.

(end)

I keep seeing this bad pup optional tho in recent scan's it keeps showing up

but this morning i woke up to find out i had trojan.banker virus

I use malwarebytes. pro

avast free

search and destroy

cc cleaner

malwarebytes run's every 12 hour's i also do scan's on avast and search and destory scann's all the time i have no idea how i ended up getting these's viruses

again should i be worried as i these's viruses keep showing up ?

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 3/7/2013 1:43:24 PM

System Uptime: 8/21/2013 11:13:51 AM (0 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | P8Z77-V LK

Processor: Intel® Core i5-3570K CPU @ 3.40GHz | LGA1155 | 3401/103mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 931 GiB total, 215.544 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 466 GiB total, 319.148 GiB free.

F: is CDROM ()

G: is CDROM ()

P: is FIXED (NTFS) - 931 GiB total, 215.544 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: avast! Firewall NDIS Filter Miniport

Device ID: ROOT\SW_ASWNDISMP\0001

Manufacturer: ALWIL Software

Name: avast! Firewall NDIS Filter Miniport

PNP Device ID: ROOT\SW_ASWNDISMP\0001

Service: aswNdis

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: avast! Firewall NDIS Filter Miniport

Device ID: ROOT\SW_ASWNDISMP\0000

Manufacturer: ALWIL Software

Name: avast! Firewall NDIS Filter Miniport

PNP Device ID: ROOT\SW_ASWNDISMP\0000

Service: aswNdis

.

==== System Restore Points ===================

.

RP268: 8/19/2013 5:15:19 PM - Device Driver Package Install: NT Kernel Resources Network Service

RP269: 8/19/2013 5:15:48 PM - C

RP270: 8/20/2013 1:34:45 PM - Restore Operation

RP271: 8/21/2013 3:53:09 AM - Windows Update

RP272: 8/21/2013 11:16:29 AM - Device Driver Package Install: NT Kernel Resources Network Service

.

==== Installed Programs ======================

.

3D Ripper DX v1.8.2

3ds max 7

Addon Sync 2009

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.03)

Aeria Ignite

Age of Wushu

AI Suite II

Akamai NetSession Interface

APB Reloaded

Apple Application Support

Apple Software Update

ARMA 2 Operation Arrowhead Uninstall

Arma 3 Alpha

ARMA II

ArmA II Launcher

Asmedia ASM104x USB 3.0 Host Controller Driver

Assassin's Creed® III v1.04

Audacity 2.0.3

Autodesk 3ds Max 2010 Tutorials Files

avast! Free Antivirus

Battlefield 2

Battlefield 3™

Battlelog Web Plugins

Battlestations: Pacific

BattlEye for OA Uninstall

BI's Tools drive Uninstall

BinMake Uninstall

BinPBO Personal Edition Uninstall

BioShock Infinite

BitRaider Web Client

BitTorrent

Blacklight: Retribution

CCleaner

Cheat Engine 6.2

Citadels

Command & Conquer™ The Ultimate Collection Additional Content

Command & Conquer™: Generals and Zero Hour

CPUID CPU-Z 1.65.0

D3DX10

DAEMON Tools Pro

Dark Souls: Prepare to Die Edition

Dawn of Fantasy: Kingdom Wars

DC Universe Online

DCS World

DCS: Black Shark

Dead Island

Dead Island Riptide © Deep Silver version 1

Defiance

DefianceRuntimes

Desura

Desura: Mortal Online

Divinity 2 Developers Cut version 1.00

Don't Starve

Dota 2

Download Accelerator Plus (DAP)

Dragon Nest

Dragon UnPACKer 5

Dragons Prophet Beta

Dropbox

End of Nations Alpha

ESN Sonar

Facebook Video Calling 1.2.0.287

Falcon BMS 4.32

Fallen Enchantress Legendary Heroes © Stardock Entertainment version 1

Farming Simulator 2013

ffdshow v1.1.3572 [2010-09-13]

FINAL FANTASY XIV - A Realm Reborn

Firefall

Fraps v3.5.99 Build 15618

FSM Editor Personal Edition Uninstall

GIGABYTE OC_GURU II

Google Chrome

Google SketchUp Pro 8

Google Update Helper

Grand Theft Auto IV

GTA IV Vehicle Mod Installer v1.3

Guild Wars 2

Heroes & Generals

ImgBurn

Infestation Survivor Stories version 1.0

Intel® Control Center

Intel® Management Engine Components

Intel® Rapid Storage Technology

Intel® USB 3.0 eXtensible Host Controller Driver

Intel® Trusted Connect Service Client

Intel® Watchdog Timer Driver (Intel® WDT)

