Possible Infection - DDS.txt & ATTACH.txt Results

JeromeAC · December 7, 2013

Computer is less than 60 days old
The results of the dds tool appear below. A couple of notes that may help:
Drive H is an old, external 500GB WD hard drive to which I can no longer write; I can copy files from it but I can no longer back-up to it.
Although Skype is installed on my machine, it was not running at the time I ran the dds tool
Thanks for your assistance

.ATTACH.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 12/28/2010 10:51:17

System Uptime: 12/7/2013 05:56:34 (4 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | Z87-PLUS

Processor: Intel® Core i7-4770K CPU @ 3.50GHz | SOCKET 1150 | 3501/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 209 GiB total, 143.5 GiB free.

E: is Removable

F: is Removable

G: is FIXED (NTFS) - 932 GiB total, 777.415 GiB free.

H: is FIXED (NTFS) - 466 GiB total, 70.955 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Intel® Ethernet Connection I217-V

Device ID: PCI\VEN_8086&DEV_153B&SUBSYS_859F1043&REV_04\3&11583659&0&C8

Manufacturer: Intel

Name: Intel® Ethernet Connection I217-V

PNP Device ID: PCI\VEN_8086&DEV_153B&SUBSYS_859F1043&REV_04\3&11583659&0&C8

Service: e1dexpress

.

==== System Restore Points ===================

.

RP62: 11/22/2013 08:55:49 - Windows Update

RP63: 11/26/2013 08:05:53 - Windows Update

RP64: 11/26/2013 18:38:54 - Removed ScorpionSaver

RP65: 11/26/2013 18:41:00 - Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

RP66: 11/27/2013 08:45:10 - Windows Update

RP67: 11/27/2013 22:38:47 - Removed ScorpionSaver Services

RP68: 11/27/2013 22:39:18 - Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

RP69: 11/28/2013 08:49:20 - Windows Update

RP70: 11/29/2013 18:09:34 - Installed PowerDirector

RP71: 11/29/2013 18:17:04 - Installed PowerDirector

RP72: 12/3/2013 14:32:03 - Windows Update

.

==== Installed Programs ======================

.

Adobe Reader XI (11.0.05)

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS PMP Lite

ASUS Xonar DX Audio Driver

Bitdefender Antivirus Plus

Bonjour

CameraHelperMsi

CANON iMAGE GATEWAY MyCamera Download Plugin

CANON iMAGE GATEWAY Task for ZoomBrowser EX

Canon MOV Decoder

Canon MOV Encoder

Canon Utilities Digital Photo Professional

Canon Utilities EOS Utility

Canon Utilities Picture Style Editor

Citrix Authentication Manager

Citrix Receiver

Citrix Receiver (HDX Flash Redirection)

Citrix Receiver Inside

Citrix Receiver Updater

Citrix Receiver(Aero)

Citrix Receiver(DV)

Citrix Receiver(USB)

CyberLink PowerDirector 12

CyberLink WaveEditor 2

D3DX10

DMUninstaller

erLT

FAHClient

GeForce Experience NvStream Client Components

Google Chrome

Google Update Helper

HD Writer AE 4.0

iCloud

Intel® Network Connections 18.7.28.0

iTunes

Logitech Webcam Software

LWS Facebook

LWS Gallery

LWS Help_main

LWS Launcher

LWS Motion Detection

LWS Pictures And Video

LWS Twitter

LWS Webcam Software

LWS WLM Plugin

LWS YouTube Plugin

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft SQL Server Compact 3.5 SP2 ENU

Microsoft SQL Server Compact 3.5 SP2 x64 ENU

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Movie Maker

MSVCRT

MSVCRT110

MSVCRT110_amd64

NVIDIA 3D Vision Controller Driver 331.65

NVIDIA Control Panel 331.65

NVIDIA GeForce Experience 1.7

NVIDIA Graphics Driver 331.65

NVIDIA HD Audio Driver 1.3.26.4

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.0725

NVIDIA ShadowPlay 9.3.16

NVIDIA Update 9.3.16

NVIDIA Virtual Audio 1.2.9

Online Plug-in

OpenAL

OpenOffice.org 3.1

PCIe Soft Data Fax SoftRing Modem with SmartCP

Photo Common

Photo Gallery

QuickTime

Realtek High Definition Audio Driver

Samsung Magician

ScorpionSaver

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)

Self-service Plug-in

SHIELD Streaming

Skype Click to Call

Skype™ 6.10

SmartSound Quicktracks 5

Tom Clancy's Splinter Cell® Blacklist™

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Uplay

VC_CRT_x64

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

.

==== Event Viewer Messages From Past Week ========

.

12/7/2013 05:56:57, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom

12/6/2013 07:53:57, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OneTouch4.

12/6/2013 07:50:38, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

12/6/2013 06:59:34, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume H:.

12/5/2013 19:22:46, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avc3 cdrom

12/5/2013 19:22:46, Error: Service Control Manager [7000] - The Bitdefender Desktop Update Service service failed to start due to the following error: The system cannot find the file specified.

12/5/2013 19:18:35, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004a (0x0000000077a4132a, 0x0000000000000002, 0x0000000000000000, 0xfffff880062f7b60). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 120513-7488-01.

12/3/2013 19:11:56, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\DR4.

.

==== End Of File ===========================

DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16428

Run by Valued Customer at 9:06:28 on 2013-12-07

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.16323.13131 [GMT -5:00]

.

AV: Bitdefender Antivirus *Enabled/Updated* {9B5F5313-CAF9-DD97-C460-E778420237B4}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Bitdefender Antispyware *Enabled/Updated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Bitdefender\Bitdefender\vsserv.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Windows\system\CMGxMon.exe

C:\Windows\system\HsMgr64.exe

C:\Program Files\Bitdefender\Bitdefender\bdagent.exe

C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe

C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe

C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe

C:\Program Files\ASUS Xonar DX Audio\Customapp\ASUSAUDIOCENTER.EXE

C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Citrix\ICA Client\redirector.exe

C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe

C:\Windows\system32\svchost.exe -k HsfXAudioService

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe

C:\Program Files (x86)\Citrix\Receiver\Receiver.exe

G:\Malwarebytes' Anti-Malware\mbamscheduler.exe

G:\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

G:\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\WUDFHost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mStart Page = about:blank

mWinlogon: Userinit = userinit.exe,

BHO: Bitdefender Wallet: {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie.dll

TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>

uRun: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

uRun: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe

uRun: [bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"

uRun: [bitdefender Wallet] "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard

uRun: [bitdefender Wallet Application Agent] "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [CitrixReceiver] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"

mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun: [Redirector] "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

dRun: [bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"

dRun: [bitdefender Wallet] "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard

dRun: [bitdefender Wallet Application Agent] "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"

StartupFolder: C:\Users\VALUED~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files (x86)\Logitech\Ereg\eReg.exe

StartupFolder: C:\Users\VALUED~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SAMSUN~1.LNK - C:\Program Files (x86)\Samsung\Samsung Magician\Samsung Magician.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HDWRIT~1.LNK - C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

TCP: NameServer = 192.168.1.1 71.242.0.12

TCP: Interfaces\{22B78663-DEFC-4B56-B974-6AC5E12D3859} : DHCPNameServer = 137.107.3.150 137.107.2.1

