Need to verify all my devuces are clean after possibly infecting my radio station's website

Jhay · January 22, 2014

I work for a radio station in Syracuse and am in charge of developing the station's website. Over the last month, I discovered the site was infected by two trojans. The site has since been cleaned up; however, I had the suspicion that I infected the site with at least one of my devices, either my laptop desktop or Android phone. I have since installed Malwarebytes Anti-Malware on all devices. MBAM on the desktop detected one trojan and I have since removed it. Same with the MBAM installation on the Android. As far as the laptop is concerned, I have since formatted the hard drive and reinstalled Windows with a fresh copy of MBAM. Full scans result in detection of zero malware; however, I have been receiving reports that MBAM has successfully blocked attacks from four different IP addresses. This is mainly due to visiting sketchy websites vulnerable to cause infection.

MrCharlie · January 22, 2014

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt (DDS won't run on W8)

(please don't put logs in code or quotes and use the default font)

(Please don't forget to run the RogueKiller scan below)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Jhay · January 25, 2014

I am running Windows 8. DDS can't be run on this operating system. Any workarounds or suggestions?

Jhay · January 25, 2014

Here are all the logs and reports from my DESKTOP PC. I have taken my laptop into be fixed for a network connectivity issue and they have since recommended re-installing Windows and formatting the hard drive, which I am doing. As far as my desktop is concerned, it seems as though there is much more work to be done. MalwareBytes Antimalware reports a PUP installed on the system.

DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16384

Run by Jordan at 23:07:54 on 2014-01-24

Microsoft Windows 8.1 Pro 6.3.9600.0.1252.1.1033.18.8172.5732 [GMT -5:00]

.

AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k RPCSS

C:\WINDOWS\system32\nvvsvc.exe

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\IDT\WDM\STacSV64.exe

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

C:\WINDOWS\system32\dashost.exe

C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

C:\WINDOWS\SysWOW64\svchost.exe -k hpdevmgmt

C:\Program Files (x86)\NVDA\nvda_service.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\WUDFHost.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\WINDOWS\System32\dwm.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\taskhostex.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

C:\WINDOWS\System32\spoolsv.exe

C:\WINDOWS\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\klwtblfs.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll

BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: ZeonIEEventHelper Class: {C7DA0384-42AA-428c-B832-88AC343DE1A8} - C:\Program Files (x86)\Nuance\PDF Create 8\bin\GZeonIEFavClient.dll

BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll

BHO: ClassicIEBHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll

TB: Nuance PDF: {BCCE15AE-AC7E-4bc9-94AF-2A714A412BCB} - C:\Program Files (x86)\Nuance\PDF Create 8\bin\GZeonIEFavClient.dll

TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll

uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

uRun: [spotify Web Helper] "C:\Users\J\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

uRun: [Amazon Cloud Player] C:\Users\J\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [Google Update] "C:\Users\J\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [Plex Media Server] "C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe"

mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\runner_avp.exe"

mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [PDFCreHook] "C:\Program Files (x86)\Nuance\PDF Create 8\pdfcreate8hook.exe"

mRun: [PDF8 Registry Controller] "C:\Program Files (x86)\Nuance\PDF Create 8\RegistryController.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\NUANCE~1.LNK - C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladLauncher.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105

IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll

TCP: NameServer = 209.18.47.61 209.18.47.62

TCP: Interfaces\{9A0196F5-6E39-4DA2-8EA9-2572621C0DB6} : DHCPNameServer = 209.18.47.61 209.18.47.62

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

SSODL: WebCheck - <orphaned>

x64-BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll

x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll

x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-BHO: ClassicIEBHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll

x64-TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll

x64-Run: [beatsOSDApp] C:\Program Files\IDT\WDM\beats64.exe

x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-SSODL: WebCheck - <orphaned>

x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall

x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\J\AppData\Roaming\Mozilla\Firefox\Profiles\gf7ygnlv.default\

FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

FF - plugin: C:\Users\J\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll

FF - plugin: C:\Users\J\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\J\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Users\J\AppData\Roaming\Mozilla\plugins\npo1d.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

.

---- FIREFOX POLICIES ----

FF - user.js: browser.search.defaultenginename - FindWide

FF - user.js: browser.keywordURLPromptDeclined - 1

FF - user.js: browser.startup.page - 1

FF - user.js: browser.newtab.url -

.

============= SERVICES / DRIVERS ===============

.

R0 intelpep;Intel® Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2013-12-31 39768]

R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2013-8-22 76800]

R1 ElRawDisk;ElRawDisk;C:\WINDOWS\System32\drivers\rsdrvx64.sys [2013-11-24 26024]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\WINDOWS\System32\drivers\klim6.sys [2012-8-2 30304]

R1 klwfp;klwfp;C:\WINDOWS\System32\drivers\klwfp.sys [2013-5-2 50448]

R1 kneps;kneps;C:\WINDOWS\System32\drivers\kneps.sys [2013-5-2 178448]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2013-8-8 89600]

R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [2013-5-2 356128]

R2 GladFileMonSvc;GladFileMonSvc;C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [2013-3-22 30032]

R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2013-6-7 376144]

R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2013-4-30 16056]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\System32\drivers\LMIRfsDriver.sys [2013-9-6 72216]

R2 nvda;nvda;C:\Program Files (x86)\NVDA\nvda_service.exe [2013-9-4 40040]

