Jump to content

Yahoo spigot problem


jbbj
 Share

Recommended Posts

Hi, I just got this thing recently when I open Chrome my default is google but a second tab opens with a yahoo search engine.  I did a quick scan using your anti-malware and was able to delete 1 detection but the problem persists.  Thanks for your time.

-Josh

 

Link to post
Share on other sites

  • Root Admin

Hello and :welcome:

If you've not already done so please start here and post back the 2 log files DDS.txt and Attach.txt

P2P/Piracy Warning:
 

 
If you're using
Peer 2 Peer
software such as
uTorrent, BitTorrent
or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have
illegal/cracked software, cracks, keygens etc
. on the system, please remove or uninstall them now and read the policy on
Piracy
.




Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.
  • Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
  • If the log is too large then you can use attachments by clicking on the More Reply Options button.
  • Please enable your system to show hidden files: How to see hidden files in Windows
  • Make sure you're subscribed to this topic:
    • Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

    [*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)




STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.


Link 2

  • On Windows XP double-click on the Rkill desktop icon to run the tool.
  • On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.
  • Do not reboot the computer, you will need to run the application again.



STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

  • Please download ERUNT from one of the following links: Link1 | Link2 | Link3
  • ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  • Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  • NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
  • Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  • Choose a location for the backup.
    • Note: the default location is C:\Windows\ERDNT which is acceptable.

    [*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe


STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

  • RogueKiller 32-bit | RogueKiller 64-bit
  • Quit all running programs.
  • For Windows XP, double-click to start.
  • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
  • Read and accept the EULA (End User Licene Agreement)
  • Click Scan to scan the system.
  • When the scan completes Close the program > Don't Fix anything!
  • Don't run any other options, they're not all bad!!
  • Post back the report which should be located on your desktop.


 

Link to post
Share on other sites

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 10.0.9200.16736  BrowserJavaVersion: 10.45.2

Run by Josh at 21:10:13 on 2013-12-10

Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.3327.1776 [GMT -8:00]

.

AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\Wacom_Tablet.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\SearchIndexer.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Users\Josh\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe

C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinService.exe

C:\Windows\system32\WTablet\Wacom_TabletUser.exe

C:\Windows\system32\Wacom_Tablet.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.


mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

uRun: [spotify Web Helper] "C:\Users\Josh\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [20131121] C:\Program Files\AVAST Software\Avast\setup\emupdate\d1bc4e1d-732f-419c-a92e-1e7cd779e8e3.exe /check

mRun: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui

dRunOnce: [sPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{1DD0E257-A9DD-4A48-8085-7C22E0886B44} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{30F08EBF-7E7B-44C5-AE1E-68DF1A383257} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{3E8878E5-BD1D-47C4-B1FB-E2D5D22F1028} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{9E249D4D-C5DB-4A1B-9C4B-45C73782B02D} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{B503BA3A-94A5-4CFC-8386-A70D15ED16F0} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"

x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2013-4-17 65776]

R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2013-4-17 205320]

R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-4-17 1032416]

R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-4-17 409832]

R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-4-17 38984]

R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-4-17 84328]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-12-8 50344]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-12-8 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-12-8 701512]

R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-2 1370912]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-8-30 15128352]

R2 TabletServiceWacom;TabletServiceWacom;C:\Windows\System32\Wacom_Tablet.exe [2013-8-17 1908520]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-12-8 25928]

R3 netr7364;RT73 USB Wireless LAN Card Driver for Vista;C:\Windows\System32\drivers\netr7364.sys [2009-6-10 707072]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2013-12-2 39200]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-4-17 236544]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-5-20 59392]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-4-18 1255736]

S4 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]

S4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-11-11 414496]

.

=============== Created Last 30 ================

.

2013-12-08 21:49:41 -------- d-----w- C:\Users\Josh\AppData\Roaming\AVAST Software

2013-12-08 19:41:46 -------- d-----w- C:\Users\Josh\AppData\Roaming\Malwarebytes

2013-12-08 19:41:37 -------- d-----w- C:\ProgramData\Malwarebytes

2013-12-08 19:41:36 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-12-08 19:41:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-08 19:40:47 10280728 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{89E2683C-1D38-42ED-A620-38AE73A1A732}\mpengine.dll

2013-12-08 19:09:14 -------- d-----w- C:\Users\Josh\AppData\Local\Razer

2013-12-07 12:18:34 -------- d-----w- C:\Users\Josh\AppData\Local\parasite_in_city

2013-12-07 12:09:20 -------- d-----w- C:\Users\Josh\AppData\Roaming\uTorrent

2013-12-03 07:05:36 39200 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys

2013-12-03 07:05:36 32544 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll

2013-11-18 18:44:43 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-11-18 18:31:46 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2013-11-18 18:28:05 461312 ----a-w- C:\Windows\System32\scavengeui.dll

2013-11-13 07:25:50 -------- d-----w- C:\Users\Josh\AppData\Local\NVIDIA Corporation

2013-11-11 16:59:28 590112 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

.

==================== Find3M  ====================

.

2013-12-08 20:07:28 92544 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys

2013-12-08 20:07:28 84328 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

2013-12-08 20:07:28 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys

2013-12-08 20:07:28 43152 ----a-w- C:\Windows\avastSS.scr

2013-12-08 20:07:28 205320 ----a-w- C:\Windows\System32\drivers\aswVmm.sys

2013-12-08 20:07:28 1032416 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

2013-11-29 16:56:58 1096480 ----a-w- C:\Windows\System32\nvspcap64.dll

2013-11-29 16:56:57 979744 ----a-w- C:\Windows\SysWow64\nvspcap.dll

2013-11-11 15:02:02 6674208 ----a-w- C:\Windows\System32\nvcpl.dll

2013-11-11 15:02:02 3490080 ----a-w- C:\Windows\System32\nvsvc64.dll

2013-11-11 15:01:59 922912 ----a-w- C:\Windows\System32\nvvsvc.exe

2013-11-11 15:01:59 63776 ----a-w- C:\Windows\System32\nvshext.dll

2013-11-11 15:01:59 219424 ----a-w- C:\Windows\System32\nvmctray.dll

2013-11-11 15:01:58 3467927 ----a-w- C:\Windows\System32\nvcoproc.bin

2013-11-11 13:50:16 267936 ----a-w- C:\Windows\System32\MpSigStub.exe

2013-10-30 17:02:58 35104 ----a-w- C:\Windows\System32\nvaudcap64v.dll

2013-10-30 04:58:58 298584 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2013-10-30 04:58:58 298584 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2013-10-28 03:34:44 298584 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2013-10-27 05:32:51 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2013-10-26 00:26:40 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-10-23 10:30:23 1884448 ----a-w- C:\Windows\System32\nvdispco6433165.dll

2013-10-23 10:30:23 1511712 ----a-w- C:\Windows\System32\nvdispgenco6433165.dll

2013-10-16 00:48:05 1884448 ----a-w- C:\Windows\System32\nvdispco6433158.dll

2013-10-16 00:48:05 1511712 ----a-w- C:\Windows\System32\nvdispgenco6433158.dll

2013-10-12 08:45:20 2241536 ----a-w- C:\Windows\System32\wininet.dll

2013-10-12 08:43:37 3959808 ----a-w- C:\Windows\System32\jscript9.dll

2013-10-12 08:43:32 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-10-12 08:43:32 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-10-12 07:03:50 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-10-12 07:02:33 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-10-12 07:02:29 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-10-12 07:02:29 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-10-12 06:35:26 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-10-12 05:44:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-10-12 05:15:39 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-10-12 02:30:42 830464 ----a-w- C:\Windows\System32\nshwfp.dll