Java 7 Update 25

Java Auto Updater

Java SE Development Kit 7 Update 17 (64-bit)

Java 7

Junk Mail filter update

Killing Floor

League of Legends

Lock On 1.1

Lock On: Modern Air Combat

Logitech Gaming Software 5.10

Malwarebytes Anti-Malware version 1.75.0.1300

Marvel Heroes

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106

Microsoft XNA Framework Redistributable 4.0 Refresh

MiniTool Partition Wizard Home Edition 7.8

Mirror's Edge

Mount & Blade: Warband

Movie Maker

MSI Afterburner 2.3.1

MSI Kombustor 2.5.0

MSVCRT

MSVCRT Redists

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

Mu_Rebirth

Natural Selection 2

Neverwinter

Nexus Mod Manager

Notepad++

NVIDIA 3D Vision Controller Driver 320.49

NVIDIA 3D Vision Driver 320.49

NVIDIA Control Panel 320.49

NVIDIA GeForce Experience 1.6

NVIDIA Graphics Driver 320.49

NVIDIA HD Audio Driver 1.3.24.2

NVIDIA Install Application

NVIDIA Photoshop Plug-ins 64 bit

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 7.2.17

NVIDIA Update Components

NVIDIA Virtual Audio 1.2.1

OpenAL

Origin

Overwolf

Oxygen 2 Personal Edition Uninstall

Pando Media Booster

Photo Common

Photo Gallery

PlanetSide 2

Police Simulator 2

Project Reality: BF2

PunkBuster Services

QuickTime

Rapture3D 2.3.26 Game

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

RESCUE 2013

RollerCoaster Tycoon 3 Platinum

ROTR ECA Beta 1.8

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

SHIELD Streaming

Skype Click to Call

Skype™ 6.6

Sleeping Dogs™

Sniper Elite: Nazi Zombie Army

Sound Tools Uninstall

Spybot - Search & Destroy

SpywareBlaster 5.0

Star Wars: The Old Republic

StarForge Alpha

Steam

TARS

TeamSpeak 3 Client

TeamViewer 8

TechPowerUp GPU-Z

TERA

Terraria

TexView 2 Uninstall

The Elder Scrolls V Skyrim Dragonborn © Bethesda Softworks version 1

The Sims™ 3

The Sims™ 3 High-End Loft Stuff

Torchlight II

Tropico 4

ubi.com

Ultra Mobile 3GP Video Converter 6.0.0202

Uninstall TrianglePlayer

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2836939)

Uplay

Vegas Pro 11.0 (64-bit)

Vegas Pro 12.0 (64-bit)

Vindictus

Visitor 3 Uninstall

Visual C++ 64-bit Redistributables

Visual C++ Redistributables

Visual Studio 2010 x64 Redistributables

VLC media player 2.0.7

War Thunder Launcher 1.0.1.236

Warframe

Wargame: AirLand Battle

WEBZEN Browser Extension

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR 4.20 (64-bit)

Xiph.Org Open Codecs 0.85.17777

YTD Video Downloader 4.0

.

==== Event Viewer Messages From Past Week ========

.

8/21/2013 11:16:36 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.

8/21/2013 11:16:36 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

8/21/2013 11:16:36 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

8/21/2013 11:16:16 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

8/21/2013 11:16:16 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.

8/20/2013 1:39:36 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.

8/20/2013 1:39:36 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Scanner Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

8/20/2013 1:34:37 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: 490@01010004

8/19/2013 8:41:56 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MILLYANN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{BC7188E4-14A5-4610-B6A0-26B415578E40}. The master browser is stopping or an election is being forced.

8/19/2013 11:45:18 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

8/19/2013 11:45:18 AM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

8/17/2013 1:24:09 AM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.

8/17/2013 1:24:05 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the nvsvc service.