R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\WINDOWS\System32\drivers\klkbdflt.sys [2013-5-2 29280]

R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\WINDOWS\System32\drivers\klmouflt.sys [2013-5-2 29280]

R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2013-8-22 16384]

R3 RTL8168;Realtek 8168 NT Driver;C:\WINDOWS\System32\drivers\Rt630x64.sys [2013-8-22 591360]

R3 xcbdaNtsc;ViXS Tuner Card (NTSC);C:\WINDOWS\System32\drivers\xcbdax64.sys [2007-9-7 204672]

S0 klelam;klelam;C:\WINDOWS\System32\drivers\klelam.sys [2012-7-27 29616]

S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-12-30 418376]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-12-30 701512]

S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2013-8-22 782176]

S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2013-8-22 37768]

S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2013-8-22 37768]

S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2013-8-22 17624]

S3 iaLPSSi_GPIO;Intel® Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2013-8-22 24568]

S3 iaLPSSi_I2C;Intel® Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2013-8-22 99320]

S3 iaStorAV;Intel® SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2013-8-22 651248]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\WINDOWS\System32\ieetwcollector.exe [2013-11-14 111616]

S3 kbldfltr;kbldfltr;C:\WINDOWS\System32\drivers\kbldfltr.sys [2013-11-14 22272]

S3 lfsvc;Windows Location Framework Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]

S3 LSI_SAS3;LSI_SAS3;C:\WINDOWS\System32\drivers\lsi_sas3.sys [2013-8-22 81760]

S3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\drivers\mbam.sys [2013-12-30 25928]

S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc63.sys [2013-8-22 87040]

S3 PEERNET Spooler Service 10.0;PEERNET Spooler Service 10.0;C:\WINDOWS\System32\spool\drivers\x64\3\PNSvc10.exe [2012-12-12 242632]

S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2013-8-22 924512]

S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2013-12-31 146776]

S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2013-8-22 37768]

S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2013-11-14 57176]

S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2013-8-22 26976]

S3 vmbusr;Virtual Machine Bus Provider;C:\WINDOWS\System32\drivers\vmbusr.sys [2013-11-14 129536]

S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]

S3 WdNisDrv;Windows Defender Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2013-8-22 124256]

S3 WdNisSvc;Windows Defender Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2013-8-22 346872]

S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2013-8-22 37768]

S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2013-8-22 37768]

S4 MsKeyboardFilter;Microsoft Keyboard Filter;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]

.

=============== Created Last 30 ================

.

2014-01-14 03:33:59 -------- d-----w- C:\ProgramData\boost_interprocess

2014-01-14 03:33:57 -------- d-----w- C:\Users\J\AppData\Local\Plex Media Server

2014-01-14 03:33:36 -------- d-----w- C:\Program Files (x86)\Plex

2014-01-14 03:33:29 -------- d-----w- C:\ProgramData\Package Cache

2014-01-13 22:32:11 -------- d-----w- C:\Users\J\AppData\Roaming\e-academy Inc

2014-01-13 22:32:11 -------- d-----w- C:\Users\J\AppData\Local\e-academy Inc

2014-01-09 20:02:15 -------- d---a-r- C:\Users\J\SkyDrive

2013-12-31 21:31:57 35480 ----a-w- C:\WINDOWS\SysWow64\TsWpfWrp.exe

2013-12-31 21:31:57 102608 ----a-w- C:\WINDOWS\SysWow64\PresentationCFFRasterizerNative_v0300.dll

2013-12-31 21:31:56 778936 ----a-w- C:\WINDOWS\SysWow64\PresentationNative_v0300.dll

2013-12-31 21:31:54 35480 ----a-w- C:\WINDOWS\System32\TsWpfWrp.exe

2013-12-31 21:31:54 124112 ----a-w- C:\WINDOWS\System32\PresentationCFFRasterizerNative_v0300.dll

2013-12-31 21:31:54 1166520 ----a-w- C:\WINDOWS\System32\PresentationNative_v0300.dll

2013-12-31 18:42:40 922912 ----a-w- C:\WINDOWS\System32\nvvsvc.exe

2013-12-31 18:42:40 6669600 ----a-w- C:\WINDOWS\System32\nvcpl.dll

2013-12-31 18:42:40 63776 ----a-w- C:\WINDOWS\System32\nvshext.dll

2013-12-31 18:42:40 3489568 ----a-w- C:\WINDOWS\System32\nvsvc64.dll

2013-12-31 18:42:40 3426956 ----a-w- C:\WINDOWS\System32\nvcoproc.bin

2013-12-31 18:42:40 2559776 ----a-w- C:\WINDOWS\System32\nvsvcr.dll

2013-12-31 18:42:40 219424 ----a-w- C:\WINDOWS\System32\nvmctray.dll

2013-12-31 18:42:15 -------- d-----w- C:\ProgramData\NVIDIA Corporation

2013-12-31 18:42:10 -------- d-----w- C:\Program Files\NVIDIA Corporation

2013-12-31 18:42:10 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation

2013-12-31 18:41:57 254464 ----a-w- C:\WINDOWS\System32\Spool\prtprocs\x64\hpfpp083.dll

2013-12-31 03:47:13 -------- d-----w- C:\Users\J\AppData\Roaming\Malwarebytes

2013-12-31 03:47:06 25928 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys

2013-12-31 03:47:06 -------- d-----w- C:\ProgramData\Malwarebytes

2013-12-31 03:47:06 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

.