2013-10-12 02:29:21 859648 ----a-w- C:\Windows\System32\IKEEXT.DLL

2013-10-12 02:29:08 324096 ----a-w- C:\Windows\System32\FWPUCLNT.DLL

2013-10-12 02:03:08 656896 ----a-w- C:\Windows\SysWow64\nshwfp.dll

2013-10-12 02:01:25 216576 ----a-w- C:\Windows\SysWow64\FWPUCLNT.DLL

2013-10-05 20:25:35 1474048 ----a-w- C:\Windows\System32\crypt32.dll

2013-10-05 19:57:25 1168384 ----a-w- C:\Windows\SysWow64\crypt32.dll

2013-10-04 02:28:31 190464 ----a-w- C:\Windows\System32\SmartcardCredentialProvider.dll

2013-10-04 02:25:17 197120 ----a-w- C:\Windows\System32\credui.dll

2013-10-04 02:24:49 1930752 ----a-w- C:\Windows\System32\authui.dll

2013-10-04 01:58:50 152576 ----a-w- C:\Windows\SysWow64\SmartcardCredentialProvider.dll

2013-10-04 01:56:25 168960 ----a-w- C:\Windows\SysWow64\credui.dll

2013-10-04 01:56:00 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

2013-10-03 02:23:48 404480 ----a-w- C:\Windows\System32\gdi32.dll

2013-10-03 02:00:44 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll

2013-09-28 01:09:10 497152 ----a-w- C:\Windows\System32\drivers\afd.sys

2013-09-25 02:26:40 154560 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2013-09-25 02:23:33 28672 ----a-w- C:\Windows\System32\sspisrv.dll

2013-09-25 02:23:33 135680 ----a-w- C:\Windows\System32\sspicli.dll

2013-09-25 02:23:01 28160 ----a-w- C:\Windows\System32\secur32.dll

2013-09-25 02:22:59 340992 ----a-w- C:\Windows\System32\schannel.dll

2013-09-25 02:21:50 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2013-09-25 02:21:07 1447936 ----a-w- C:\Windows\System32\lsasrv.dll

2013-09-25 01:58:17 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2013-09-25 01:57:26 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2013-09-25 01:57:24 247808 ----a-w- C:\Windows\SysWow64\schannel.dll

2013-09-25 01:56:42 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2013-09-25 01:03:24 30720 ----a-w- C:\Windows\System32\lsass.exe

2013-09-12 08:58:10 1884448 ----a-w- C:\Windows\System32\nvdispco6432723.dll

2013-09-12 08:58:10 1511712 ----a-w- C:\Windows\System32\nvdispgenco6432723.dll

.

============= FINISH: 21:10:42.68 ===============

 


.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional 

Boot Device: \Device\HarddiskVolume1

Install Date: 4/17/2013 3:24:34 AM

System Uptime: 12/10/2013 8:59:01 PM (1 hours ago)

.

Motherboard: ASRock |  | G31M-GS.  

Processor: Intel® Core2 Duo CPU     E6850  @ 3.00GHz | CPUSocket | 2992/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 931 GiB total, 782.199 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {745a17a0-74d3-11d0-b6fe-00a0c90f57da}

Description: Wacom Virtual Hid Driver

Device ID: ROOT\HIDCLASS\0000

Manufacturer: Wacom

Name: Wacom Virtual Hid Driver

PNP Device ID: ROOT\HIDCLASS\0000

Service: wacomvhid

.

==== System Restore Points ===================

.

RP76: 12/3/2013 7:35:20 PM - Scheduled Checkpoint

RP77: 12/5/2013 8:01:17 AM - Windows Update

RP78: 12/8/2013 12:12:19 AM - Razer Drivers Install

RP79: 12/8/2013 11:35:24 AM - Restore Operation

RP80: 12/8/2013 12:01:23 PM - avast! antivirus system restore point

.

==== Installed Programs ======================

.

??????? 2.7

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.0

avast! Free Antivirus

BioShock

Compact Wireless-G USB Adapter

Counter-Strike: Global Offensive

Diablo II

GeForce Experience NvStream Client Components

Ghost Recon Online (NCSA-Live)

Google Chrome

Google Talk (remove only)

Google Update Helper

Java 7 Update 45

Java Auto Updater

League of Legends

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

NVIDIA 3D Vision Controller Driver 331.82

NVIDIA Control Panel 331.82

NVIDIA GeForce Experience 1.8

NVIDIA Graphics Driver 331.82

NVIDIA HD Audio Driver 1.3.26.4

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA Network Service

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.0725

NVIDIA ShadowPlay 10.10.5

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 10.10.5

NVIDIA Update Core

NVIDIA Virtual Audio 1.2.12

PaintTool SAI Ver.1

Pando Media Booster

PunkBuster Services

RaidCall

Realtek Ethernet Controller  Driver

Realtek High Definition Audio Driver

S.T.A.L.K.E.R.: Call of Pripyat

S.T.A.L.K.E.R.: Shadow of Chernobyl

Sanctum

Sanctum 2

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)

SHIELD Streaming

Skype™ 6.3

Spotify

Stalker Complete 2009 v1.4.4

Steam

Super Sanctum TD

Tencent QQ

Unity Web Player

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3)

Ventrilo Client for Windows x64

Wacom Tablet

Warhammer 40,000 Space Marine

Warhammer 40,000: Dawn of War - Game of the Year Edition

Warhammer 40,000: Dawn of War – Dark Crusade

Warhammer 40,000: Dawn of War – Soulstorm

Warhammer 40,000: Dawn of War – Winter Assault

World of Warcraft

.

==== Event Viewer Messages From Past Week ========

.

12/8/2013 12:07:30 PM, Error: Service Control Manager [7030]  - The avast! Antivirus service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

12/8/2013 1:54:24 PM, Error: Service Control Manager [7009]  - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

12/8/2013 1:54:24 PM, Error: Service Control Manager [7000]  - The Steam Client Service service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.

12/3/2013 6:26:20 PM, Error: nvlddmkm [14]  - 

12/10/2013 8:59:08 PM, Error: Microsoft-Windows-Kernel-Processor-Power [6]  - Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

.

==== End Of File ===========================

 

Link to post
Share on other sites

  • Root Admin

Please temporarily disable your antivirus software and run through the following steps.

 

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.
  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus



STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.


Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.


STEP 06
button_eos.gif

Please go here to run the online antivirus scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

    [*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.



STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.