TCP: Interfaces\{25DC47D6-58D6-4418-AAA6-9AB3A97BD204} : DHCPNameServer = 192.168.1.1 71.242.0.12

TCP: Interfaces\{80C306FB-F5BD-411D-AF84-8ED9C0655D09} : DHCPNameServer = 137.107.3.150 137.107.2.1

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = about:blank

x64-BHO: Bitdefender Wallet : {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\pmbxie.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>

x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-Run: [Cmaudio8788] C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.cpl,CMICtrlWnd

x64-Run: [Cmaudio8788GX] C:\Windows\system\CmGxMon.exe Envoke

x64-Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe Envoke

x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-Run: [bdagent] "C:\Program Files\Bitdefender\Bitdefender\bdagent.exe"

x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 avc3;avc3;C:\Windows\System32\drivers\avc3.sys [2013-12-5 727592]

R0 gzflt;gzflt;C:\Windows\System32\drivers\gzflt.sys [2013-12-5 150256]

R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2013-10-22 20464]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2013-11-2 55952]

R1 bdfwfpf;bdfwfpf;C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2013-12-5 103504]

R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\System32\drivers\ctxusbm.sys [2013-9-24 97768]

R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [2013-11-4 936728]

R2 HsfXAudioService;HsfXAudioService;C:\Windows\System32\svchost.exe -k HsfXAudioService [2009-7-13 27136]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2013-7-30 204552]

R2 MBAMScheduler;MBAMScheduler;G:\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-11-16 418376]

R2 MBAMService;MBAMService;G:\Malwarebytes' Anti-Malware\mbamservice.exe [2013-11-16 701512]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-10-22 15122208]

R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-9 3275136]

R2 UPDATESRV;Bitdefender Desktop Update Service;C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [2013-12-5 67320]

R3 avchv;avchv Function Driver;C:\Windows\System32\drivers\avchv.sys [2013-11-1 261056]

R3 avckf;avckf;C:\Windows\System32\drivers\avckf.sys [2013-12-5 601360]

R3 cmudaxp;ASUS Xonar DX Audio Interface;C:\Windows\System32\drivers\cmudaxp.sys [2013-10-22 2725376]

R3 iusb3hub;Intel® USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2013-10-22 368112]

R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2013-10-22 786416]

R3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2012-9-21 351520]

R3 LVUVC64;Logitech HD Webcam C310(UVC);C:\Windows\System32\drivers\lvuvc64.sys [2012-9-21 4763680]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-11-16 25928]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2013-11-1 39200]

RUnknown Level Quality Watcher;Level Quality Watcher; [x]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-9-5 171680]

S3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-9-14 129000]

S3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-9-14 394216]

S3 BDSandBox;BDSandBox;C:\Windows\System32\drivers\bdsandbox.sys [2013-12-5 82824]

S3 CAXHWBS3;CAXHWBS3;C:\Windows\System32\drivers\CAXHWBS3.sys [2009-6-30 288256]

S3 e1dexpress;Intel® PRO/1000 PCI Express Network Connection Driver D;C:\Windows\System32\drivers\e1d62x64.sys [2013-9-30 494864]

S3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-10-9 171632]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2013-11-16 111616]

S3 PMUSB2G;PassMark USB2.0 Loopback plug driver;C:\Windows\System32\drivers\PMUSB.sys [2010-4-1 26624]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-1-17 19456]

S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-10-9 805088]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-11-15 56832]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-12-28 1255736]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]

.

=============== Created Last 30 ================

.

2013-12-06 10:38:17 10285968 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{84D89270-E399-4A02-8498-41DCD87AA2DE}\mpengine.dll

2013-12-06 01:21:02 76944 ----a-w- C:\Windows\System32\drivers\bdvedisk.sys

2013-12-06 00:51:26 417299 ----a-w- C:\ProgramData\1386291008.bdinstall.bin

2013-12-06 00:50:43 82824 ----a-w- C:\Windows\System32\drivers\bdsandbox.sys

2013-12-06 00:50:42 727592 ----a-w- C:\Windows\System32\drivers\avc3.sys

2013-12-06 00:50:42 601360 ----a-w- C:\Windows\System32\drivers\avckf.sys

2013-12-06 00:50:40 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\Bitdefender

2013-12-06 00:50:39 3271472 ---ha-w- C:\bdr-bz02

2013-12-06 00:50:16 389240 ----a-w- C:\Windows\System32\drivers\trufos.sys

2013-12-06 00:50:16 150256 ----a-w- C:\Windows\System32\drivers\gzflt.sys

2013-12-06 00:50:16 -------- d-----w- C:\ProgramData\Bitdefender

2013-12-06 00:49:36 241835 ----a-w- C:\ProgramData\1386290890.bdinstall.bin

2013-12-06 00:24:13 427088 ----a-w- C:\ProgramData\1386289399.bdinstall.bin

2013-12-06 00:22:18 62254 ----a-w- C:\ProgramData\1386289332.bdinstall.bin

2013-12-06 00:20:30 289079 ----a-w- C:\ProgramData\1386289201.bdinstall.bin

2013-12-06 00:20:29 -------- d-----w- C:\Program Files\Bitdefender

2013-12-06 00:17:07 3271472 ---ha-w- C:\bdr-bz01

2013-12-06 00:17:06 2247 ----a-w- C:\ProgramData\1386288990.5816.bin

2013-12-06 00:16:50 1451 ----a-w- C:\ProgramData\1386288990.2288.bin

2013-12-06 00:16:40 6706 ----a-w- C:\ProgramData\1386288990.2564.bin

2013-12-06 00:16:40 2726 ----a-w- C:\ProgramData\1386288990.5992.bin

2013-12-06 00:16:40 181021 ----a-w- C:\ProgramData\1386288990.2572.bin

2013-12-06 00:16:40 18047 ----a-w- C:\ProgramData\1386288990.5824.bin

2013-12-06 00:16:40 17891 ----a-w- C:\ProgramData\1386288990.5836.bin

2013-12-06 00:16:40 1090 ----a-w- C:\ProgramData\1386288990.5236.bin

2013-12-06 00:16:40 1090 ----a-w- C:\ProgramData\1386288990.3856.bin

2013-12-06 00:16:34 32994 ----a-w- C:\ProgramData\1386288990.6116.bin

2013-12-06 00:16:34 31186 ----a-w- C:\ProgramData\1386288990.2500.bin

2013-12-06 00:16:30 115738 ----a-w- C:\ProgramData\1386288990.4316.bin

2013-12-06 00:15:17 237451 ----a-w- C:\ProgramData\1386288829.bdinstall.bin

2013-12-06 00:13:40 -------- d-----w- C:\Program Files (x86)\Common Files\Bitdefender

2013-12-06 00:13:33 5710344 ----a-w- C:\Users\Valued Customer\bitdefender_antivirus_2014.exe

2013-11-29 23:15:17 1029080 ----a-w- C:\Users\Valued Customer\CyberLink_PowerDirector_Downloader.exe

2013-11-29 23:12:14 -------- d-----w- C:\ProgramData\SmartSound Software Inc

2013-11-29 23:12:14 -------- d-----w- C:\ProgramData\eSellerate

2013-11-29 23:12:14 -------- d-----w- C:\Program Files (x86)\SmartSound Software

2013-11-29 23:09:51 -------- d-----w- C:\ProgramData\install_clap

2013-11-28 13:28:05 -------- d-----w- C:\Users\Valued Customer\AppData\Local\Diagnostics