==================== Find3M ====================

.

2014-01-22 03:09:06 107368 ----a-w- C:\WINDOWS\System32\LMIRfsClientNP.dll

2014-01-22 03:09:05 92488 ----a-w- C:\WINDOWS\System32\LMIinit.dll

2014-01-22 03:09:05 35656 ----a-w- C:\WINDOWS\System32\LMIport.dll

2014-01-06 22:31:05 693240 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe

2014-01-06 22:31:05 105464 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl

2013-12-31 21:39:15 75360 ----a-w- C:\WINDOWS\System32\imagehlp.dll

2013-12-31 21:39:15 70680 ----a-w- C:\WINDOWS\SysWow64\imagehlp.dll

2013-12-31 21:39:09 393216 ----a-w- C:\WINDOWS\System32\WMPhoto.dll

2013-12-31 21:39:09 348160 ----a-w- C:\WINDOWS\SysWow64\WMPhoto.dll

2013-12-31 21:39:06 197120 ----a-w- C:\WINDOWS\System32\scrrun.dll

2013-12-31 21:39:06 156672 ----a-w- C:\WINDOWS\SysWow64\scrrun.dll

2013-12-31 21:39:03 615936 ----a-w- C:\WINDOWS\System32\MDMAgent.exe

2013-12-31 21:39:03 414720 ----a-w- C:\WINDOWS\System32\wbem\MDMSettingsProv.dll

2013-12-31 21:39:03 287744 ----a-w- C:\WINDOWS\System32\mdmregistration.dll

2013-12-31 21:39:03 240128 ----a-w- C:\WINDOWS\SysWow64\mdmregistration.dll

2013-12-31 21:39:03 156672 ----a-w- C:\WINDOWS\System32\wbem\MDMAppProv.dll

2013-12-31 21:31:42 303104 ----a-w- C:\WINDOWS\apppatch\apppatch64\AcGenral.dll

2013-12-31 21:31:42 2415104 ----a-w- C:\WINDOWS\apppatch\AcGenral.dll

2013-12-12 01:13:32 458336 ----a-w- C:\WINDOWS\System32\drivers\kl1.sys

2013-12-12 01:13:32 30304 ----a-w- C:\WINDOWS\System32\drivers\klim6.sys

2013-11-14 07:38:58 18577408 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll

2013-11-14 07:38:58 13925888 ----a-w- C:\WINDOWS\SysWow64\Windows.UI.Xaml.dll

2013-11-14 07:37:20 872840 ----a-w- C:\WINDOWS\System32\mfplat.dll

2013-11-14 07:37:20 698232 ----a-w- C:\WINDOWS\SysWow64\mfplat.dll

2013-11-14 07:34:15 869888 ----a-w- C:\WINDOWS\SysWow64\twinui.appcore.dll

2013-11-14 07:34:15 2801664 ----a-w- C:\WINDOWS\System32\actxprxy.dll

2013-11-14 07:34:15 1085952 ----a-w- C:\WINDOWS\System32\twinui.appcore.dll

2013-11-14 07:34:15 1019392 ----a-w- C:\WINDOWS\SysWow64\actxprxy.dll

2013-11-14 07:31:52 688640 ----a-w- C:\WINDOWS\System32\MrmIndexer.dll

2013-11-14 07:31:52 669184 ----a-w- C:\WINDOWS\System32\SkyDriveTelemetry.dll

2013-11-14 07:31:52 515072 ----a-w- C:\WINDOWS\SysWow64\MrmIndexer.dll

2013-11-14 07:28:17 977408 ----a-w- C:\WINDOWS\SysWow64\Windows.Media.Streaming.dll

2013-11-14 07:28:17 294400 ----a-w- C:\WINDOWS\System32\Windows.Devices.Sensors.dll

2013-11-14 07:28:17 225792 ----a-w- C:\WINDOWS\SysWow64\Windows.Devices.Sensors.dll

2013-11-14 07:28:17 1286552 ----a-w- C:\WINDOWS\System32\msctf.dll

2013-11-14 07:28:17 1217024 ----a-w- C:\WINDOWS\System32\Windows.Media.Streaming.dll

2013-11-14 07:28:17 1018960 ----a-w- C:\WINDOWS\SysWow64\msctf.dll

2013-11-14 07:24:29 1341288 ----a-w- C:\WINDOWS\System32\gdi32.dll

2013-11-14 07:24:29 1067008 ----a-w- C:\WINDOWS\SysWow64\gdi32.dll

2013-11-14 07:24:26 1943536 ----a-w- C:\WINDOWS\System32\crypt32.dll

2013-11-14 07:24:26 1581968 ----a-w- C:\WINDOWS\SysWow64\crypt32.dll

2013-11-14 07:24:22 828416 ----a-w- C:\WINDOWS\System32\BFE.DLL

2013-11-14 07:24:22 136536 ----a-w- C:\WINDOWS\System32\drivers\wfplwfs.sys

2013-11-14 07:24:22 1104384 ----a-w- C:\WINDOWS\System32\IKEEXT.DLL

2013-11-14 07:14:23 5632 ----a-w- C:\WINDOWS\SysWow64\drivers\en-US\ndiscap.sys.mui

2013-11-14 07:14:23 11264 ----a-w- C:\WINDOWS\SysWow64\drivers\en-US\NdisImPlatform.sys.mui

2013-11-14 07:14:22 7680 ----a-w- C:\WINDOWS\SysWow64\drivers\en-US\fwpkclnt.sys.mui

2013-11-14 07:14:22 2560 ----a-w- C:\WINDOWS\SysWow64\drivers\en-US\wfplwfs.sys.mui

2013-11-05 03:42:19 92488 ----a-w- C:\WINDOWS\System32\LMIinit.dll.000.bak

2013-11-05 03:42:19 107368 ----a-w- C:\WINDOWS\System32\LMIRfsClientNP.dll.000.bak

.