 

Link to post
Share on other sites

RogueKiller V8.7.11 _x64_ [Nov 25 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com




 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Josh [Admin rights]

Mode : Scan -- Date : 12/10/2013 21:33:58

| ARK || FAK || MBR |

 

¤¤¤ Bad processes : 0 ¤¤¤

 

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

 

¤¤¤ Scheduled tasks : 0 ¤¤¤

 

¤¤¤ Startup Entries : 0 ¤¤¤

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ Particular Files / Folders: ¤¤¤

 

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

 

¤¤¤ External Hives: ¤¤¤

 

¤¤¤ Infection :  ¤¤¤

 

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

 

 

 

 

¤¤¤ MBR Check: ¤¤¤

 

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD1002FAEX-00Z3A0 ATA Device +++++

--- User ---

[MBR] 46bc759c59a84d91c3184ca2703c3e07

[bSP] f2f043ca5b94130979182c4a764e6ba1 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 Mo

User = LL1 ... OK!

User = LL2 ... OK!

 

Finished : << RKreport[0]_S_12102013_213358.txt >>
Link to post
Share on other sites

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

www.malwarebytes.org

 

Database version: v2013.12.11.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16736

Josh :: TIBURON [administrator]

 

12/10/2013 9:38:15 PM

mbar-log-2013-12-10 (21-38-15).txt

 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: 

Objects scanned: 223175

Time elapsed: 8 minute(s), 9 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

Physical Sectors Detected: 0

(No malicious items detected)

 

(end)

 


---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

 

© Malwarebytes Corporation 2011-2012

 

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

 

Account is Administrative

 

Internet Explorer version: 10.0.9200.16736

 

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 2.992000 GHz

Memory total: 3488931840, free: 1825611776

 

Downloaded database version: v2013.12.11.01

Downloaded database version: v2013.10.11.02

Initializing...

======================

------------ Kernel report ------------

     12/10/2013 21:38:11

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\intelide.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\vmbus.sys

\SystemRoot\system32\drivers\winhv.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\System32\Drivers\aswVmm.sys

\SystemRoot\System32\Drivers\aswRvrt.sys

\SystemRoot\system32\drivers\cdrom.sys

\??\C:\Windows\system32\drivers\aswSnx.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\??\C:\Windows\system32\drivers\aswTdi.sys

\SystemRoot\system32\drivers\afd.sys

\??\C:\Windows\system32\drivers\aswRdr2.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\??\C:\Windows\system32\drivers\aswSP.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\drivers\HDAudBus.sys

\SystemRoot\system32\DRIVERS\Rt64win7.sys

\SystemRoot\system32\drivers\usbuhci.sys

\SystemRoot\system32\drivers\USBPORT.SYS

\SystemRoot\system32\drivers\usbehci.sys

\SystemRoot\system32\DRIVERS\parport.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\WacomVKHid.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\drivers\nvvad64v.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\DRIVERS\netr7364.sys

\SystemRoot\system32\DRIVERS\vwifibus.sys

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\aswMonFlt.sys

\??\C:\Windows\system32\drivers\mbam.sys

\??\C:\Windows\system32\drivers\aswFsBlk.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\System32\Drivers\fastfat.SYS

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\setupapi.dll

\Windows\System32\Wldap32.dll

\Windows\System32\usp10.dll

\Windows\System32\psapi.dll

\Windows\System32\urlmon.dll

\Windows\System32\iertutil.dll

\Windows\System32\normaliz.dll

\Windows\System32\ws2_32.dll

\Windows\System32\nsi.dll

\Windows\System32\wininet.dll

\Windows\System32\shlwapi.dll

\Windows\System32\gdi32.dll

\Windows\System32\imm32.dll

\Windows\System32\imagehlp.dll

\Windows\System32\comdlg32.dll

\Windows\System32\shell32.dll

\Windows\System32\advapi32.dll

\Windows\System32\oleaut32.dll

\Windows\System32\rpcrt4.dll

\Windows\System32\clbcatq.dll

\Windows\System32\user32.dll

\Windows\System32\sechost.dll

\Windows\System32\msctf.dll

\Windows\System32\difxapi.dll

\Windows\System32\kernel32.dll

\Windows\System32\ole32.dll

\Windows\System32\msvcrt.dll

\Windows\System32\lpk.dll

\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

\Windows\System32\crypt32.dll

\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

\Windows\System32\comctl32.dll

\Windows\System32\cfgmgr32.dll

\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

\Windows\System32\wintrust.dll

\Windows\System32\devobj.dll

\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

\Windows\System32\KernelBase.dll

\Windows\System32\msasn1.dll

\Windows\SysWOW64\normaliz.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa8003709060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\

Lower Device Object: 0xfffffa8003286680

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa8003709060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa8003709ab0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa8003709060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800328a520, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xfffffa8003286680, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 96D17518

 

Partition information:

 

    Partition 0 type is Primary (0x7)

    Partition is ACTIVE.

    Partition starts at LBA: 2048  Numsec = 204800

    Partition file system is NTFS

    Partition is bootable

 

    Partition 1 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 206848  Numsec = 1953314816

 

    Partition 2 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0

 

    Partition 3 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0

 

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

 

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...

Done!

Scan finished

=======================================

 

 

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_2048_i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...

Removal finished

 

Link to post
Share on other sites

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Professional x64

Ran by Josh on Tue 12/10/2013 at 21:48:18.15

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_for_painttool-sai_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_for_painttool-sai_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_painttool-sai_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_painttool-sai_RASMANCS

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] "C:\Users\Josh\AppData\Roaming\tencent"

Successfully deleted: [Folder] "C:\Program Files (x86)\tencent"

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

 

 