2013-11-28 03:32:15 439296 ----a-w- C:\Windows\System32\AdpeakProxy64.dll

2013-11-26 22:45:41 -------- d-----w- C:\Program Files (x86)\MyPC Backup

2013-11-26 22:45:35 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\Systweak

2013-11-26 22:45:34 20312 ----a-w- C:\Windows\System32\roboot64.exe

2013-11-26 22:44:59 -------- d-----w- C:\temp

2013-11-26 22:44:58 -------- d-----w- C:\Program Files\Level Quality Watcher

2013-11-21 10:48:04 74512 ----a-w- C:\Windows\SysWow64\bdsandboxuiskin32.dll

2013-11-20 13:45:09 84848 ----a-w- C:\Windows\System32\bdsandboxuiskin.dll

2013-11-20 13:45:08 74512 ----a-w- C:\Windows\System32\bdsandboxuiskin32.dll

2013-11-20 13:45:01 34384 ----a-w- C:\Windows\System32\bdsandboxuh.dll

2013-11-16 15:21:03 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\Malwarebytes

2013-11-16 15:20:51 -------- d-----w- C:\ProgramData\Malwarebytes

2013-11-16 15:20:50 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-11-16 14:33:51 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\ICAClient

2013-11-16 14:33:50 -------- d-----w- C:\ProgramData\Citrix

2013-11-16 14:33:45 -------- d-----w- C:\Users\Valued Customer\AppData\Local\Citrix

2013-11-16 14:33:45 -------- d-----w- C:\Program Files (x86)\Common Files\Citrix

2013-11-16 14:33:44 -------- d-----w- C:\Program Files (x86)\Citrix

2013-11-16 13:58:13 -------- d-----r- C:\Program Files (x86)\Skype

2013-11-16 12:17:04 100352 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HPZPPLHN.DLL

2013-11-13 13:19:13 1474048 ----a-w- C:\Windows\System32\crypt32.dll

2013-11-12 01:15:44 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-11-12 01:15:44 -------- d-----w- C:\Program Files\iTunes

2013-11-12 01:15:44 -------- d-----w- C:\Program Files\iPod

2013-11-12 01:15:44 -------- d-----w- C:\Program Files (x86)\iTunes

2013-11-09 13:41:25 -------- d-----w- C:\Windows\en

2013-11-09 13:41:14 -------- d-----w- C:\Windows\PCHEALTH

2013-11-09 13:40:43 89944 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\490cceb71cedd5103\DSETUP.dll

2013-11-09 13:40:43 537432 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\490cceb71cedd5103\DXSETUP.exe

2013-11-09 13:40:43 1801048 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\490cceb71cedd5103\dsetup32.dll

2013-11-09 13:40:42 94040 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\489fb36e1cedd5102\DSETUP.dll

2013-11-09 13:40:42 525656 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\489fb36e1cedd5102\DXSETUP.exe

2013-11-09 13:40:42 1691480 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\489fb36e1cedd5102\dsetup32.dll

2013-11-09 13:40:41 89944 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\486e42751cedd5101\DSETUP.dll

2013-11-09 13:40:41 537432 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\486e42751cedd5101\DXSETUP.exe

2013-11-09 13:40:41 1801048 -c--a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\486e42751cedd5101\dsetup32.dll

2013-11-09 13:40:40 -------- d-----w- C:\Users\Valued Customer\AppData\Local\Windows Live

2013-11-09 13:40:17 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live

2013-11-09 13:33:19 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\Canon_Inc_IC

2013-11-09 13:16:01 565760 ----a-w- C:\Windows\SysWow64\MSVCP50.DLL

2013-11-09 13:14:03 304128 ----a-w- C:\Windows\IsUninst.exe

2013-11-09 06:32:57 736952 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll

2013-11-09 06:32:34 2876528 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2013-11-09 06:32:26 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2013-11-09 06:32:19 539984 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2013-11-09 05:08:24 -------- d-----w- C:\Users\Valued Customer\AppData\Roaming\ZoomBrowser EX

2013-11-08 00:26:22 -------- d-----w- C:\Users\Valued Customer\AppData\Local\CANON_INC

2013-11-08 00:05:08 -------- d-----w- C:\Program Files (x86)\Common Files\Canon_Inc_IC

2013-11-08 00:05:08 -------- d-----w- C:\Program Files (x86)\Canon

2013-11-08 00:04:04 -------- d-----w- C:\ProgramData\Canon_Inc_IC

2013-11-07 23:39:08 -------- d-----w- C:\Program Files (x86)\Common Files\Canon

.

==================== Find3M ====================

.

2013-11-11 10:50:16 267936 ------w- C:\Windows\System32\MpSigStub.exe

2013-11-05 01:23:26 16896 ----a-w- C:\Windows\AsTaskSched.dll

2013-11-04 15:41:30 11264 ----a-w- C:\wajam_validate.exe

2013-11-02 01:37:35 443632 ----a-w- C:\ProgramData\1383356093.bdinstall.bin

2013-10-23 08:20:08 6669600 ----a-w- C:\Windows\System32\nvcpl.dll

2013-10-23 08:20:07 3489568 ----a-w- C:\Windows\System32\nvsvc64.dll

2013-10-23 08:20:05 922912 ----a-w- C:\Windows\System32\nvvsvc.exe

2013-10-23 08:20:05 63776 ----a-w- C:\Windows\System32\nvshext.dll

2013-10-23 08:20:05 219424 ----a-w- C:\Windows\System32\nvmctray.dll

2013-10-23 08:20:03 3426956 ----a-w- C:\Windows\System32\nvcoproc.bin

2013-10-22 14:59:21 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2013-10-22 14:59:21 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2013-10-22 14:59:21 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2013-10-22 14:59:21 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2013-10-18 01:36:09 1063200 ----a-w- C:\Windows\System32\nvspcap64.dll

2013-10-18 01:36:08 955168 ----a-w- C:\Windows\SysWow64\nvspcap.dll

2013-10-16 00:48:05 1884448 ----a-w- C:\Windows\System32\nvdispco6433158.dll

2013-10-16 00:48:05 1511712 ----a-w- C:\Windows\System32\nvdispgenco6433158.dll

2013-10-12 02:30:42 830464 ----a-w- C:\Windows\System32\nshwfp.dll

2013-10-12 02:29:21 859648 ----a-w- C:\Windows\System32\IKEEXT.DLL

2013-10-12 02:29:08 324096 ----a-w- C:\Windows\System32\FWPUCLNT.DLL

2013-10-12 02:03:08 656896 ----a-w- C:\Windows\SysWow64\nshwfp.dll

2013-10-12 02:01:25 216576 ----a-w- C:\Windows\SysWow64\FWPUCLNT.DLL

2013-10-05 19:57:25 1168384 ----a-w- C:\Windows\SysWow64\crypt32.dll

2013-10-04 02:28:31 190464 ----a-w- C:\Windows\System32\SmartcardCredentialProvider.dll

2013-10-04 02:25:17 197120 ----a-w- C:\Windows\System32\credui.dll

2013-10-04 02:24:49 1930752 ----a-w- C:\Windows\System32\authui.dll

2013-10-04 01:58:50 152576 ----a-w- C:\Windows\SysWow64\SmartcardCredentialProvider.dll