============= FINISH: 23:08:11.63 ===============

Attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8.1 Pro

Boot Device: \Device\HarddiskVolume1

Install Date: 12/31/2013 11:34:42 PM

System Uptime: 1/12/2014 12:42:02 PM (299 hours ago)

.

Motherboard: PEGATRON CORPORATION | | 2AB5

Processor: Intel® Core i7-2600 CPU @ 3.40GHz | CPU 1 | 1600/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 1397 GiB total, 1188.377 GiB free.

D: is FIXED (NTFS) - 149 GiB total, 19.365 GiB free.

E: is CDROM ()

F: is Removable

G: is Removable

H: is Removable

I: is Removable

J: is CDROM (UDF)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP2: 1/10/2014 5:31:10 PM - Windows Update

RP3: 1/13/2014 5:31:56 PM - Installed Secure Download Manager

RP4: 1/22/2014 9:17:08 PM - Windows Update

.

==== Installed Programs ======================

.

64 Bit HP CIO Components Installer

Adobe AIR

Adobe Connect 9 Add-in

Adobe Download Assistant

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.06)

AmazingMIDI

Amazon Cloud Player

Amazon Kindle

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Audacity 2.0.3

Bonjour

BufferChm

calibre 64bit

Classic Shell

Copy

Cyberduck 4.4 (13577)

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Destinations

DeviceDiscovery

DJ_AIO_05_F4400_Software_Min

EPS Viewer

F4400

GIMP 2.8.6

Google Chrome

Google Drive

Google Talk Plugin

Google Update Helper

GPBaseService2

HP Deskjet F4400 Printer Driver Software 14.0 Rel. 5

HP Imaging Device Functions 14.0

HP Photo Creations

HP Solution Center 14.0

HP Update

HPPhotoGadget

HPProductAssistant

IDT Audio

iTunes

Kaspersky Internet Security 2013

LogMeIn

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Mouse and Keyboard Center

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office Office 64-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 64-bit MUI (English) 2010

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 24.0 (x86 en-US)

Mozilla Maintenance Service

Nuance Cloud Connector

Nuance PDF Create 8

NVDA

NVIDIA 3D Vision Controller Driver 320.49

NVIDIA Control Panel 331.65

NVIDIA HD Audio Driver 1.3.24.2

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.0604

Pinnacle Studio 16

Pinnacle Studio 16 - Install Manager

Pinnacle Studio 16 - Standard Content Pack

Pinnacle Video Driver

Plex Media Server

Portal

QuickTime

QuizXpress 3.3.4

Remove Game Show Presenter PLUS

Rhapsody

Scan

Scansoft PDF Create

Secure Download Manager

Security Update for CAPICOM (KB931906)

Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition

Security Update for Microsoft Outlook 2010 (KB2837597) 32-Bit Edition

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition

SolutionCenter

Spotify

Status

Steam

Sublime Text 2.0.2

Synthesia

Toolbox

TrayApp

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition

Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition

Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition

Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition

Updater

VLC media player 2.0.8

WebReg

Zotero Standalone 4.0.16 (x86 en-US)

.

==== Event Viewer Messages From Past Week ========

.

1/24/2014 6:44:24 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {C2F03A33-21F5-47FA-B4BB-156362A2F239} and APPID {316CDED5-E4AE-4B15-9113-7055D84DCC97} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

1/24/2014 6:41:24 PM, Error: disk [11] - The driver detected a controller error on \Device\Harddisk5\DR5.

1/24/2014 6:41:24 PM, Error: disk [11] - The driver detected a controller error on \Device\Harddisk4\DR4.

1/24/2014 6:41:24 PM, Error: disk [11] - The driver detected a controller error on \Device\Harddisk3\DR3.

1/22/2014 9:18:59 PM, Error: Ntfs [55] - A corruption was discovered in the file system structure on volume ??. A corruption was found in a file system index structure. The file reference number is 0x9000000000009. The name of the file is "<unable to determine file name>". The corrupted index attribute is ":$SII:$INDEX_ALLOCATION".

1/21/2014 7:23:05 PM, Error: disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.

.

==== End Of File ===========================

RogueKiller Report:

RogueKiller V8.8.3 _x64_ [Jan 24 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9200 ) 64 bits version

Started in : Normal mode

User : Jordan [Admin rights]

Mode : Scan -- Date : 01/24/2014 23:16:22

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST31500341AS +++++

--- User ---

[MBR] aed2c500fcd30567bdc8f4f819865259

[bSP] e3e00fc96a4693955ef5e08943664a9e : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 350 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 718848 | Size: 1430447 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Maxtor 3200 USB Device +++++

--- User ---

[MBR] 5aa78cf19e8ab2ae0bab6e8b8c52e596

[bSP] a1a71bc3aee9ff3c99fea0e817092648 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152617 Mo

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_01242014_231622.txt >>

MrCharlie · January 25, 2014

Not much showing, lets run some scans.