 

~~~ Event Viewer Logs were cleared

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Tue 12/10/2013 at 21:56:09.99

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Link to post
Share on other sites

# AdwCleaner v3.015 - Report created 10/12/2013 at 22:01:08

# Updated 10/12/2013 by Xplode

# Operating System : Windows 7 Professional Service Pack 1 (64 bits)

# Username : Josh - TIBURON

# Running from : C:\Users\Josh\Downloads\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Program Files (x86)\Common Files\Tencent

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKCU\Software\TENCENT

Key Deleted : HKLM\Software\TENCENT

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v10.0.9200.16736

 

 

-\\ Google Chrome v31.0.1650.63

 

[ File : C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [927 octets] - [10/12/2013 21:58:10]

AdwCleaner[s0].txt - [816 octets] - [10/12/2013 22:01:08]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [875 octets] ##########
Link to post
Share on other sites

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

 

Database version: v2013.12.11.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16736

Josh :: TIBURON [administrator]

 

Protection: Enabled

 

12/10/2013 10:06:15 PM

mbam-log-2013-12-10 (22-06-15).txt

 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 212103

Time elapsed: 3 minute(s), 38 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 0

(No malicious items detected)

 

(end)
Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2013 01

Ran by Josh (administrator) on TIBURON on 10-12-2013 23:32:39

Running from C:\Users\Josh\Downloads

Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

 

==================== Processes (Whitelisted) =================

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Wacom Technology, Corp.) C:\Windows\System32\Wacom_Tablet.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe

(Wacom Technology, Corp.) C:\Windows\System32\WTablet\Wacom_TabletUser.exe

() C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinService.exe

(Wacom Technology, Corp.) C:\Windows\System32\Wacom_Tablet.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Spotify Ltd) C:\Users\Josh\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028384 2013-11-08] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] - C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)

HKCU\...\Run: [spotify Web Helper] - C:\Users\Josh\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-10-16] (Spotify Ltd)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [37296 2012-01-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [20131121] - C:\Program Files\AVAST Software\Avast\Setup\emupdate\d1bc4e1d-732f-419c-a92e-1e7cd779e8e3.exe [180184 2013-11-23] (AVAST Software)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-12-08] (AVAST Software)

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?client=aff-ime

BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

 

Chrome: 

=======



CHR DefaultSearchKeyword: google.com

CHR DefaultSearchProvider: Google

CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Extension: (Google Docs) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (WOT) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\2.4.4_0

CHR Extension: (YouTube) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Adblock Plus) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0

CHR Extension: (Google Search) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\Users\Josh\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

 

==================== Services (Whitelisted) =================

 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-08] (AVAST Software)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15128352 2013-11-29] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-10-26] ()

R2 TabletServiceWacom; C:\Windows\system32\Wacom_Tablet.exe [1908520 2007-09-07] (Wacom Technology, Corp.)

 

==================== Drivers (Whitelisted) ====================

 

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-12-08] (AVAST Software)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-12-08] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-08] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-08] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-12-08] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-12-08] (AVAST Software)

R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-12-08] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-12-08] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-10-30] (NVIDIA Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-12-10 23:32 - 2013-12-10 23:32 - 01928212 _____ (Farbar) C:\Users\Josh\Downloads\FRST64.exe

2013-12-10 23:32 - 2013-12-10 23:32 - 00009880 _____ C:\Users\Josh\Downloads\FRST.txt

2013-12-10 23:32 - 2013-12-10 23:32 - 00000000 ____D C:\FRST

2013-12-10 23:31 - 2013-12-10 23:31 - 00000100 _____ C:\Users\Josh\Desktop\ESET.txt

2013-12-10 22:17 - 2013-12-10 22:17 - 00000000 ____D C:\Program Files (x86)\ESET

2013-12-10 22:16 - 2013-12-10 22:16 - 02347384 _____ (ESET) C:\Users\Josh\Downloads\esetsmartinstaller_enu.exe

2013-12-10 22:10 - 2013-12-10 22:10 - 01682336 _____ (ESET) C:\Users\Josh\Downloads\eset_nod32_antivirus_live_installer.exe

2013-12-10 21:57 - 2013-12-10 22:01 - 00000000 ____D C:\AdwCleaner

2013-12-10 21:57 - 2013-12-10 21:57 - 01226802 _____ C:\Users\Josh\Downloads\AdwCleaner.exe

2013-12-10 21:56 - 2013-12-10 21:56 - 00001459 _____ C:\Users\Josh\Desktop\JRT.txt

2013-12-10 21:48 - 2013-12-10 21:48 - 00000000 ____D C:\Windows\ERUNT

2013-12-10 21:47 - 2013-12-10 21:47 - 01034531 _____ (Thisisu) C:\Users\Josh\Downloads\JRT.exe

2013-12-10 21:38 - 2013-12-10 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-12-10 21:37 - 2013-12-10 22:04 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-12-10 21:37 - 2013-12-10 22:04 - 00000000 ____D C:\Users\Josh\Desktop\mbar

2013-12-10 21:36 - 2013-12-10 21:36 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Josh\Downloads\mbar-1.07.0.1008.exe

2013-12-10 21:33 - 2013-12-10 21:33 - 00001595 _____ C:\Users\Josh\Desktop\RKreport[0]_S_12102013_213358.txt

2013-12-10 21:30 - 2013-12-10 21:33 - 00000000 ____D C:\Users\Josh\Desktop\RK_Quarantine

2013-12-10 21:30 - 2013-12-10 21:30 - 04166144 _____ C:\Users\Josh\Downloads\RogueKillerX64.exe

2013-12-10 21:29 - 2013-12-10 21:29 - 00000000 ____D C:\Windows\ERDNT

2013-12-10 21:28 - 2013-12-10 21:28 - 00000928 _____ C:\Users\Josh\Desktop\NTREGOPT.lnk

2013-12-10 21:28 - 2013-12-10 21:28 - 00000909 _____ C:\Users\Josh\Desktop\ERUNT.lnk

2013-12-10 21:28 - 2013-12-10 21:28 - 00000000 ____D C:\Program Files (x86)\ERUNT

2013-12-10 21:26 - 2013-12-10 21:26 - 00791393 _____ (Lars Hederer                                                ) C:\Users\Josh\Downloads\erunt-setup.exe

2013-12-10 21:24 - 2013-12-10 21:25 - 00002278 _____ C:\Users\Josh\Desktop\Rkill.txt

2013-12-10 21:24 - 2013-12-10 21:24 - 00000000 ____D C:\Users\Josh\Desktop\rkill

2013-12-10 21:16 - 2013-12-10 21:17 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Josh\Downloads\rkill.exe

2013-12-10 21:10 - 2013-12-10 21:10 - 00015383 _____ C:\Users\Josh\Desktop\dds.txt

2013-12-10 21:10 - 2013-12-10 21:10 - 00005852 _____ C:\Users\Josh\Desktop\attach.txt

2013-12-08 13:49 - 2013-12-08 13:49 - 00000000 ____D C:\Users\Josh\AppData\Roaming\AVAST Software

2013-12-08 11:58 - 2013-12-08 11:58 - 00688992 ____R (Swearware) C:\Users\Josh\Downloads\dds.scr

2013-12-08 11:41 - 2013-12-08 11:41 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Malwarebytes

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-08 11:41 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-12-08 11:40 - 2013-12-08 11:41 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Josh\Downloads\mbam-setup-1.75.0.1300.exe

2013-12-08 11:12 - 2013-12-08 11:12 - 00034816 _____ C:\Users\Josh\AppData\Roaming\RZR_002068354c7682f80fe0a1548e41.db

2013-12-08 11:09 - 2013-12-08 11:09 - 00000000 ____D C:\Users\Josh\AppData\Local\Razer

2013-12-08 00:12 - 2013-12-08 00:12 - 00000000 ____D C:\ProgramData\Razer