2013-10-04 01:56:25 168960 ----a-w- C:\Windows\SysWow64\credui.dll

2013-10-04 01:56:00 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

2013-10-03 02:23:48 404480 ----a-w- C:\Windows\System32\gdi32.dll

2013-10-03 02:00:44 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll

2013-10-02 02:22:20 56832 ----a-w- C:\Windows\System32\drivers\TsUsbFlt.sys

2013-10-02 02:11:13 13824 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe

2013-10-02 02:08:53 12800 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll

2013-10-02 01:48:59 56832 ----a-w- C:\Windows\System32\MsRdpWebAccess.dll

2013-10-02 01:48:08 18944 ----a-w- C:\Windows\System32\wksprtPS.dll

2013-10-02 01:29:05 62976 ----a-w- C:\Windows\System32\tsgqec.dll

2013-10-02 01:10:56 44544 ----a-w- C:\Windows\System32\TsUsbGDCoInstaller.dll

2013-10-02 00:15:45 1057280 ----a-w- C:\Windows\System32\rdvidcrl.dll

2013-10-02 00:14:58 50176 ----a-w- C:\Windows\SysWow64\MsRdpWebAccess.dll

2013-10-02 00:14:20 17920 ----a-w- C:\Windows\SysWow64\wksprtPS.dll

2013-10-02 00:08:30 83968 ----a-w- C:\Windows\System32\TSWbPrxy.exe

2013-10-02 00:01:16 420864 ----a-w- C:\Windows\System32\wksprt.exe

2013-10-01 23:58:48 53248 ----a-w- C:\Windows\SysWow64\tsgqec.dll

2013-10-01 23:31:09 1147392 ----a-w- C:\Windows\System32\mstsc.exe

2013-10-01 23:08:10 855552 ----a-w- C:\Windows\SysWow64\rdvidcrl.dll

2013-10-01 22:34:12 1068544 ----a-w- C:\Windows\SysWow64\mstsc.exe

2013-10-01 20:57:46 6578176 ----a-w- C:\Windows\System32\mstscax.dll

2013-10-01 20:55:10 5698048 ----a-w- C:\Windows\SysWow64\mstscax.dll

2013-09-28 01:09:10 497152 ----a-w- C:\Windows\System32\drivers\afd.sys

2013-09-27 23:01:44 39200 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys

2013-09-27 23:01:38 29984 ----a-w- C:\Windows\System32\nvaudcap64v.dll

2013-09-27 23:01:38 28960 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll

2013-09-25 02:26:40 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2013-09-25 02:26:40 154560 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2013-09-25 02:23:41 1030144 ----a-w- C:\Windows\System32\TSWorkspace.dll

2013-09-25 02:23:33 28672 ----a-w- C:\Windows\System32\sspisrv.dll

2013-09-25 02:23:33 135680 ----a-w- C:\Windows\System32\sspicli.dll

2013-09-25 02:23:01 28160 ----a-w- C:\Windows\System32\secur32.dll

2013-09-25 02:22:59 340992 ----a-w- C:\Windows\System32\schannel.dll

2013-09-25 02:21:50 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2013-09-25 02:21:07 1447936 ----a-w- C:\Windows\System32\lsasrv.dll

2013-09-25 01:58:17 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2013-09-25 01:57:53 792576 ----a-w- C:\Windows\SysWow64\TSWorkspace.dll

2013-09-25 01:57:26 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2013-09-25 01:57:24 247808 ----a-w- C:\Windows\SysWow64\schannel.dll

2013-09-25 01:56:42 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2013-09-25 01:03:24 30720 ----a-w- C:\Windows\System32\lsass.exe

2013-09-24 12:10:34 97768 ----a-w- C:\Windows\System32\drivers\ctxusbm.sys

2013-09-12 08:58:10 1884448 ----a-w- C:\Windows\System32\nvdispco6432723.dll

2013-09-12 08:58:10 1511712 ----a-w- C:\Windows\System32\nvdispgenco6432723.dll

.

============= FINISH: 9:06:37.77 ===============

AdvancedSetup · December 10, 2013

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

JeromeAC · December 15, 2013

Steps I followed:

downloaded & saved to desktop Combofix
disabled internet connection and Bitdefender Antivirus and Malwarebytes Pro
Ran combofix
urned back on Bitdefender Antivirus and Malwarebytes Pro
Reconnected to Internet
Bleeping Computer page indicated that a system restore point would be created; this did not occur following the running of Combofix
Pasted combo log below:

ComboFix 13-12-13.01 - Valued Customer 12/15/2013 15:29:34.1.8 - x64

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.16323.14166 [GMT -5:00]

Running from: c:\users\Valued Customer\Desktop\ComboFix.exe

AV: Bitdefender Antivirus *Disabled/Updated* {9B5F5313-CAF9-DD97-C460-E778420237B4}

SP: Bitdefender Antispyware *Disabled/Updated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\1383356093.bdinstall.bin

c:\programdata\1386288829.bdinstall.bin

c:\programdata\1386288990.2288.bin

c:\programdata\1386288990.2500.bin

c:\programdata\1386288990.2564.bin

c:\programdata\1386288990.2572.bin

c:\programdata\1386288990.3856.bin

c:\programdata\1386288990.4316.bin

c:\programdata\1386288990.5236.bin

c:\programdata\1386288990.5816.bin

c:\programdata\1386288990.5824.bin

c:\programdata\1386288990.5836.bin

c:\programdata\1386288990.5992.bin

c:\programdata\1386288990.6116.bin

c:\programdata\1386289201.bdinstall.bin

c:\programdata\1386289332.bdinstall.bin

c:\programdata\1386289399.bdinstall.bin

c:\programdata\1386290890.bdinstall.bin

c:\programdata\1386291008.bdinstall.bin

c:\users\Valued Customer\bitdefender_antivirus_2014.exe

c:\users\Valued Customer\CyberLink_PowerDirector_Downloader.exe

c:\windows\Installer\{9B65F9A3-9D24-452A-B6EF-1457D65E4259}

c:\windows\Installer\{9B65F9A3-9D24-452A-B6EF-1457D65E4259}\icon64.ico

c:\windows\SysWow64\tmp7FCA.tmp

c:\windows\SysWow64\tmp7FDA.tmp

H:\autorun.inf

H:\explorer.exe

.

((((((((((((((((((((((((( Files Created from 2013-11-15 to 2013-12-15 )))))))))))))))))))))))))))))))

.