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

Jhay · January 26, 2014

mbar log:

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

www.malwarebytes.org

Database version: v2014.01.26.06

Windows 8 x64 NTFS

Internet Explorer 11.0.9600.16476

Jordan :: JORDAN-PC [administrator]

1/26/2014 6:12:59 PM

mbar-log-2014-01-26 (18-12-59).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 243270

Time elapsed: 15 minute(s), 22 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

system log:

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.2.9200 Windows 8 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.392000 GHz

Memory total: 8569286656, free: 6244720640

Downloaded database version: v2014.01.26.06

Downloaded database version: v2013.12.18.01

=======================================

Initializing...

------------ Kernel report ------------

01/26/2014 18:12:56

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kd.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\System32\drivers\werkernel.sys

\SystemRoot\System32\drivers\CLFS.SYS

\SystemRoot\System32\drivers\tm.sys

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\BOOTVID.dll

\SystemRoot\system32\CI.dll

\SystemRoot\System32\drivers\msrpc.sys

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\System32\Drivers\acpiex.sys

\SystemRoot\System32\Drivers\WppRecorder.sys

\SystemRoot\System32\drivers\ACPI.sys

\SystemRoot\System32\drivers\WMILIB.SYS

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\msisadrv.sys

\SystemRoot\System32\drivers\pci.sys

\SystemRoot\System32\drivers\vdrvroot.sys

\SystemRoot\system32\drivers\pdc.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\kl1.sys

\SystemRoot\System32\drivers\spaceport.sys

\SystemRoot\System32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\System32\drivers\storahci.sys

\SystemRoot\System32\drivers\storport.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\System32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\DRIVERS\wfplwfs.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\System32\drivers\volsnap.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\intelpep.sys

\SystemRoot\System32\drivers\disk.sys

\SystemRoot\System32\drivers\CLASSPNP.SYS

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\drivers\cdrom.sys

\SystemRoot\system32\DRIVERS\klif.sys

\SystemRoot\system32\DRIVERS\klflt.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\BasicRender.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\System32\drivers\BasicDisplay.sys

\SystemRoot\system32\DRIVERS\lmimirr.sys

\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\klwfp.sys

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\klim6.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\System32\drivers\npsvctrig.sys

\SystemRoot\System32\drivers\mssmbios.sys

\SystemRoot\system32\DRIVERS\kneps.sys

\??\C:\Windows\system32\drivers\rsdrvx64.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\ahcache.sys

\SystemRoot\System32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\kdnic.sys

\SystemRoot\System32\drivers\umbus.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\HDAudBus.sys

\SystemRoot\System32\drivers\HECIx64.sys

\SystemRoot\System32\drivers\usbehci.sys

\SystemRoot\System32\drivers\USBPORT.SYS

\SystemRoot\system32\DRIVERS\xcbdax64.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\BdaSup.SYS

\SystemRoot\system32\DRIVERS\xchalx64.sys

\SystemRoot\system32\DRIVERS\xcmemx64.sys

\SystemRoot\system32\DRIVERS\xcfex64.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\Rt630x64.sys

\SystemRoot\System32\drivers\USBXHCI.SYS

\SystemRoot\System32\drivers\ucx01000.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\System32\drivers\intelppm.sys

\SystemRoot\System32\drivers\NdisVirtualBus.sys

\SystemRoot\System32\drivers\swenum.sys

\SystemRoot\System32\drivers\MarvinBus64.sys

\SystemRoot\System32\drivers\rdpbus.sys

\SystemRoot\System32\drivers\usbhub.sys

\SystemRoot\System32\drivers\USBD.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\DRIVERS\stwrt64.sys

\SystemRoot\System32\drivers\UsbHub3.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\HIDPARSE.SYS

\SystemRoot\System32\drivers\USBSTOR.SYS

\SystemRoot\System32\Drivers\dump_diskdump.sys

\SystemRoot\System32\Drivers\dump_storahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\drivers\usbccgp.sys

\SystemRoot\System32\drivers\dc3d.sys

\SystemRoot\System32\drivers\hidusb.sys

\SystemRoot\System32\drivers\HIDCLASS.SYS

\SystemRoot\System32\drivers\kbdhid.sys

\SystemRoot\system32\DRIVERS\klkbdflt.sys

\SystemRoot\System32\drivers\kbdclass.sys

\SystemRoot\System32\drivers\NuidFltr.sys

\SystemRoot\System32\drivers\mouhid.sys

\SystemRoot\System32\drivers\point64.sys

\SystemRoot\system32\DRIVERS\klmouflt.sys

\SystemRoot\System32\drivers\mouclass.sys

\SystemRoot\System32\drivers\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\System32\drivers\condrv.sys

\??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys

\??\C:\Windows\system32\drivers\LMIRfsDriver.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\drivers\Ndu.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\mslldp.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\SystemRoot\System32\drivers\WpdUpFltr.sys

\SystemRoot\system32\drivers\mrxdav.sys

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\system32\DRIVERS\usbscan.sys