2013-12-08 00:12 - 2013-12-08 00:12 - 00000000 ____D C:\Program Files (x86)\Razer

2013-12-07 04:18 - 2013-12-08 11:37 - 00000000 ____D C:\Users\Josh\AppData\Local\parasite_in_city

2013-12-07 04:17 - 2013-12-07 04:17 - 00000000 ____D C:\Users\Josh\AppData\Roaming\WinRAR

2013-12-07 04:16 - 2013-12-08 11:37 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2013-12-07 04:16 - 2013-12-08 11:37 - 00000000 ____D C:\Program Files\WinRAR

2013-12-07 04:16 - 2013-12-07 04:16 - 01977432 _____ C:\Users\Josh\Downloads\winrar-x64-501.exe

2013-12-07 04:09 - 2013-12-08 11:37 - 00000000 ____D C:\Users\Josh\AppData\Roaming\uTorrent

2013-12-07 02:16 - 2013-12-08 12:12 - 00000000 ____D C:\Users\Josh\Desktop\New folder

2013-12-04 00:34 - 2013-12-04 00:34 - 38363066 _____ C:\Users\Josh\Downloads\josh_benz_-_4b5tr4ct_1280x720.mp4

2013-12-02 23:05 - 2013-10-30 09:03 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2013-12-02 23:05 - 2013-10-30 09:02 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2013-11-27 00:09 - 2013-11-27 00:09 - 00262144 ____N C:\Windows\Minidump\112713-14843-01.dmp

2013-11-23 01:48 - 2013-11-23 01:48 - 00000394 __RSH C:\Users\Josh\ntuser.pol

2013-11-20 20:29 - 2013-11-14 03:55 - 30361888 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 22951200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 18208624 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 15862272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 12613408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2013-11-20 20:29 - 2013-11-14 03:55 - 11600432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 11514624 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 09691888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 09619872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433182.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433182.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00707360 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00657184 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00609568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00562464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2013-11-20 20:29 - 2013-11-14 03:55 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2013-11-18 10:44 - 2013-10-12 00:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-11-18 10:44 - 2013-10-12 00:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-11-18 10:44 - 2013-10-12 00:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-11-18 10:44 - 2013-10-12 00:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-11-18 10:44 - 2013-10-12 00:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-11-18 10:44 - 2013-10-11 23:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-11-18 10:44 - 2013-10-11 23:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-11-18 10:44 - 2013-10-11 23:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-11-18 10:44 - 2013-10-11 22:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-11-18 10:44 - 2013-10-11 22:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-11-18 10:44 - 2013-10-11 21:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-11-18 10:44 - 2013-10-11 21:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-11-18 10:31 - 2013-10-11 18:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2013-11-18 10:31 - 2013-10-11 18:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2013-11-18 10:31 - 2013-10-11 18:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2013-11-18 10:31 - 2013-10-11 18:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2013-11-18 10:31 - 2013-10-11 18:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2013-11-18 10:31 - 2013-10-05 12:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-11-18 10:31 - 2013-10-05 11:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-11-18 10:31 - 2013-10-03 18:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll

2013-11-18 10:31 - 2013-10-03 18:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll

2013-11-18 10:31 - 2013-10-03 18:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2013-11-18 10:31 - 2013-10-03 17:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-18 10:31 - 2013-10-03 17:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2013-11-18 10:31 - 2013-10-03 17:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll

2013-11-18 10:31 - 2013-10-02 18:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2013-11-18 10:31 - 2013-10-02 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2013-11-18 10:31 - 2013-09-27 17:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-11-18 10:31 - 2013-09-24 18:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2013-11-18 10:31 - 2013-09-24 18:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2013-11-18 10:31 - 2013-09-24 18:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2013-11-18 10:31 - 2013-09-24 18:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2013-11-18 10:31 - 2013-09-24 18:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2013-11-18 10:31 - 2013-09-24 18:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2013-11-18 10:31 - 2013-09-24 18:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2013-11-18 10:31 - 2013-09-24 18:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2013-11-18 10:31 - 2013-09-24 17:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2013-11-18 10:31 - 2013-09-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2013-11-18 10:31 - 2013-09-24 17:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2013-11-18 10:31 - 2013-09-24 17:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2013-11-18 10:31 - 2013-09-24 17:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2013-11-18 10:31 - 2013-09-07 18:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-11-18 10:31 - 2013-09-07 18:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll

2013-11-18 10:31 - 2013-09-07 18:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll

2013-11-18 10:31 - 2013-08-28 18:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-11-18 10:31 - 2013-08-28 18:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-11-18 10:31 - 2013-08-28 18:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2013-11-18 10:31 - 2013-08-28 18:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-11-18 10:31 - 2013-08-28 18:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2013-11-18 10:31 - 2013-08-28 17:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-11-18 10:31 - 2013-08-28 17:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-11-18 10:31 - 2013-08-28 17:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-11-18 10:31 - 2013-08-28 17:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll

2013-11-18 10:31 - 2013-08-28 17:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-11-18 10:31 - 2013-08-28 17:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2013-11-18 10:31 - 2013-08-28 16:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-11-18 10:31 - 2013-08-28 16:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-11-18 10:31 - 2013-08-28 16:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-11-18 10:31 - 2013-08-28 16:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-11-18 10:31 - 2013-08-27 17:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-11-18 10:31 - 2013-08-01 04:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-11-18 10:31 - 2013-07-20 02:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-11-18 10:31 - 2013-07-20 02:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2013-11-18 10:31 - 2013-07-12 02:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2013-11-18 10:31 - 2013-07-04 04:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2013-11-18 10:31 - 2013-07-04 04:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2013-11-18 10:31 - 2013-07-04 04:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2013-11-18 10:31 - 2013-07-04 04:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2013-11-18 10:31 - 2013-07-04 03:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll

2013-11-18 10:31 - 2013-07-04 03:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll

2013-11-18 10:31 - 2013-07-04 03:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

2013-11-18 10:31 - 2013-07-04 02:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2013-11-18 10:31 - 2013-07-02 20:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2013-11-18 10:31 - 2013-07-02 20:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2013-11-18 10:31 - 2013-06-25 14:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

2013-11-18 10:31 - 2013-06-05 21:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2013-11-18 10:31 - 2013-06-05 21:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2013-11-18 10:31 - 2013-06-05 21:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2013-11-18 10:31 - 2013-06-05 21:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2013-11-18 10:31 - 2013-06-05 20:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2013-11-18 10:31 - 2013-06-05 20:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2013-11-18 10:31 - 2013-06-05 20:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2013-11-18 10:31 - 2013-06-05 19:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2013-11-18 10:31 - 2013-06-05 19:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2013-11-18 10:31 - 2013-06-05 19:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2013-11-18 10:28 - 2013-08-27 17:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll

2013-11-18 10:24 - 2013-11-18 10:24 - 00262144 ____N C:\Windows\Minidump\111813-17718-01.dmp

2013-11-16 11:28 - 2013-12-08 09:02 - 00000000 ____D C:\Users\Josh\Desktop\my art

2013-11-12 23:25 - 2013-12-02 23:07 - 00000000 ____D C:\Users\Josh\AppData\Local\NVIDIA Corporation

2013-11-11 08:59 - 2013-11-11 08:59 - 00590112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

 

==================== One Month Modified Files and Folders =======

 

2013-12-10 23:32 - 2013-12-10 23:32 - 01928212 _____ (Farbar) C:\Users\Josh\Downloads\FRST64.exe

2013-12-10 23:32 - 2013-12-10 23:32 - 00009880 _____ C:\Users\Josh\Downloads\FRST.txt

2013-12-10 23:32 - 2013-12-10 23:32 - 00000000 ____D C:\FRST

2013-12-10 23:31 - 2013-12-10 23:31 - 00000100 _____ C:\Users\Josh\Desktop\ESET.txt

2013-12-10 22:58 - 2013-04-17 02:26 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-10 22:17 - 2013-12-10 22:17 - 00000000 ____D C:\Program Files (x86)\ESET

2013-12-10 22:16 - 2013-12-10 22:16 - 02347384 _____ (ESET) C:\Users\Josh\Downloads\esetsmartinstaller_enu.exe

2013-12-10 22:10 - 2013-12-10 22:10 - 01682336 _____ (ESET) C:\Users\Josh\Downloads\eset_nod32_antivirus_live_installer.exe

2013-12-10 22:09 - 2009-07-13 20:45 - 00015360 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-12-10 22:09 - 2009-07-13 20:45 - 00015360 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-12-10 22:08 - 2009-07-13 21:13 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI

2013-12-10 22:05 - 2013-04-17 02:01 - 01394425 _____ C:\Windows\WindowsUpdate.log

2013-12-10 22:04 - 2013-12-10 21:37 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-12-10 22:04 - 2013-12-10 21:37 - 00000000 ____D C:\Users\Josh\Desktop\mbar

2013-12-10 22:02 - 2013-08-17 19:02 - 00000000 ____D C:\Users\Josh\AppData\Roaming\WTablet

2013-12-10 22:02 - 2013-04-17 02:26 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-10 22:02 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-12-10 22:02 - 2009-07-13 20:51 - 00066950 _____ C:\Windows\setupact.log

2013-12-10 22:01 - 2013-12-10 21:57 - 00000000 ____D C:\AdwCleaner

2013-12-10 21:57 - 2013-12-10 21:57 - 01226802 _____ C:\Users\Josh\Downloads\AdwCleaner.exe

2013-12-10 21:56 - 2013-12-10 21:56 - 00001459 _____ C:\Users\Josh\Desktop\JRT.txt

2013-12-10 21:48 - 2013-12-10 21:48 - 00000000 ____D C:\Windows\ERUNT

2013-12-10 21:47 - 2013-12-10 21:47 - 01034531 _____ (Thisisu) C:\Users\Josh\Downloads\JRT.exe

2013-12-10 21:46 - 2013-12-10 21:38 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-12-10 21:36 - 2013-12-10 21:36 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Josh\Downloads\mbar-1.07.0.1008.exe

2013-12-10 21:33 - 2013-12-10 21:33 - 00001595 _____ C:\Users\Josh\Desktop\RKreport[0]_S_12102013_213358.txt

2013-12-10 21:33 - 2013-12-10 21:30 - 00000000 ____D C:\Users\Josh\Desktop\RK_Quarantine

2013-12-10 21:30 - 2013-12-10 21:30 - 04166144 _____ C:\Users\Josh\Downloads\RogueKillerX64.exe

2013-12-10 21:29 - 2013-12-10 21:29 - 00000000 ____D C:\Windows\ERDNT

2013-12-10 21:28 - 2013-12-10 21:28 - 00000928 _____ C:\Users\Josh\Desktop\NTREGOPT.lnk

2013-12-10 21:28 - 2013-12-10 21:28 - 00000909 _____ C:\Users\Josh\Desktop\ERUNT.lnk

2013-12-10 21:28 - 2013-12-10 21:28 - 00000000 ____D C:\Program Files (x86)\ERUNT

2013-12-10 21:26 - 2013-12-10 21:26 - 00791393 _____ (Lars Hederer                                                ) C:\Users\Josh\Downloads\erunt-setup.exe

2013-12-10 21:25 - 2013-12-10 21:24 - 00002278 _____ C:\Users\Josh\Desktop\Rkill.txt

2013-12-10 21:24 - 2013-12-10 21:24 - 00000000 ____D C:\Users\Josh\Desktop\rkill

2013-12-10 21:21 - 2013-10-03 07:33 - 00000000 ____D C:\Users\Josh\Downloads\practice

2013-12-10 21:17 - 2013-12-10 21:16 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Josh\Downloads\rkill.exe

2013-12-10 21:10 - 2013-12-10 21:10 - 00015383 _____ C:\Users\Josh\Desktop\dds.txt

2013-12-10 21:10 - 2013-12-10 21:10 - 00005852 _____ C:\Users\Josh\Desktop\attach.txt

2013-12-10 00:11 - 2013-04-17 02:57 - 00000000 ____D C:\Users\Josh\AppData\Local\PMB Files

2013-12-10 00:11 - 2013-04-17 02:57 - 00000000 ____D C:\ProgramData\PMB Files

2013-12-10 00:10 - 2013-04-22 03:18 - 00000000 ____D C:\Program Files (x86)\Steam

2013-12-08 13:49 - 2013-12-08 13:49 - 00000000 ____D C:\Users\Josh\AppData\Roaming\AVAST Software

2013-12-08 13:48 - 2013-04-17 02:50 - 00039858 _____ C:\Windows\PFRO.log

2013-12-08 13:37 - 2013-04-17 02:35 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2013-12-08 12:12 - 2013-12-07 02:16 - 00000000 ____D C:\Users\Josh\Desktop\New folder

2013-12-08 12:07 - 2013-04-17 02:35 - 01032416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00409832 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2013-12-08 12:07 - 2013-04-17 02:35 - 00205320 _____ C:\Windows\system32\Drivers\aswVmm.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00084328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00065264 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys

2013-12-08 12:07 - 2013-04-17 02:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2013-12-08 12:07 - 2013-04-17 02:35 - 00038984 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys

2013-12-08 12:01 - 2013-04-17 02:34 - 00000000 ____D C:\ProgramData\AVAST Software

2013-12-08 12:00 - 2013-04-17 02:35 - 00000000 _____ C:\Windows\SysWOW64\config.nt

2013-12-08 11:58 - 2013-12-08 11:58 - 00688992 ____R (Swearware) C:\Users\Josh\Downloads\dds.scr

2013-12-08 11:53 - 2013-04-17 02:26 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-08 11:53 - 2013-04-17 02:26 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-12-08 11:41 - 2013-12-08 11:41 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Malwarebytes

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-12-08 11:41 - 2013-12-08 11:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-12-08 11:41 - 2013-12-08 11:40 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Josh\Downloads\mbam-setup-1.75.0.1300.exe

2013-12-08 11:38 - 2013-04-17 02:24 - 00000000 ____D C:\Users\Josh

2013-12-08 11:37 - 2013-12-07 04:18 - 00000000 ____D C:\Users\Josh\AppData\Local\parasite_in_city

2013-12-08 11:37 - 2013-12-07 04:16 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2013-12-08 11:37 - 2013-12-07 04:16 - 00000000 ____D C:\Program Files\WinRAR

2013-12-08 11:37 - 2013-12-07 04:09 - 00000000 ____D C:\Users\Josh\AppData\Roaming\uTorrent

2013-12-08 11:37 - 2013-04-17 02:57 - 00000000 ____D C:\Users\Josh\.swt

2013-12-08 11:37 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2013-12-08 11:36 - 2013-04-17 02:26 - 00000000 ____D C:\Users\Josh\AppData\Local\Google

2013-12-08 11:36 - 2013-04-17 02:25 - 00000000 ____D C:\Users\Josh\AppData\Local\Apps\2.0

2013-12-08 11:12 - 2013-12-08 11:12 - 00034816 _____ C:\Users\Josh\AppData\Roaming\RZR_002068354c7682f80fe0a1548e41.db