2013-12-15 20:32 . 2013-12-15 20:32 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-12-15 19:58 . 2013-12-15 19:58 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2013-12-15 19:50 . 2013-12-15 19:50 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll

2013-12-13 11:32 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{10130230-54B7-49FA-9023-69CEF0857D00}\mpengine.dll

2013-12-11 13:28 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll

2013-12-09 23:38 . 2013-12-09 23:38 -------- d-----w- c:\windows\Migration

2013-12-06 01:21 . 2013-12-06 01:21 76944 ----a-w- c:\windows\system32\drivers\bdvedisk.sys

2013-12-06 00:50 . 2013-11-04 20:47 82824 ----a-w- c:\windows\system32\drivers\bdsandbox.sys

2013-12-06 00:50 . 2013-07-19 22:08 601360 ----a-w- c:\windows\system32\drivers\avckf.sys

2013-12-06 00:50 . 2013-07-19 22:04 727592 ----a-w- c:\windows\system32\drivers\avc3.sys

2013-12-06 00:50 . 2013-12-06 00:50 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\Bitdefender

2013-12-06 00:50 . 2013-08-13 17:38 3271472 ---ha-w- C:\bdr-bz02

2013-12-06 00:50 . 2013-12-06 01:21 -------- d-----w- c:\programdata\Bitdefender

2013-12-06 00:50 . 2013-08-23 17:48 150256 ----a-w- c:\windows\system32\drivers\gzflt.sys

2013-12-06 00:50 . 2013-08-07 17:46 389240 ----a-w- c:\windows\system32\drivers\trufos.sys

2013-12-06 00:20 . 2013-12-06 00:50 -------- d-----w- c:\program files\Bitdefender

2013-12-06 00:17 . 2013-08-13 17:38 3271472 ---ha-w- C:\bdr-bz01

2013-12-06 00:13 . 2013-12-06 00:13 -------- d-----w- c:\program files (x86)\Common Files\Bitdefender

2013-11-29 23:20 . 2013-11-29 23:36 -------- d-----w- c:\users\Public\CyberLink

2013-11-29 23:19 . 2013-11-30 00:06 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\CyberLink

2013-11-29 23:12 . 2013-11-29 23:12 -------- d-----w- c:\programdata\SmartSound Software Inc

2013-11-29 23:12 . 2013-11-29 23:12 -------- d-----w- c:\programdata\eSellerate

2013-11-29 23:12 . 2013-11-29 23:12 -------- d-----w- c:\program files (x86)\SmartSound Software

2013-11-29 23:11 . 2013-11-29 23:12 -------- d-----w- c:\program files (x86)\CyberLink

2013-11-29 23:09 . 2013-11-29 23:42 -------- d-----w- c:\programdata\CyberLink

2013-11-29 23:09 . 2013-11-29 23:12 -------- d-----w- c:\programdata\install_clap

2013-11-28 13:28 . 2013-12-07 14:23 -------- d-----w- c:\users\Valued Customer\AppData\Local\Diagnostics

2013-11-28 03:32 . 2013-10-16 15:18 439296 ----a-w- c:\windows\system32\AdpeakProxy64.dll

2013-11-26 22:45 . 2013-11-26 23:41 -------- d-----w- c:\program files (x86)\MyPC Backup

2013-11-26 22:45 . 2013-11-26 23:40 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\Systweak

2013-11-26 22:45 . 2013-08-22 23:36 20312 ----a-w- c:\windows\system32\roboot64.exe

2013-11-26 22:44 . 2013-12-07 13:53 -------- d-----w- C:\temp

2013-11-26 22:44 . 2013-12-07 17:15 -------- d-----w- c:\program files\Level Quality Watcher

2013-11-21 10:48 . 2013-12-06 01:20 74512 ----a-w- c:\windows\SysWow64\bdsandboxuiskin32.dll

2013-11-20 13:45 . 2013-11-04 20:47 84848 ----a-w- c:\windows\system32\bdsandboxuiskin.dll

2013-11-20 13:45 . 2013-12-06 01:20 74512 ----a-w- c:\windows\system32\bdsandboxuiskin32.dll

2013-11-20 13:45 . 2013-11-04 20:46 34384 ----a-w- c:\windows\system32\bdsandboxuh.dll

2013-11-16 15:21 . 2013-11-16 15:21 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\Malwarebytes

2013-11-16 15:20 . 2013-11-16 15:20 -------- d-----w- c:\programdata\Malwarebytes

2013-11-16 15:20 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-11-16 14:56 . 2013-10-14 23:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE

2013-11-16 14:33 . 2013-11-16 18:55 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\ICAClient

2013-11-16 14:33 . 2013-11-16 14:33 -------- d-----w- c:\programdata\Citrix

2013-11-16 14:33 . 2013-11-16 14:34 -------- d-----w- c:\users\Valued Customer\AppData\Local\Citrix

2013-11-16 14:33 . 2013-11-16 14:33 -------- d-----w- c:\program files (x86)\Common Files\Citrix

2013-11-16 14:33 . 2013-11-16 14:33 -------- d-----w- c:\program files (x86)\Citrix

2013-11-16 13:58 . 2013-11-16 14:13 -------- d-----w- c:\users\Valued Customer\AppData\Roaming\Skype

2013-11-16 13:58 . 2013-11-16 13:58 -------- d-----r- c:\program files (x86)\Skype

2013-11-16 13:58 . 2013-11-16 13:58 -------- d-----w- c:\program files (x86)\Common Files\Skype

2013-11-16 13:58 . 2013-11-16 13:58 -------- d-----w- c:\programdata\Skype

2013-11-16 12:17 . 2007-05-24 02:26 100352 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-11-16 00:01 . 2010-12-28 16:15 82896128 ----a-w- c:\windows\system32\MRT.exe

2013-11-11 10:50 . 2010-12-28 16:09 267936 ------w- c:\windows\system32\MpSigStub.exe

2013-11-09 13:41 . 2012-07-17 19:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-11-09 06:32 . 2013-11-09 06:32 736952 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll

2013-11-09 06:32 . 2013-11-09 06:32 2876528 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2013-11-09 06:32 . 2013-11-09 06:32 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2013-11-09 06:32 . 2013-11-09 06:32 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2013-11-05 01:23 . 2013-11-05 01:23 16896 ----a-w- c:\windows\AsTaskSched.dll

2013-11-04 15:41 . 2013-11-04 15:41 11264 ----a-w- C:\wajam_validate.exe

2013-11-02 16:27 . 2013-11-02 16:27 53248 ----a-r- c:\users\Valued Customer\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2013-10-23 10:30 . 2013-11-02 01:50 9524088 ----a-w- c:\windows\SysWow64\nvcuda.dll

2013-10-23 10:30 . 2013-11-02 01:50 9480328 ----a-w- c:\windows\SysWow64\nvopencl.dll

2013-10-23 10:30 . 2013-11-02 01:50 696096 ----a-w- c:\windows\system32\NvFBC64.dll

2013-10-23 10:30 . 2013-11-02 01:50 655136 ----a-w- c:\windows\system32\NvIFR64.dll

2013-10-23 10:30 . 2013-11-02 01:50 599840 ----a-w- c:\windows\SysWow64\NvFBC.dll

2013-10-23 10:30 . 2013-11-02 01:50 560416 ----a-w- c:\windows\SysWow64\NvIFR.dll

2013-10-23 10:30 . 2013-11-02 01:50 479520 ----a-w- c:\windows\system32\nvEncodeAPI64.dll

2013-10-23 10:30 . 2013-11-02 01:50 405280 ----a-w- c:\windows\SysWow64\nvEncodeAPI.dll

2013-10-23 10:30 . 2013-11-02 01:50 317472 ----a-w- c:\windows\system32\nvoglshim64.dll

2013-10-23 10:30 . 2013-11-02 01:50 3131680 ----a-w- c:\windows\system32\nvcuvid.dll

2013-10-23 10:30 . 2013-11-02 01:50 3124512 ----a-w- c:\windows\system32\nvcuvenc.dll

2013-10-23 10:30 . 2013-11-02 01:50 30344480 ----a-w- c:\windows\system32\nvoglv64.dll

2013-10-23 10:30 . 2013-11-02 01:50 2946848 ----a-w- c:\windows\SysWow64\nvcuvid.dll