\SystemRoot\System32\drivers\usbprint.sys

\SystemRoot\system32\DRIVERS\dot4usb.sys

\SystemRoot\system32\DRIVERS\Dot4.sys

\SystemRoot\System32\drivers\Dot4Prt.sys

\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys

\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk5\DR5

Upper Device Object: 0xffffe000035f1650

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\0000004e\

Lower Device Object: 0xffffe000035fbb10

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk4\DR4

Upper Device Object: 0xffffe000035ef770

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\0000004d\

Lower Device Object: 0xffffe000035f3060

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk3\DR3

Upper Device Object: 0xffffe000035f0770

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\0000004c\

Lower Device Object: 0xffffe000035f6b10

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk2\DR2

Upper Device Object: 0xffffe000035ee770

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\0000004b\

Lower Device Object: 0xffffe000035f75c0

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xffffe00003337770

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\00000041\

Lower Device Object: 0xffffe00003332b10

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffe0000226f770

Upper Device Driver Name: \Driver\disk\

Lower Device Name: \Device\00000029\

Lower Device Object: 0xffffe00001005060

Lower Device Driver Name: \Driver\storahci\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffe0000226f770, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe0000226f1c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe0000226f770, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\

DevicePointer: 0xffffe00001005060, DeviceName: \Device\00000029\, DriverName: \Driver\storahci\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Read File: File "C:\Windows\System32\drivers\1394ohci.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\1394ohci.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\acpi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\acpi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\acpipagr.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\acpipagr.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\acpipmi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\acpipmi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\acpitime.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\acpitime.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\AGP440.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\AGP440.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\amdk8.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\amdk8.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\amdppm.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\amdppm.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\atapi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\atapi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\ataport.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\ataport.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BasicDisplay.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BasicDisplay.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\intelpep.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\intelpep.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\intelppm.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\intelppm.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\isapnp.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\isapnp.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\kbdclass.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\kbdclass.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\kbdhid.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\kbdhid.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\kdnic.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\kdnic.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\battc.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\battc.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BdaSup.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BdaSup.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BtaMPM.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BtaMPM.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\bthhfenum.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\bthhfenum.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BthhfHid.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BthhfHid.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\bthmodem.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\bthmodem.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\cdrom.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\cdrom.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\circlass.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\circlass.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\CmBatt.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\CmBatt.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\errdev.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\errdev.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\fdc.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\fdc.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\flpydisk.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\flpydisk.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\fxppm.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\fxppm.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\parport.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\parport.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\pci.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\pci.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\pciide.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\pciide.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\pciidex.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\pciidex.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\pcmcia.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\pcmcia.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\portcls.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\portcls.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\processr.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\processr.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\monitor.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\monitor.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\mouclass.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\mouclass.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\mouhid.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\mouhid.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\msgpiowin32.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\msgpiowin32.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\msisadrv.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\msisadrv.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\msiscsi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\msiscsi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\BasicRender.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\BasicRender.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\sdstor.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\sdstor.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\vhdmp.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\vhdmp.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\serenum.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\serenum.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\serial.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\serial.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\sermouse.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\sermouse.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\sfloppy.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\sfloppy.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\spaceport.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\spaceport.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\stornvme.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\stornvme.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\swenum.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\swenum.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\terminpt.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\terminpt.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\tpm.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\tpm.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\TsUsbGD.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\TsUsbGD.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\uaspstor.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\uaspstor.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\UCX01000.SYS" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\UCX01000.SYS" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\uefi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\uefi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\umbus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\umbus.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\umpass.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\umpass.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbccgp.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbccgp.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbcir.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbcir.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbd.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbd.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbehci.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbehci.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbhub.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbhub.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\USBHUB3.SYS" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\USBHUB3.SYS" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbohci.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbohci.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbport.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbport.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbprint.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbprint.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\USBSTOR.SYS" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\USBSTOR.SYS" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\usbuhci.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\usbuhci.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\USBXHCI.SYS" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\USBXHCI.SYS" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\vdrvroot.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\vdrvroot.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\volmgr.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\volmgr.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\volsnap.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\volsnap.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\mssmbios.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\mssmbios.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\MTConfig.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\MTConfig.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\npsvctrig.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\npsvctrig.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\vwifibus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\wacompen.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\wacompen.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\wmiacpi.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\wmiacpi.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hdaudbus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hdaudbus.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidbatt.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidbatt.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidbth.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidbth.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidclass.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidclass.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidi2c.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidi2c.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidparse.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidparse.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\hidusb.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\hidusb.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\i8042prt.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\i8042prt.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\CompositeBus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\CompositeBus.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\disk.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\disk.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\drmk.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\drmk.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\drmkaud.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\drmkaud.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\dumpsd.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\dumpsd.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\rdpbus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\rdpbus.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\sbp2port.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\sbp2port.sys" is compressed (flags = 1)

Read File: File "C:\Windows\System32\drivers\sdbus.sys" is compressed (flags = 1)

Read File: File "C:\WINDOWS\SYSTEM32\drivers\sdbus.sys" is compressed (flags = 1)

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: B5C51DC

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 716800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 718848 Numsec = 2929555456

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 1500301910016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-2930257168-2930277168)...

Done!

Physical Sector Size: 512

Drive: 1, DevicePointer: 0xffffe00003337770, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe00003333040, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe00003337770, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\

DevicePointer: 0xffffe00003332b10, DeviceName: \Device\00000041\, DriverName: \Driver\USBSTOR\

------------ End ----------

Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

Drive 1

Scanning MBR on drive 1...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 48E2519E

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 312560577

Partition file system is NTFS

Partition is bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes

Sector size: 512 bytes

Done!