8/17/2013 1:14:10 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

8/16/2013 4:56:25 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16660 BrowserJavaVersion: 10.25.2

Run by Joe at 11:46:18 on 2013-08-21

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16338.12372 [GMT 10:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe

C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\PowerControlHelp.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

C:\Program Files (x86)\ASUS\AI Suite II\USB 3.0 Boost\U3BoostSvr64.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files\Logitech\Gaming Software\LWEMon.exe

C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\DAP\DAP.exe

C:\Windows\system32\rundll32.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Users\Joe\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\notepad.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uWindow Title = Internet Explorer, enhanced for Bing and MSN

uProxyOverride = <local>

uSearchAssistant = about:blank

mWinlogon: Userinit = userinit.exe,

BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

uRun: [mapdisk] "C:\Users\Joe\Documents\ArmAWork\mapdisk.bat"

uRun: [DownloadAccelerator] "C:\Program Files (x86)\DAP\DAP.EXE" /STARTUP

uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [ASUS AiChargerPlus Execute] C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

StartupFolder: C:\Users\Joe\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Joe\AppData\Roaming\Dropbox\bin\Dropbox.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm

IE: &Verify with DAP - C:\Program Files (x86)\DAP\dapverify.htm

IE: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 198.142.235.14 211.29.132.12 198.142.0.51

TCP: Interfaces\{BC7188E4-14A5-4610-B6A0-26B415578E40} : DHCPNameServer = 198.142.235.14 211.29.132.12 198.142.0.51

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie.dll

Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie.dll

Notify: SDWinLogon - SDWinLogon.dll

AppInit_DLLs= C:\PROGRA~2\NVIDIA~1\NVSTRE~1\rxinput.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-Run: [start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui

x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

.

INFO: x64-HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie64.dll

x64-Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie64.dll

x64-SSODL: WebCheck - <orphaned>

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-4-4 65336]

R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-4-4 189936]

R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2013-3-7 16152]

R1 aswKbd;aswKbd;C:\Windows\System32\drivers\aswKbd.sys [2013-4-4 22600]

R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-4-4 1030952]

R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-4-4 378944]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-7-23 283200]

R1 ndisrd;WinpkFilter LightWeight Filter;C:\Windows\System32\drivers\ndisrd.sys [2013-7-2 32400]

R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [2013-7-2 920736]

R2 asHmComSvc;ASUS HM Com Service;C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [2013-7-2 951936]

R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [2013-7-2 149120]

R2 AsusFanControlService;AsusFanControlService;C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.10\AsusFanControlService.exe [2013-7-2 1475744]

R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-4-4 33400]

R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-4-4 80816]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-5-23 46808]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-3-7 13592]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-3-7 166720]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-4-5 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-4-5 701512]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-7-31 14984480]

R2 SBUpd;SpeedBit Update;C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe [2013-2-27 1097848]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2013-8-17 1817560]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2013-8-17 1033688]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2013-8-17 171928]

R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-7-12 3289472]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-6-21 413472]

R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-3-16 3560288]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-3-7 365376]

R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2012-2-21 130536]

R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2012-2-21 396776]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-7-2 160768]

R3 ICCWDT;Intel® Watchdog Timer Driver (Intel® WDT);C:\Windows\System32\drivers\ICCWDT.sys [2013-7-2 26136]

R3 iusb3hub;Intel® USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2013-3-7 356120]

R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2013-3-7 787736]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-5 25928]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2013-7-31 39712]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-3-7 677480]

R3 SBUpdd;SpeedBit UpdateD;C:\Program Files\Common Files\SpeedBit\SBUpdate\sbw.sys [2013-2-27 40856]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-21 162408]

S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328]

S3 BEService;BattlEye Service;C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2013-3-23 49152]

S3 BRDriver64;BRDriver64;C:\ProgramData\bitraider\BRDriver64.sys [2013-6-6 74024]

S3 BRSptSvc;BitRaider Mini-Support Service;C:\ProgramData\bitraider\BRSptSvc.exe [2013-4-5 914200]

S3 Desura Install Service;Desura Install Service;C:\Program Files (x86)\Common Files\Desura\desura_service.exe [2013-6-19 131912]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-3-9 57856]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2013-2-5 1512448]

S3 GPCIDrv;GPCIDrv;C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [2010-2-4 14376]

S3 OverwolfUpdaterService;Overwolf Updater Service;C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2013-4-16 18360]

S3 pwdrvio;pwdrvio;C:\Windows\System32\pwdrvio.sys [2013-5-31 19032]

S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2013-5-31 9584]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-3-30 19456]

S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]

S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]

S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]

S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-3-30 57856]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-3-7 1255736]

.

=============== Created Last 30 ================

.