2013-10-23 10:30 . 2013-11-02 01:50 2747168 ----a-w- c:\windows\SysWow64\nvcuvenc.dll

2013-10-23 10:30 . 2013-11-02 01:50 266984 ----a-w- c:\windows\SysWow64\nvoglshim32.dll

2013-10-23 10:30 . 2013-11-02 01:50 25257248 ----a-w- c:\windows\system32\nvcompiler.dll

2013-10-23 10:30 . 2013-11-02 01:50 22933792 ----a-w- c:\windows\SysWow64\nvoglv32.dll

2013-10-23 10:30 . 2013-11-02 01:50 1884448 ----a-w- c:\windows\system32\nvdispco6433165.dll

2013-10-23 10:30 . 2013-11-02 01:50 18199872 ----a-w- c:\windows\system32\nvd3dumx.dll

2013-10-23 10:30 . 2013-11-02 01:50 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll

2013-10-23 10:30 . 2013-11-02 01:50 168616 ----a-w- c:\windows\system32\nvinitx.dll

2013-10-23 10:30 . 2013-11-02 01:50 15855568 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

2013-10-23 10:30 . 2013-11-02 01:50 1511712 ----a-w- c:\windows\system32\nvdispgenco6433165.dll

2013-10-23 10:30 . 2013-11-02 01:50 141336 ----a-w- c:\windows\SysWow64\nvinit.dll

2013-10-23 10:30 . 2013-11-02 01:50 12572960 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2013-10-23 10:30 . 2013-11-02 01:50 1241376 ----a-w- c:\windows\SysWow64\nvumdshim.dll

2013-10-23 10:30 . 2013-11-02 01:50 11426568 ----a-w- c:\windows\system32\nvcuda.dll

2013-10-23 10:30 . 2013-11-02 01:50 11374520 ----a-w- c:\windows\system32\nvopencl.dll

2013-10-23 10:30 . 2013-10-28 12:43 15212336 ----a-w- c:\windows\SysWow64\nvd3dum.dll

2013-10-23 10:30 . 2013-10-22 14:45 61216 ----a-w- c:\windows\system32\OpenCL.dll

2013-10-23 10:30 . 2013-10-22 14:45 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll

2013-10-23 10:30 . 2013-10-22 14:42 3067560 ----a-w- c:\windows\system32\nvapi64.dll

2013-10-23 10:30 . 2013-10-22 14:42 2695200 ----a-w- c:\windows\SysWow64\nvapi.dll

2013-10-23 10:30 . 2013-10-22 14:42 18286416 ----a-w- c:\windows\system32\nvwgf2umx.dll

2013-10-23 10:30 . 2013-10-22 14:42 1435504 ----a-w- c:\windows\system32\nvumdshimx.dll

2013-10-23 08:20 . 2013-10-22 14:45 6669600 ----a-w- c:\windows\system32\nvcpl.dll

2013-10-23 08:20 . 2013-10-22 14:45 3489568 ----a-w- c:\windows\system32\nvsvc64.dll

2013-10-23 08:20 . 2013-10-22 14:45 922912 ----a-w- c:\windows\system32\nvvsvc.exe

2013-10-23 08:20 . 2013-10-22 14:45 63776 ----a-w- c:\windows\system32\nvshext.dll

2013-10-23 08:20 . 2013-10-22 14:45 219424 ----a-w- c:\windows\system32\nvmctray.dll

2013-10-23 08:20 . 2013-10-22 14:45 3426956 ----a-w- c:\windows\system32\nvcoproc.bin

2013-10-22 16:24 . 2013-10-22 16:24 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin

2013-10-22 14:59 . 2013-10-22 14:59 466456 ----a-w- c:\windows\system32\wrap_oal.dll

2013-10-22 14:59 . 2013-10-22 14:59 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2013-10-22 14:59 . 2013-10-22 14:59 122904 ----a-w- c:\windows\system32\OpenAL32.dll

2013-10-22 14:59 . 2013-10-22 14:59 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2013-10-18 01:36 . 2013-11-02 01:48 1063200 ----a-w- c:\windows\system32\nvspcap64.dll

2013-10-18 01:36 . 2013-11-02 01:48 955168 ----a-w- c:\windows\SysWow64\nvspcap.dll

2013-10-16 00:48 . 2013-10-28 12:43 1884448 ----a-w- c:\windows\system32\nvdispco6433158.dll

2013-10-16 00:48 . 2013-10-28 12:43 1511712 ----a-w- c:\windows\system32\nvdispgenco6433158.dll

2013-10-12 02:30 . 2013-11-13 13:19 830464 ----a-w- c:\windows\system32\nshwfp.dll

2013-10-12 02:29 . 2013-11-13 13:19 859648 ----a-w- c:\windows\system32\IKEEXT.DLL

2013-10-12 02:29 . 2013-11-13 13:19 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL

2013-10-12 02:03 . 2013-11-13 13:19 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll

2013-10-12 02:01 . 2013-11-13 13:19 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL

2013-10-05 20:25 . 2013-11-13 13:19 1474048 ----a-w- c:\windows\system32\crypt32.dll

2013-10-05 19:57 . 2013-11-13 13:19 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll

2013-10-04 02:28 . 2013-11-13 13:19 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll

2013-10-04 02:25 . 2013-11-13 13:19 197120 ----a-w- c:\windows\system32\credui.dll

2013-10-04 02:24 . 2013-11-13 13:19 1930752 ----a-w- c:\windows\system32\authui.dll

2013-10-04 01:58 . 2013-11-13 13:19 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll

2013-10-04 01:56 . 2013-11-13 13:19 168960 ----a-w- c:\windows\SysWow64\credui.dll

2013-10-04 01:56 . 2013-11-13 13:19 1796096 ----a-w- c:\windows\SysWow64\authui.dll

2013-10-03 02:23 . 2013-11-13 13:19 404480 ----a-w- c:\windows\system32\gdi32.dll

2013-10-03 02:00 . 2013-11-13 13:19 311808 ----a-w- c:\windows\SysWow64\gdi32.dll

2013-09-28 01:09 . 2013-11-13 13:19 497152 ----a-w- c:\windows\system32\drivers\afd.sys

2013-09-27 23:01 . 2013-11-02 01:37 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys

2013-09-27 23:01 . 2013-11-02 01:37 28960 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll

2013-09-27 23:01 . 2013-10-22 14:42 29984 ----a-w- c:\windows\system32\nvaudcap64v.dll

2013-09-25 02:26 . 2013-11-13 13:19 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2013-09-25 02:26 . 2013-11-13 13:19 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2013-09-25 02:23 . 2013-11-13 13:19 28672 ----a-w- c:\windows\system32\sspisrv.dll

2013-09-25 02:23 . 2013-11-13 13:19 135680 ----a-w- c:\windows\system32\sspicli.dll

2013-09-25 02:23 . 2013-11-13 13:19 28160 ----a-w- c:\windows\system32\secur32.dll

2013-09-25 02:22 . 2013-11-13 13:19 340992 ----a-w- c:\windows\system32\schannel.dll

2013-09-25 02:21 . 2013-11-13 13:19 307200 ----a-w- c:\windows\system32\ncrypt.dll

2013-09-25 02:21 . 2013-11-13 13:19 1447936 ----a-w- c:\windows\system32\lsasrv.dll