Physical Sector Size: 0

Drive: 2, DevicePointer: 0xffffe000035ee770, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe000035ed990, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe000035ee770, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\

DevicePointer: 0xffffe000035f75c0, DeviceName: \Device\0000004b\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 3, DevicePointer: 0xffffe000035f0770, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe000035f0230, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe000035f0770, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\disk\

DevicePointer: 0xffffe000035f6b10, DeviceName: \Device\0000004c\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 4, DevicePointer: 0xffffe000035ef770, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe000035f1040, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe000035ef770, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\disk\

DevicePointer: 0xffffe000035f3060, DeviceName: \Device\0000004d\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 5, DevicePointer: 0xffffe000035f1650, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\disk\

--------- Disk Stack ------

DevicePointer: 0xffffe00003517040, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffe000035f1650, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\disk\

DevicePointer: 0xffffe000035fbb10, DeviceName: \Device\0000004e\, DriverName: \Driver\USBSTOR\

------------ End ----------

Scan finished

=======================================

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-63-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...

Removal finished

Jhay · January 26, 2014

Internet access and Windows Update are verified to work. I am not using Windows Firewall as I am using a firewall provided by Kaspersky Internet Security 2013.

MrCharlie · January 27, 2014

OK..Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look similar to this, not the "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Jhay · January 29, 2014

Sorry. My computer is running Windows 8.1, which means I cannot run ComboFix on this machine.

MrCharlie · January 29, 2014

Sorry about that........

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

Jhay · January 29, 2014

Attached are the FRST and Addition logs.

Also as of 1/24/2014, Kaspersky reports malicious URLs, as shown in this log:

Type: phishing URL (4)

Malicious URL Inactive 1/24/2014 11:35:48 PM http://amateurallure.org/videos/ chloe-brooke.mp4

Malicious URL Inactive 1/24/2014 11:31:31 PM http://amateurallure.org/videos/ halloween-preauditions.mp4

Malicious URL Inactive 1/24/2014 11:29:49 PM http://amateurallure.org/ favicon.ico

Malicious URL Inactive 1/24/2014 11:29:48 PM http://amateurallure.org/ ?discount=ip

Addition.txt

FRST.txt

MrCharlie · January 29, 2014

OK, give me some time to look over the logs, MrC

MrCharlie · January 30, 2014

Clean out temp files:

http://corel.force.com/pinnacle/articles/en_US/Master_Article/How-to-delete-temporary-files-from-Windows-8?&source=kba

You may want to install CCleaner at a later date to clean out temp files:

Download, install and run CCleaner free to clean out temp files.

Here's a Tutorial if needed.

You may want to uncheck "cookies" and please stay away from the registry cleaner.

----------------------------

Download the attached fixlist.txt to the same folder as FRST.

Run FRST.exe and click Fix only once and wait

The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......update and run a scan with your anti-virus.

Let me know how it is, MrC

Jhay · January 31, 2014

fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-01-2014 01

Ran by Jordan at 2014-01-31 14:46:01 Run:1

Running from C:\Users\J\Downloads

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

SearchScopes: HKCU - DefaultScope {2350D937-F928-447D-8528-CCAB9614A779} URL = http://search.findwide.com/serp?guid={081AE358-51A0-4C4E-82B4-1BCC83A918CD}&action=default_search&serpv=22&k={searchTerms}

SearchScopes: HKCU - {2350D937-F928-447D-8528-CCAB9614A779} URL = http://search.findwide.com/serp?guid={081AE358-51A0-4C4E-82B4-1BCC83A918CD}&action=default_search&serpv=22&k={searchTerms}

SearchScopes: HKCU - {C7246DC3-B3D0-4560-B2DB-BD564B66F3C7} URL =

Toolbar: HKCU - No Name - {EAD9862F-FAF0-4F2B-B6F4-084C815154D0} - No File

FF Extension: Tube Dimmer - C:\Users\J\AppData\Roaming\Mozilla\Firefox\Profiles\gf7ygnlv.default\Extensions\support@tubedimmerapp.com [2013-12-20]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

AlternateDataStreams: C:\ProgramData\TEMP:A303874F

AlternateDataStreams: C:\Users\J\SkyDrive:ms-properties

*****************

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2350D937-F928-447D-8528-CCAB9614A779} => Key deleted successfully.

HKCR\CLSID\{2350D937-F928-447D-8528-CCAB9614A779} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C7246DC3-B3D0-4560-B2DB-BD564B66F3C7} => Key deleted successfully.

HKCR\CLSID\{C7246DC3-B3D0-4560-B2DB-BD564B66F3C7} => Key not found.

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EAD9862F-FAF0-4F2B-B6F4-084C815154D0} => Value deleted successfully.

HKCR\CLSID\{EAD9862F-FAF0-4F2B-B6F4-084C815154D0} => Key not found.

Firefox homepage deleted successfully.

Firefox Keyword.URL deleted successfully.

C:\Users\J\AppData\Roaming\Mozilla\Firefox\Profiles\gf7ygnlv.default\Extensions\support@tubedimmerapp.com => Moved successfully.

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.

C:\ProgramData\TEMP => ":A303874F" ADS removed successfully.

"C:\Users\J\SkyDrive" => ":ms-properties" ADS not found.