2013-08-20 17:53:40 9460976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{024B59A2-D939-4386-8DAD-FB4F9E5B5B8E}\mpengine.dll

2013-08-16 15:39:20 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2013-08-16 15:39:02 17272 ----a-w- C:\Windows\System32\sdnclean64.exe

2013-08-16 15:38:58 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2

2013-08-16 07:25:54 447752 ----a-w- C:\Windows\SysWow64\vp6vfw.dll

2013-08-16 00:40:34 -------- d-----w- C:\Program Files (x86)\SquareEnix

2013-08-14 19:04:59 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-08-14 00:51:49 224256 ----a-w- C:\Windows\System32\wintrust.dll

2013-08-09 01:33:15 -------- d-----w- C:\Users\Joe\AppData\Local\PAYDAY 2

2013-08-07 00:53:56 -------- d-----w- C:\Program Files (x86)\Police Simulator 2

2013-08-06 23:03:00 -------- d-----w- C:\Users\Joe\AppData\Roaming\Project Reality

2013-08-06 22:35:32 -------- d-----w- C:\Users\Joe\AppData\Local\Project Reality

2013-08-06 02:14:45 -------- d-----w- C:\Users\Joe\AppData\Local\Mozilla

2013-08-06 02:06:54 -------- d-----w- C:\Users\Joe\AppData\Local\Vidalia

2013-08-05 06:30:10 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-08-05 04:55:08 -------- d-----w- C:\ProgramData\NexonUS

2013-08-03 23:40:04 -------- d-----w- C:\Program Files (x86)\PokeGen

2013-08-03 23:40:01 -------- d-----w- C:\Users\Joe\AppData\Local\WpfApplication1

2013-08-03 02:29:57 -------- d-----w- C:\Users\Joe\AppData\Local\dof

2013-07-31 06:01:57 -------- d-----w- C:\Users\Joe\AppData\Roaming\Citadels

2013-07-31 05:16:07 -------- d-----w- C:\NvidiaLogging

2013-07-31 05:15:15 39712 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys

2013-07-31 05:15:14 29984 ----a-w- C:\Windows\System32\nvaudcap64v.dll

2013-07-31 05:15:14 28448 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll

2013-07-31 05:10:59 -------- d-----w- C:\Program Files (x86)\Citadels

2013-07-27 02:55:38 -------- d-----w- C:\Users\Joe\AppData\Roaming\LolClient

2013-07-27 02:28:45 -------- d-----w- C:\Riot Games

2013-07-27 02:28:26 -------- d-----w- C:\Users\Joe\AppData\Local\PMB Files

2013-07-27 02:28:24 -------- d-----w- C:\ProgramData\PMB Files

2013-07-27 02:28:22 -------- d-----w- C:\Program Files (x86)\Pando Networks

2013-07-27 02:28:08 -------- d-----w- C:\Users\Joe\AppData\Roaming\Riot Games

2013-07-25 06:48:05 -------- d-----w- C:\Windows\en

2013-07-25 02:10:41 -------- d-----w- C:\Users\Joe\jagexcache

2013-07-23 04:10:32 -------- d-----w- C:\Program Files (x86)\Microsoft XNA

2013-07-23 04:07:38 -------- d-----w- C:\Users\Joe\AppData\Local\SKIDROW

2013-07-23 04:05:54 -------- d-----w- C:\Program Files (x86)\Abbey Games

2013-07-23 04:02:15 283200 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys

2013-07-23 04:02:11 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Pro

2013-07-22 07:50:56 -------- d-----w- C:\Users\Joe\Temp

.

==================== Find3M ====================

.

2013-08-06 22:59:47 281152 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2013-08-06 22:59:47 281152 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2013-08-06 11:43:23 189248 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2013-08-06 11:43:14 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2013-08-05 06:30:06 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-08-05 06:30:06 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-07-26 05:13:37 2241024 ----a-w- C:\Windows\System32\wininet.dll

2013-07-26 05:12:08 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-07-26 05:12:04 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-07-26 05:12:03 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-07-26 03:35:08 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-07-26 03:13:24 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-07-26 03:12:04 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-07-26 03:12:00 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-07-26 03:12:00 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-07-26 02:49:14 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-07-26 01:59:38 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL

2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL

2013-07-25 02:52:50 840264 ----a-w- C:\Windows\SysWow64\pbsvc.exe

2013-07-19 01:58:42 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-07-19 01:41:01 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll

2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll

2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll

2013-07-09 05:46:20 184320 ----a-w- C:\Windows\System32\cryptsvc.dll

2013-07-09 05:46:20 1472512 ----a-w- C:\Windows\System32\crypt32.dll

2013-07-09 05:46:20 139776 ----a-w- C:\Windows\System32\cryptnet.dll

2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll

2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll

2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2013-07-09 04:52:10 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll

2013-07-09 04:46:31 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll

2013-07-09 04:46:31 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll

2013-07-09 04:46:31 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll

2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe

2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-07-02 07:03:20 4696672 ----a-w- C:\Windows\PE_Rom.dll

2013-06-27 21:17:43 189936 ----a-w- C:\Windows\System32\drivers\aswVmm.sys

2013-06-27 21:17:43 1030952 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

2013-06-25 09:57:59 16896 ----a-w- C:\Windows\AsTaskSched.dll

2013-06-21 10:23:16 6496544 ----a-w- C:\Windows\System32\nvcpl.dll

2013-06-21 10:23:16 3514656 ----a-w- C:\Windows\System32\nvsvc64.dll

2013-06-21 10:23:11 884512 ----a-w- C:\Windows\System32\nvvsvc.exe

2013-06-21 10:23:10 63776 ----a-w- C:\Windows\System32\nvshext.dll

2013-06-21 10:23:10 237856 ----a-w- C:\Windows\System32\nvmctray.dll

2013-06-20 19:16:02 566048 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2013-06-20 04:17:49 3253909 ----a-w- C:\Windows\System32\nvcoproc.bin

2013-06-15 04:32:16 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys

2013-06-12 16:33:08 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-12 16:33:08 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys

2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll

2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll

2013-05-23 11:19:14 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll

.

============= FINISH: 11:46:41.75 ===============

AdvancedSetup · August 24, 2013

Hello and :welcome:

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Before we proceed further, please read all of the following instructions carefully.

If there is anything that you do not understand kindly ask before proceeding.

If needed please print out these instructions.

Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
- Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive
Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you.
The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue.
You can check here if you're not sure if your computer is 32-bit or 64-bit
Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners.
When we are done, I'll give you instructions on how to cleanup all the tools and logs
Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.
Your topic will be closed if you haven't replied within 3 days
(If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes

so that your normal security software can then run and clean your computer of infections.

When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies

that stop us from using certain tools. When finished it will display a log file that shows the processes that were

terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot

your computer as any malware processes that are configured to start automatically will just be started again.

Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

STEP 01

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
Make sure that at least the first two check boxes are selected.
Click on OK
Then click on YES to create the folder.
Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02

Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

Exeagle · August 25, 2013

Hello and
P2P/Piracy Warning:

Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.
Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive
Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you.
The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue.
You can check here if you're not sure if your computer is 32-bit or 64-bit
Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners.
When we are done, I'll give you instructions on how to cleanup all the tools and logs
Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.
Your topic will be closed if you haven't replied within 3 days
(If I have not responded within 24 hours, please send me a Private Message as a reminder)
STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.
As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.
Please download Rkill by Grinler from one of the links below and save it to your desktop.
Link 1
Link 2
On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.
STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.
Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
Note: the default location is C:\Windows\ERDNT which is acceptable.
Make sure that at least the first two check boxes are selected.
Click on OK
Then click on YES to create the folder.
Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe
STEP 02
Please download RogueKiller and save it to your desktop.
You can check here if you're not sure if your computer is 32-bit or 64-bit
RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

Ok removed all Peer 2 Peer software i hope, I also turned on the show hidden file's and everything you said to do

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 3/7/2013 1:43:24 PM

System Uptime: 8/25/2013 11:05:52 AM (0 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | P8Z77-V LK

Processor: Intel® Core i5-3570K CPU @ 3.40GHz | LGA1155 | 3401/103mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 931 GiB total, 130.948 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 466 GiB total, 318.587 GiB free.

F: is CDROM (CDFS)

G: is CDROM ()

P: is FIXED (NTFS) - 931 GiB total, 130.948 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: avast! Firewall NDIS Filter Miniport

Device ID: ROOT\SW_ASWNDISMP\0000

Manufacturer: ALWIL Software

Name: avast! Firewall NDIS Filter Miniport

PNP Device ID: ROOT\SW_ASWNDISMP\0000

Service: aswNdis

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: avast! Firewall NDIS Filter Miniport

Device ID: ROOT\SW_ASWNDISMP\0001

Manufacturer: ALWIL Software

Name: avast! Firewall NDIS Filter Miniport

PNP Device ID: ROOT\SW_ASWNDISMP\0001

Service: aswNdis

.