2013-09-25 01:58 . 2013-11-13 13:19 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2013-09-25 01:57 . 2013-11-13 13:19 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2013-09-25 01:57 . 2013-11-13 13:19 247808 ----a-w- c:\windows\SysWow64\schannel.dll

2013-09-25 01:56 . 2013-11-13 13:19 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2013-09-25 01:03 . 2013-11-13 13:19 30720 ----a-w- c:\windows\system32\lsass.exe

2013-09-24 12:10 . 2013-09-24 12:10 97768 ----a-w- c:\windows\system32\drivers\ctxusbm.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-09-14 59720]

"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-09-15 59720]

"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2013-11-18 560648]

"Bitdefender Wallet"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2013-11-18 1000488]

"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2013-11-18 612696]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2012-09-13 204136]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-02 152392]

"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2013-10-02 395656]

"Redirector"="c:\program files (x86)\Citrix\ICA Client\redirector.exe" [2013-10-02 153992]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2013-11-18 560648]

"Bitdefender Wallet"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2013-11-18 1000488]

"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2013-11-18 612696]

.

c:\users\Valued Customer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech . Product Registration.lnk - c:\program files (x86)\Logitech\Ereg\eReg.exe /remind /language=ENU /_WFM="." [2009-11-16 517384]

Samsung Magician.lnk - c:\program files (x86)\Samsung\Samsung Magician\Samsung Magician.exe /AUTOHIDE [2013-12-13 4580256]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HD Writer.lnk - c:\program files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2013-11-2 292736]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]

R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]

R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]

R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys;c:\windows\SYSNATIVE\drivers\bdsandbox.sys [x]

R3 CAXHWBS3;CAXHWBS3;c:\windows\system32\DRIVERS\CAXHWBS3.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWBS3.sys [x]

R3 e1dexpress;Intel® PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]

R3 NTIOLib_1_0_C;NTIOLib_1_0_C;d:\ntiolib_x64.sys;d:\NTIOLib_X64.sys [x]

R3 PMUSB2G;PassMark USB2.0 Loopback plug driver;c:\windows\system32\Drivers\PMUSB.sys;c:\windows\SYSNATIVE\Drivers\PMUSB.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]

S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]

S0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]

S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [x]

S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]

S2 MBAMScheduler;MBAMScheduler;g:\malwarebytes' anti-malware\mbamscheduler.exe;g:\malwarebytes' anti-malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;g:\malwarebytes' anti-malware\mbamservice.exe;g:\malwarebytes' anti-malware\mbamservice.exe [x]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]

S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender\updatesrv.exe;c:\program files\Bitdefender\Bitdefender\updatesrv.exe [x]

S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]

S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys;c:\windows\SYSNATIVE\drivers\cmudaxp.sys [x]

S3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]

S3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]

S3 LVUVC64;Logitech HD Webcam C310(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-05 02:17 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02 02:00]

.

2013-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-11-02 02:00]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-10-18 1028384]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2013-03-29 7174728]

"Cmaudio8788"="c:\windows\Syswow64\cmicnfgp.cpl" [2008-01-10 6475776]

"Cmaudio8788GX"="c:\windows\system\CmGxMon.exe" [2007-12-19 20480]

"Cmaudio8788GX64"="c:\windows\system\HsMgr64.exe" [2008-07-11 282112]

"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-10-18 1063200]

"Bdagent"="c:\program files\Bitdefender\Bitdefender\bdagent.exe" [2013-11-21 1734848]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.1 71.242.0.12

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-CitrixReceiver - c:\programdata\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-12-15 15:33:20

ComboFix-quarantined-files.txt 2013-12-15 20:33

.

Pre-Run: 156,373,012,480 bytes free

Post-Run: 156,565,372,928 bytes free

.

- - End Of File - - 74068D4C6C61EEDC363216A390E8F746

A36C5E4F47E84449FF07ED3517B43A31

AdvancedSetup · December 17, 2013

That looks pretty good. Combofix was able to find and remove items for us.

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next reply message
When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

STEP 06

Please go here to run the online antivirus scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

JeromeAC · December 23, 2013

Step 03 - Malwarebyte Anti-Rootkit

Followed directions

Infected file found - wajam_validate.exe - couldn't be remediated due to no backup. I moved file to Recycle Bin; ran Anti-Rootkit again, it found file in Recycle Bin; I deleted it from Recycle Bin; ran tool again; no threats found. Reports are below:

Mbar-log.txt

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

www.malwarebytes.org

Database version: v2013.12.22.04

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Valued Customer :: AVA-407420-1 [administrator]

12/22/2013 15:27:08

mbar-log-2013-12-22 (15-27-08).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 235929

Time elapsed: 3 minute(s), 7 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

system-log.txt

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED

CPU speed: 3.500000 GHz

Memory total: 17115754496, free: 15142817792

Downloaded database version: v2013.12.22.04

Downloaded database version: v2013.12.18.01

=======================================

Initializing...

------------ Kernel report ------------

12/22/2013 15:13:13

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\system32\DRIVERS\iusb3hcs.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\trufos.sys

\SystemRoot\system32\DRIVERS\FLTMGR.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\vmbus.sys

\SystemRoot\system32\drivers\winhv.sys

\SystemRoot\system32\drivers\iaStorV.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\system32\DRIVERS\avc3.sys

\SystemRoot\system32\DRIVERS\gzflt.sys

\SystemRoot\System32\Drivers\PxHlpa64.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\system32\DRIVERS\ctxusbm.sys

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\??\C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\ws2ifsl.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\SysWow64\drivers\AsIO.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\1394ohci.sys

\SystemRoot\system32\DRIVERS\iusb3xhc.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\DRIVERS\e1d62x64.sys

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\drivers\cmudaxp.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\DRIVERS\avchv.sys

\SystemRoot\system32\drivers\umbus.sys

\SystemRoot\system32\drivers\nvvad64v.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\DRIVERS\iusb3hub.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\lvuvc64.sys

\SystemRoot\system32\drivers\usbaudio.sys

\SystemRoot\system32\DRIVERS\lvrs64.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\DRIVERS\avckf.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\DRIVERS\mdmxsdk.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\system32\DRIVERS\XAudio64.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\SystemRoot\System32\ATMFD.DLL

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\kernel32.dll

\Windows\System32\clbcatq.dll

\Windows\System32\ole32.dll

\Windows\System32\user32.dll

\Windows\System32\usp10.dll

\Windows\System32\Wldap32.dll

\Windows\System32\shlwapi.dll

\Windows\System32\msvcrt.dll

\Windows\System32\comdlg32.dll

\Windows\System32\imagehlp.dll

\Windows\System32\wininet.dll

\Windows\System32\rpcrt4.dll

\Windows\System32\msctf.dll

\Windows\System32\gdi32.dll

\Windows\System32\urlmon.dll

\Windows\System32\iertutil.dll

\Windows\System32\setupapi.dll

\Windows\System32\normaliz.dll

\Windows\System32\imm32.dll

\Windows\System32\advapi32.dll

\Windows\System32\psapi.dll

\Windows\System32\difxapi.dll

\Windows\System32\oleaut32.dll

\Windows\System32\lpk.dll

\Windows\System32\shell32.dll

\Windows\System32\sechost.dll

\Windows\System32\nsi.dll

\Windows\System32\ws2_32.dll

\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

\Windows\System32\comctl32.dll

\Windows\System32\KernelBase.dll

\Windows\System32\crypt32.dll

\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

\Windows\System32\devobj.dll

\Windows\System32\cfgmgr32.dll

\Windows\System32\wintrust.dll

\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

\Windows\System32\msasn1.dll

\Windows\SysWOW64\normaliz.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk4\DR4