==== End of Fixlog ====

Also ran the Kaspersky scan again, which found no threats with the full scan. However, this did not remove the malicious URLs because they are considered "quarantined" by the software. What I can do is remove them from the quarantine to get rid of them. They should no longer point to any local files, since I cleared my browsing history immediately after Kaspersky detected the malicious URLs.

In addition, the anti-virus did find some security vulnerabilities in seven programs, as listed below:

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=56676 Inactive C:\Program Files (x86)\VideoLAN\VLC\ vlc.exe 1/31/2014 2:52:21 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=56676 Inactive C:\Program Files (x86)\VideoLAN\VLC\ vlc-cache-gen.exe 1/31/2014 2:52:20 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=53520 Inactive C:\Program Files (x86)\QuickTime\ QuickTimePlayer.exe 1/31/2014 2:51:50 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=56234 Inactive C:\Program Files (x86)\Plex\Plex Media Server\ python27.dll 1/31/2014 2:51:38 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=56234 Inactive C:\Program Files (x86)\NVDA\ python27.dll 1/31/2014 2:50:52 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=56005 Inactive C:\Program Files (x86)\Mozilla Firefox\ firefox.exe 1/31/2014 2:50:41 PM

http://redirect.kaspersky.com/?hl=en-US&target=securelist&rpe=1&function=advisories&VN=41917 Inactive C:\Program Files (x86)\HP\Digital Imaging\help\player\ FlashPla.exe 1/31/2014 2:49:46 PM

Clicking on the URLs listed suggest me to update to the latest versions of those programs in order to fix the detected vulnerabilities. I had since uninstalled Firefox because I rarely use it now that I use Chrome. I will update the rest of the software to the latest versions shortly.

Please let me know what you think. Hope to hear from you soon!

MrCharlie · January 31, 2014

Also ran the Kaspersky scan again, which found no threats with the full scan. However, this did not remove the malicious URLs because they are considered "quarantined" by the software. What I can do is remove them from the quarantine to get rid of them. They should no longer point to any local files, since I cleared my browsing history immediately after Kaspersky detected the malicious URLs.

I'm not sure what you mean by this, where are these urls located?

MrC

Jhay · February 1, 2014

These malicious URLs are actually located elsewhere on the World Wide Web; however, they are stored in a Kaspersky-maintained database that detects when users access sites associated with those malicious URLs. The aforementioned URLs, as a reminder, are listed below:

Malicious URL Inactive 1/24/2014 11:35:48 PM http://amateurallure.org/videos/ chloe-brooke.mp4

Malicious URL Inactive 1/24/2014 11:31:31 PM http://amateurallure.org/videos/ halloween-preauditions.mp4

Malicious URL Inactive 1/24/2014 11:29:49 PM http://amateurallure.org/ favicon.ico

Malicious URL Inactive 1/24/2014 11:29:48 PM http://amateurallure.org/ ?discount=ip

Kaspersky detected my browser accessing a site that matched one in their database after attempting to view a video, particularly one pointing to the second URL in the list above. Immediately following this, a pop-up or redirect occurred and Kaspersky's web protection module denied access to the pop-up/redirect. Consequently, Kaspersky associated all URLs connected to the domain http://amateurallure.org/ as malicious and recorded them in a "detected threats" report that the user can access. The software permits users to delete these records from the report; however, this does not mean Kaspersky "forgets" the malicious nature of these URLs.

MrCharlie · February 1, 2014

I don't have an answer for you, maybe you can contact Kaspersky??

MrC

Jhay · February 2, 2014

Contacted Kaspersky technical support. Should hear back from them soon.

MrCharlie · February 2, 2014

OK...let me know...MrC

Jhay · February 2, 2014

Here's the reply from Kaspersky, quoted directly from the e-mail reply:

If Kaspersky blocks a website with a red banner:
The site you are trying to view is infected and Kaspersky has blocked access to the site to prevent your PC from being infected. Kaspersky will not allow you to access the site until the infection is removed.

If Kaspersky states “Your Computer is Protected”, however you see an item detected as “suspicious” under Detected Threats in the Detailed report:
The item that Kaspersky has detected as “suspicious” is not in fact on your PC; it is a website that Kaspersky has encountered. Since the website is not on your PC, Kaspersky can only block the website and record the address of the website to warn you of it.

MrCharlie · February 2, 2014

So it sounds as if you're OK, correct?

MrC

Jhay · February 2, 2014

Yes, because the malicious URLs are located elsewhere on the World Wide Web, not on the local PC.

MrCharlie · February 2, 2014

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
If you get Unsupported operating system. Aborting now, just reboot and try again.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

Jhay · February 3, 2014

checkup.txt:

Results of screen317's Security Check version 0.99.79

x64 (UAC is enabled)

Internet Explorer 11

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Kaspersky Internet Security

Windows Defender

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Adobe Flash Player 12.0.0.43

Adobe Reader XI

Google Chrome 31.0.1650.57

Google Chrome 32.0.1700.102

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

Kaspersky Lab Kaspersky Internet Security 2013 avp.exe

Kaspersky Lab Kaspersky Internet Security 2013 klwtblfs.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: %

````````````````````End of Log``````````````````````

MrCharlie · February 3, 2014

That looks good......

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Please download OTC to your desktop. (This will clean up most of the tools and logs)

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Need to verify all my devuces are clean after possibly infecting my radio station's website

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information