2013-12-08 11:09 - 2013-12-08 11:09 - 00000000 ____D C:\Users\Josh\AppData\Local\Razer

2013-12-08 11:09 - 2013-04-17 02:24 - 00000000 ____D C:\Users\Josh\AppData\Local\VirtualStore

2013-12-08 09:02 - 2013-11-16 11:28 - 00000000 ____D C:\Users\Josh\Desktop\my art

2013-12-08 00:12 - 2013-12-08 00:12 - 00000000 ____D C:\ProgramData\Razer

2013-12-08 00:12 - 2013-12-08 00:12 - 00000000 ____D C:\Program Files (x86)\Razer

2013-12-07 16:54 - 2013-09-16 02:02 - 00000000 ____D C:\Users\Josh\Desktop\snipers

2013-12-07 04:17 - 2013-12-07 04:17 - 00000000 ____D C:\Users\Josh\AppData\Roaming\WinRAR

2013-12-07 04:16 - 2013-12-07 04:16 - 01977432 _____ C:\Users\Josh\Downloads\winrar-x64-501.exe

2013-12-04 00:34 - 2013-12-04 00:34 - 38363066 _____ C:\Users\Josh\Downloads\josh_benz_-_4b5tr4ct_1280x720.mp4

2013-12-02 23:07 - 2013-11-12 23:25 - 00000000 ____D C:\Users\Josh\AppData\Local\NVIDIA Corporation

2013-12-02 23:07 - 2013-08-30 13:58 - 00000000 ____D C:\Users\Josh\AppData\Local\NVIDIA

2013-12-02 23:07 - 2013-04-17 02:39 - 00000000 ____D C:\ProgramData\NVIDIA

2013-12-02 23:07 - 2013-04-17 02:38 - 00000000 ____D C:\ProgramData\NVIDIA Corporation

2013-12-02 23:06 - 2013-04-17 02:38 - 00000000 ____D C:\Program Files\NVIDIA Corporation

2013-12-02 23:06 - 2013-04-17 02:38 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation

2013-12-01 20:48 - 2013-11-08 10:47 - 00000000 ____D C:\Users\Josh\Desktop\LA trip

2013-11-29 08:56 - 2013-10-29 00:38 - 01096480 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2013-11-29 08:56 - 2013-10-29 00:38 - 00979744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2013-11-28 12:52 - 2013-05-08 12:52 - 00000000 ____D C:\Users\Josh\Documents\Tencent Files

2013-11-27 00:09 - 2013-11-27 00:09 - 00262144 ____N C:\Windows\Minidump\112713-14843-01.dmp

2013-11-27 00:09 - 2013-08-25 01:17 - 00000000 ____D C:\Windows\Minidump

2013-11-23 01:48 - 2013-11-23 01:48 - 00000394 __RSH C:\Users\Josh\ntuser.pol

2013-11-23 01:47 - 2009-07-13 19:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy

2013-11-19 21:07 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-11-18 12:21 - 2009-07-13 20:45 - 00275712 _____ C:\Windows\system32\FNTCACHE.DAT

2013-11-18 10:42 - 2013-04-17 03:11 - 00772558 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-11-18 10:38 - 2013-08-14 22:49 - 00000000 ____D C:\Windows\system32\MRT

2013-11-18 10:24 - 2013-11-18 10:24 - 00262144 ____N C:\Windows\Minidump\111813-17718-01.dmp

2013-11-17 02:21 - 2013-04-17 02:54 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Skype

2013-11-16 11:31 - 2013-11-08 10:48 - 00000000 ____D C:\Users\Josh\Desktop\china and ari

2013-11-15 17:35 - 2013-05-21 04:00 - 00000000 ____D C:\Users\Josh\Downloads\mia sollis

2013-11-15 17:34 - 2013-05-16 10:10 - 00000000 ____D C:\Users\Josh\Downloads\emiru momose

2013-11-14 03:55 - 2013-11-20 20:29 - 30361888 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 25257248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 22951200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 18208624 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 15862272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 12613408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys

2013-11-14 03:55 - 2013-11-20 20:29 - 11600432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 11514624 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 09691888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 09619872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 03132704 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 03125024 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 02947872 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 02747680 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 01884448 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433182.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433182.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 01242400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00707360 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00657184 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00609568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00562464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00317472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00266984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00168616 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll

2013-11-14 03:55 - 2013-11-20 20:29 - 00141336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll

2013-11-14 03:55 - 2013-08-13 12:15 - 03069608 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll

2013-11-14 03:55 - 2013-08-13 12:15 - 01436528 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 18293608 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 15218504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 02697248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2013-11-14 03:55 - 2013-04-17 02:38 - 00023754 _____ C:\Windows\system32\nvinfo.pb

2013-11-11 08:59 - 2013-11-11 08:59 - 00590112 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe

2013-11-11 07:02 - 2013-04-17 02:39 - 06674208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll

2013-11-11 07:02 - 2013-04-17 02:39 - 03490080 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll

2013-11-11 07:01 - 2013-04-17 02:39 - 03467927 _____ C:\Windows\system32\nvcoproc.bin

2013-11-11 07:01 - 2013-04-17 02:39 - 00922912 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

2013-11-11 07:01 - 2013-04-17 02:39 - 00219424 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll

2013-11-11 07:01 - 2013-04-17 02:39 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll

2013-11-11 05:50 - 2013-04-17 02:41 - 00267936 _____ (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2013-11-11 03:49 - 2013-04-18 21:45 - 00000000 ____D C:\Users\Josh\AppData\Roaming\Spotify

2013-11-10 19:45 - 2013-04-18 21:46 - 00000000 ____D C:\Users\Josh\AppData\Local\Spotify

 

Some content of TEMP:

====================

C:\Users\Josh\AppData\Local\Temp\binkw32.dll

C:\Users\Josh\AppData\Local\Temp\d2l_Install.exe

C:\Users\Josh\AppData\Local\Temp\gtalkwmp1.dll

C:\Users\Josh\AppData\Local\Temp\ntdll_dump.dll

C:\Users\Josh\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Josh\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Josh\AppData\Local\Temp\nvSCPAPISvr.exe

C:\Users\Josh\AppData\Local\Temp\nvStInst.exe

C:\Users\Josh\AppData\Local\Temp\qqsafeud.exe

C:\Users\Josh\AppData\Local\Temp\Quarantine.exe

C:\Users\Josh\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Josh\AppData\Local\Temp\swt-win32-3740.dll

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

 

LastRegBack: 2013-12-01 01:31

 

==================== End Of Log ============================

 


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-12-2013 01

Ran by Josh at 2013-12-10 23:33:13

Running from C:\Users\Josh\Downloads

Boot Mode: Normal

==========================================================

 

 

==================== Security Center ========================

 

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

 

==================== Installed Programs ======================

 

Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.169)

Adobe Reader 9.5.0 (x32 Version: 9.5.0)

avast! Free Antivirus (x32 Version: 9.0.2008)

BioShock (x32)

Compact Wireless-G USB Adapter (x32)

Counter-Strike: Global Offensive (x32)

Diablo II (x32)

ERUNT 1.1j (x32)

ESET Online Scanner v3 (x32)

GeForce Experience NvStream Client Components (Version: 1.6.28)

Ghost Recon Online (NCSA-Live) (HKCU Version: 1.34.5072.1)

Google Chrome (x32 Version: 31.0.1650.63)

Google Talk (remove only) (HKCU)

Google Update Helper (x32 Version: 1.3.22.3)

Java 7 Update 45 (x32 Version: 7.0.450)

Java Auto Updater (x32 Version: 2.1.9.8)

League of Legends (x32 Version: 3.0.0)

Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

NVIDIA 3D Vision Controller Driver 331.82 (Version: 331.82)

NVIDIA Control Panel 331.82 (Version: 331.82)

NVIDIA GeForce Experience 1.8 (Version: 1.8)