Upper Device Object: 0xfffffa800e6ae790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000090\

Lower Device Object: 0xfffffa800e539b60

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk3\DR3

Upper Device Object: 0xfffffa800e34c060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000088\

Lower Device Object: 0xfffffa800e3534a0

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk2\DR2

Upper Device Object: 0xfffffa800e34b060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000087\

Lower Device Object: 0xfffffa800e2f7060

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa800ce9f060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\

Lower Device Object: 0xfffffa800cad1060

Lower Device Driver Name: \Driver\atapi\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800ce7f790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\

Lower Device Object: 0xfffffa800cac24e0

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa800ce7f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800ce7f2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800ce7f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800cac24e0, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: B4553281

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 439349248

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 250059350016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488377168-488397168)...

Done!

Physical Sector Size: 512

Drive: 1, DevicePointer: 0xfffffa800ce9f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800ce9fb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800ce9f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800cad1060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

Drive 1

Scanning MBR on drive 1...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: C1D946E8

Partition information:

Partition 0 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 2048 Numsec = 1953519616

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

Done!

Physical Sector Size: 0

Drive: 2, DevicePointer: 0xfffffa800e34b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e34bb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e34b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e2f7060, DeviceName: \Device\00000087\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 3, DevicePointer: 0xfffffa800e34c060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e34cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e34c060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e3534a0, DeviceName: \Device\00000088\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 512

Drive: 4, DevicePointer: 0xfffffa800e6ae790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e535930, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e6ae790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e539b60, DeviceName: \Device\00000090\, DriverName: \Driver\USBSTOR\

------------ End ----------

Alternate DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

Drive 4

Scanning MBR on drive 4...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 69AA3A04

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 976768002

Partition file system is NTFS

Partition is not bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 500107862016 bytes

Sector size: 512 bytes

Done!

Infected file C:\wajam_validate.exe could not be remediated because backup file is not available

Scan finished

=======================================

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_2048_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_r.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_4_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_4_0_63_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_4_r.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe_k.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe_u.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\wajam_validate.exe_r.mbam...

Removal finished

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED

CPU speed: 3.500000 GHz

Memory total: 17115754496, free: 14751973376

=======================================

Initializing...

------------ Kernel report ------------

12/22/2013 15:23:05

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\system32\DRIVERS\iusb3hcs.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\trufos.sys

\SystemRoot\system32\DRIVERS\FLTMGR.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\vmbus.sys

\SystemRoot\system32\drivers\winhv.sys

\SystemRoot\system32\drivers\iaStorV.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\system32\DRIVERS\avc3.sys

\SystemRoot\system32\DRIVERS\gzflt.sys

\SystemRoot\System32\Drivers\PxHlpa64.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\system32\DRIVERS\ctxusbm.sys

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\??\C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\ws2ifsl.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\SysWow64\drivers\AsIO.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\1394ohci.sys

\SystemRoot\system32\DRIVERS\iusb3xhc.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\DRIVERS\e1d62x64.sys

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\drivers\cmudaxp.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\DRIVERS\avchv.sys

\SystemRoot\system32\drivers\umbus.sys

\SystemRoot\system32\drivers\nvvad64v.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\DRIVERS\iusb3hub.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\lvuvc64.sys

\SystemRoot\system32\drivers\usbaudio.sys

\SystemRoot\system32\DRIVERS\lvrs64.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\DRIVERS\avckf.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\DRIVERS\mdmxsdk.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\system32\DRIVERS\XAudio64.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\SystemRoot\System32\ATMFD.DLL

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\kernel32.dll

\Windows\System32\clbcatq.dll

\Windows\System32\ole32.dll

\Windows\System32\user32.dll

\Windows\System32\usp10.dll

\Windows\System32\Wldap32.dll

\Windows\System32\shlwapi.dll

\Windows\System32\msvcrt.dll

\Windows\System32\comdlg32.dll

\Windows\System32\imagehlp.dll

\Windows\System32\wininet.dll

\Windows\System32\rpcrt4.dll

\Windows\System32\msctf.dll

\Windows\System32\gdi32.dll

\Windows\System32\urlmon.dll

\Windows\System32\iertutil.dll

\Windows\System32\setupapi.dll

\Windows\System32\normaliz.dll

\Windows\System32\imm32.dll

\Windows\System32\advapi32.dll

\Windows\System32\psapi.dll

\Windows\System32\difxapi.dll

\Windows\System32\oleaut32.dll

\Windows\System32\lpk.dll

\Windows\System32\shell32.dll

\Windows\System32\sechost.dll

\Windows\System32\nsi.dll

\Windows\System32\ws2_32.dll

\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

\Windows\System32\comctl32.dll

\Windows\System32\KernelBase.dll

\Windows\System32\crypt32.dll

\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

\Windows\System32\devobj.dll

\Windows\System32\cfgmgr32.dll

\Windows\System32\wintrust.dll

\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

\Windows\System32\msasn1.dll

\Windows\SysWOW64\normaliz.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk4\DR4

Upper Device Object: 0xfffffa800e6ae790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000090\

Lower Device Object: 0xfffffa800e539b60

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk3\DR3

Upper Device Object: 0xfffffa800e34c060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000088\

Lower Device Object: 0xfffffa800e3534a0

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk2\DR2

Upper Device Object: 0xfffffa800e34b060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000087\

Lower Device Object: 0xfffffa800e2f7060

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa800ce9f060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\

Lower Device Object: 0xfffffa800cad1060

Lower Device Driver Name: \Driver\atapi\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800ce7f790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\

Lower Device Object: 0xfffffa800cac24e0

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa800ce7f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800ce7f2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800ce7f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800cac24e0, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: B4553281

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 439349248

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 250059350016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488377168-488397168)...

Done!

Physical Sector Size: 512

Drive: 1, DevicePointer: 0xfffffa800ce9f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800ce9fb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800ce9f060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800cad1060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

Drive 1

Scanning MBR on drive 1...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: C1D946E8

Partition information:

Partition 0 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 2048 Numsec = 1953519616

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

Done!

Physical Sector Size: 0

Drive: 2, DevicePointer: 0xfffffa800e34b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e34bb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e34b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e2f7060, DeviceName: \Device\00000087\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 3, DevicePointer: 0xfffffa800e34c060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e34cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e34c060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e3534a0, DeviceName: \Device\00000088\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 512

Drive: 4, DevicePointer: 0xfffffa800e6ae790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800e535930, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800e6ae790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800e539b60, DeviceName: \Device\00000090\, DriverName: \Driver\USBSTOR\

------------ End ----------

Alternate DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

Drive 4

Scanning MBR on drive 4...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 69AA3A04

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 976768002

Partition file system is NTFS

Partition is not bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 500107862016 bytes

Sector size: 512 bytes

Done!

Infected file C:\$RECYCLE.BIN\S-1-5-21-1360142460-1499946298-1873140786-1000\$RHEEJ9S.exe could not be remediated because backup file is not available