==== System Restore Points ===================

.

RP285: 8/24/2013 2:52:17 AM - Scheduled Checkpoint

RP286: 8/24/2013 8:19:53 PM - Installed DirectX

RP287: 8/24/2013 8:22:25 PM - Installed DirectX

.

==== Installed Programs ======================

.

3D Ripper DX v1.8.2

3ds max 7

Addon Sync 2009

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.03)

Aeria Ignite

Age of Wushu

AI Suite II

Akamai NetSession Interface

APB Reloaded

Apple Application Support

Apple Software Update

ARMA 2 Operation Arrowhead Uninstall

Arma 3 Alpha

ARMA II

ArmA II Launcher

Asmedia ASM104x USB 3.0 Host Controller Driver

Assassin's Creed® III v1.04

Audacity 2.0.3

Autodesk 3ds Max 2010 Tutorials Files

avast! Free Antivirus

Battlefield 2

Battlefield 3™

Battlelog Web Plugins

Battlestations: Pacific

BattlEye for OA Uninstall

BI's Tools drive Uninstall

BinMake Uninstall

BinPBO Personal Edition Uninstall

BioShock Infinite

Blacklight: Retribution

CCleaner

Citadels

Command & Conquer™ 3 Tiberium Wars and Kane's Wrath

Command & Conquer™ The Ultimate Collection Additional Content

Command & Conquer™: Generals and Zero Hour

CPUID CPU-Z 1.65.0

D3DX10

DAEMON Tools Pro

Dark Souls: Prepare to Die Edition

Dawn of Fantasy: Kingdom Wars

DC Universe Online

DCS World

DCS: Black Shark

Dead Island

Dead Island Riptide © Deep Silver version 1

Defiance

DefianceRuntimes

Desura

Desura: Mortal Online

Divinity 2 Developers Cut version 1.00

Don't Starve

Dota 2

Download Accelerator Plus (DAP)

Dragon Nest

Dragon UnPACKer 5

Dragons Prophet Beta

Dropbox

Eden Eternal

End of Nations Alpha

ESN Sonar

Facebook Video Calling 1.2.0.287

Falcon BMS 4.32

Fallen Enchantress Legendary Heroes © Stardock Entertainment version 1

Farming Simulator 2013

ffdshow v1.1.3572 [2010-09-13]

FINAL FANTASY XIV - A Realm Reborn

Firefall

Fraps v3.5.99 Build 15618

FSM Editor Personal Edition Uninstall

GIGABYTE OC_GURU II

Google Chrome

Google SketchUp Pro 8

Google Update Helper

Grand Theft Auto IV

GTA IV Vehicle Mod Installer v1.3

Guild Wars 2

Heroes & Generals

ImgBurn

Infestation Survivor Stories version 1.0

Intel® Control Center

Intel® Management Engine Components

Intel® Rapid Storage Technology

Intel® USB 3.0 eXtensible Host Controller Driver

Intel® Trusted Connect Service Client

Intel® Watchdog Timer Driver (Intel® WDT)

Java 7 Update 25

Java Auto Updater

Java SE Development Kit 7 Update 17 (64-bit)

Java 7

Junk Mail filter update

Killing Floor

League of Legends

Lock On 1.1

Lock On: Modern Air Combat

Logitech Gaming Software 5.10

Malwarebytes Anti-Malware version 1.75.0.1300

Marvel Heroes

Marvel Heroes Game

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106

Microsoft XNA Framework Redistributable 4.0 Refresh

MiniTool Partition Wizard Home Edition 7.8

Mirror's Edge

Mount & Blade: Warband

Movie Maker

MSI Afterburner 2.3.1

MSI Kombustor 2.5.0

MSVCRT

MSVCRT Redists

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

Mu_Rebirth

Natural Selection 2

Neverwinter

Nexus Mod Manager

Notepad++

NVIDIA 3D Vision Controller Driver 326.80

NVIDIA 3D Vision Driver 326.80

NVIDIA Control Panel 326.80

NVIDIA GeForce Experience 1.6

NVIDIA Graphics Driver 326.80

NVIDIA HD Audio Driver 1.3.26.4

NVIDIA Install Application

NVIDIA Photoshop Plug-ins 64 bit

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 7.2.17

NVIDIA Update Components

NVIDIA Virtual Audio 1.2.2