NVIDIA Graphics Driver 331.82 (Version: 331.82)

NVIDIA HD Audio Driver 1.3.26.4 (Version: 1.3.26.4)

NVIDIA Install Application (Version: 2.1002.142.992)

NVIDIA LED Visualizer 1.0 (Version: 1.0)

NVIDIA Network Service (Version: 1.0)

NVIDIA PhysX (x32 Version: 9.13.0725)

NVIDIA PhysX System Software 9.13.0725 (Version: 9.13.0725)

NVIDIA ShadowPlay 10.10.5 (Version: 10.10.5)

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182)

NVIDIA Update 10.10.5 (Version: 10.10.5)

NVIDIA Update Core (Version: 10.10.5)

NVIDIA Virtual Audio 1.2.12 (Version: 1.2.12)

PaintTool SAI Ver.1 (x32)

Pando Media Booster (x32 Version: 2.6.0.9)

PunkBuster Services (x32 Version: 0.993)

RaidCall (x32 Version: 7.2.2-1.0.6555.3)

Realtek Ethernet Controller  Driver (x32 Version: 1.00.0008)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.5919)

S.T.A.L.K.E.R.: Call of Pripyat (x32)

S.T.A.L.K.E.R.: Shadow of Chernobyl (x32)

Sanctum (x32)

Sanctum 2 (x32)

SHIELD Streaming (Version: 1.6.75)

Skype™ 6.3 (x32 Version: 6.3.105)

Spotify (HKCU Version: 0.9.4.185.g7545a404)

Stalker Complete 2009 v1.4.4 (x32)

Steam (x32 Version: 1.0.0.0)

Super Sanctum TD (x32)

Tencent QQ (x32 Version: 1.75.2871.0)

Unity Web Player (HKCU Version: )

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)

Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)

Ventrilo Client for Windows x64 (Version: 3.0.8.0)

Wacom Tablet (x32)

Warhammer 40,000 Space Marine (x32)

Warhammer 40,000: Dawn of War – Dark Crusade (x32)

Warhammer 40,000: Dawn of War - Game of the Year Edition (x32)

Warhammer 40,000: Dawn of War – Soulstorm (x32)

Warhammer 40,000: Dawn of War – Winter Assault (x32)

World of Warcraft (x32 Version: 5.3.0.17128)

谷歌拼音输入法 2.7

 

==================== Restore Points  =========================

 

04-12-2013 03:35:20 Scheduled Checkpoint

05-12-2013 16:01:17 Windows Update

08-12-2013 08:12:19 Razer Drivers Install

08-12-2013 19:35:24 Restore Operation

08-12-2013 20:01:23 avast! antivirus system restore point

 

==================== Hosts content: ==========================

 

2009-07-13 18:34 - 2009-06-10 13:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

 

==================== Scheduled Tasks (whitelisted) =============

 

Task: {1F373F7C-E58D-4EAA-A6F4-9BA2D2557FEF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-17] (Google Inc.)

Task: {424F72B3-E277-44A3-A41A-C40680FADFC7} - System32\Tasks\Google Pinyin Daemon => C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe [2013-06-13] (Google Inc.)

Task: {45051D24-E680-4E20-B8A7-830767E1784D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-08] (AVAST Software)

Task: {4B4D1DDD-6068-4421-A2D2-5E931A021310} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-17] (Google Inc.)

Task: {FE76B77D-E24D-4900-8B4F-F85AAF26120D} - System32\Tasks\{E5A6BEE0-9712-4B23-B3B9-737AEDD7374F} => C:\Users\Public\Games\World of Warcraft\Launcher.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

==================== Loaded Modules (whitelisted) =============

 

2013-12-10 21:00 - 2013-12-10 13:40 - 02152448 _____ () C:\Program Files\AVAST Software\Avast\defs\13121001\algo.dll

2013-12-08 12:07 - 2013-12-08 12:07 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2013-12-08 21:00 - 2013-12-03 18:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll

2013-12-08 21:00 - 2013-12-03 18:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll

2013-12-08 21:00 - 2013-12-03 18:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll

2013-12-08 21:00 - 2013-12-03 18:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll

2013-12-08 21:00 - 2013-12-03 18:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll

 

==================== Alternate Data Streams (whitelisted) =========

 

 

==================== Safe Mode (whitelisted) ===================

 

 

==================== Faulty Device Manager Devices =============

 

Name: Wacom Virtual Hid Driver

Description: Wacom Virtual Hid Driver

Class Guid: {745a17a0-74d3-11d0-b6fe-00a0c90f57da}

Manufacturer: Wacom

Service: wacomvhid

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (12/10/2013 10:17:11 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error: (12/10/2013 10:17:08 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

Error: (12/10/2013 10:17:07 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

 

 

System errors:

=============

Error: (12/10/2013 10:02:22 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT AUTHORITY)

Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

 

 

Microsoft Office Sessions:

=========================

Error: (12/10/2013 10:17:11 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Josh\Downloads\esetsmartinstaller_enu.exe

 

Error: (12/10/2013 10:17:08 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Josh\Downloads\esetsmartinstaller_enu.exe

 

Error: (12/10/2013 10:17:07 PM) (Source: SideBySide)(User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Josh\Downloads\esetsmartinstaller_enu.exe

 

 

==================== Memory info =========================== 

 

Percentage of memory in use: 54%

Total physical RAM: 3327.3 MB

Available physical RAM: 1514.54 MB

Total Pagefile: 6652.79 MB

Available Pagefile: 4608.3 MB

Total Virtual: 8192 MB

Available Virtual: 8191.79 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:931.41 GB) (Free:780.83 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 96D17518)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

 

==================== End Of Log ============================

Link to post
Share on other sites

  • Root Admin

Please Run TFC by OldTimer to clear temporary files:

  • Download TFC from here and save it to your desktop.
  • http://oldtimer.geekstogo.com/TFC.exe
  • Close any open programs and Internet browsers.
  • Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

 

Next, Please visit each of the following sites and lets reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Firefox
Click on Help / Troubleshooting Information then click on the Reset Firefox button.

Chrome
Chrome - Reset browser settings

Opera
How to Perform a (really) clean Reinstall of Opera

Link to post
Share on other sites

  • Root Admin

Great, At this time there are no more signs of an infection on your system.

However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.

They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.

It will also reset your System Restore by flushing out previous restore points and create a new restore point.

It will also remove all the backups our tools may have created.

Uninstall ComboFix (if used):

  • Turn off all active protection software including your antivirus.
  • Push the "Windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • Please copy and past the following into the box ComboFix /Uninstall and click OK.
  • Note the space between the X and the /Uninstall, it needs to be there.

CF-Uninstall.png

Remove the rest of the tools used:

Please download OTCleanIt and save it to your Desktop. This tool will remove all the tools we used to clean your pc.

  • Double-click OTCleanIt.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not go ahead and delete it by yourself.
  • If asked to restart the computer, please do so

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

AdwCleaner Removal:

  • Double click on AdwCleaner.exe to run the tool.
  • Click on Uninstall
  • Confirm with Yes
ESET antivirus Removal:
  • This tool can be uninstalled via the Control Panel, Programs, Uninstall
If there are any other left over Folders, Files, Logs then you can delete them on your own.

Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.

How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP

As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers

How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.

Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

If you're not currently using Malwarebytes PRO then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.
Link to post
Share on other sites

  • 3 weeks later...
  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.