rstrui.exe (Security.Hijack) keeps coming every reboot

[zarzelius]

Hello all.I posted this in some other malware forums but had no answer yet and im desperate.

 

After having problems with both firefox and chrome crashing constantly and randomly, i decided to run eset online scanner to find a few trojans that were removed by the tool.Now i also used malwarebytes just in case and found this.

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe (Security.Hijack) 

 

This happens every time i reboot , and sometimes is 2 of them .The other one has the same name rstrui.exe but is located in a different registry key, ussually in wow64/.../image file execution options/rstrui.exe

Chrome crashes every 2 or 3 minutes but i dont have a slow internet connection.Cant install flash player because i get errors close to something like " windows complement has stopped working" or something like that and the installation aborts itself.

I already tried uninstalling everything , using ccleaner after that and rebooting only to find that the same thing happens over and over again.

 

Any help is apreciated !

 

Here is my dds txt file and i attached the needed file as well.

 

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 10.51.2

Run by Patry at 14:17:58 on 2014-02-19

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.54.1033.18.4094.2715 [GMT -3:00]

.

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\rundll32.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Windows\System32\spool\drivers\x64\3\E_IATIIFA.EXE

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\notepad.exe

C:\Windows\system32\notepad.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

uRun: [EPLTarget\P0000000000000000] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATIIFA.EXE /EPT "EPLTarget\P0000000000000000" /M "XP-201 204 208 Series"

uRun: [office360] \Windows\Explorer.exe

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{A1E40F01-3FAB-4588-86DA-F5F928ADCE23} : DHCPNameServer = 192.168.1.1

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2013-7-20 283064]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-10-10 144152]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-11-16 238080]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-11-16 361984]

R2 AODDriver4.1;AODDriver4.1;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-3-5 53888]

R2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [2013-9-8 179296]

R2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [2013-9-8 151648]

R3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2013-7-19 46136]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-2-23 95760]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]

S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2013-7-19 104048]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2011-4-12 88960]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2011-4-12 34816]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]

SUnknown tsusbhub;tsusbhub; [x]

.

=============== Created Last 30 ================

.

2014-02-19 15:02:18 -------- d-sh--w- C:\$RECYCLE.BIN

2014-02-19 14:53:09 98816 ----a-w- C:\Windows\sed.exe

2014-02-19 14:53:09 256000 ----a-w- C:\Windows\PEV.exe

2014-02-19 14:53:09 208896 ----a-w- C:\Windows\MBR.exe

2014-02-19 14:47:40 -------- d-----w- C:\Users\Patry\AppData\Roaming\GetRightToGo

2014-02-19 12:22:06 -------- d-----w- C:\Program Files (x86)\ESET

2014-02-18 18:01:28 -------- d-----w- C:\ProgramData\Oracle

2014-02-18 18:01:15 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2014-02-18 17:57:10 -------- d-----w- C:\Windows\System32\appmgmt

2014-02-18 17:54:13 -------- d-----w- C:\Users\Patry\AppData\Local\Apps

2014-02-18 17:54:12 -------- d-----w- C:\Users\Patry\AppData\Local\Deployment

2014-02-18 16:30:00 -------- d-----w- C:\AdwCleaner

2014-02-18 16:29:20 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-02-18 12:30:36 -------- d-----w- C:\Users\Patry\AppData\Roaming\Malwarebytes

2014-02-18 12:30:23 -------- d-----w- C:\ProgramData\Malwarebytes

2014-02-18 12:30:22 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2014-02-18 12:30:22 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-18 10:40:59 -------- d-----w- C:\Users\Patry\AppData\Roaming\SUPERAntiSpyware.com

2014-02-18 10:40:35 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2014-02-18 10:40:35 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2014-02-12 22:55:23 -------- d-----w- C:\Program Files\CCleaner

2014-02-08 22:26:30 -------- d-----w- C:\Program Files (x86)\Resident Evil 6

2014-02-01 23:17:19 -------- d-----w- C:\Users\Patry\AppData\Local\MegaDownloader

2014-02-01 23:16:16 -------- d-----w- C:\Users\Patry\AppData\Local\Programs

2014-01-28 23:36:53 -------- d-----w- C:\Users\Patry\AppData\Roaming\uTorrent

.

==================== Find3M  ====================

.

2013-12-07 12:53:38 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2013-12-07 12:53:38 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2013-12-07 12:53:38 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2013-12-07 12:53:38 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

.

============= FINISH: 14:18:08,56 ===============

 

 

 

Again thanx and waiting for yall help ^^

attach.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

 

Kevin...

[zarzelius]

Hi Kevin, thanx for the fast reply.

First i want to say i do not own this computer.Is one of my family members so i really didnt know what was installed. Still, i followed your advice and uninstalled everything related to p2p i could find and also deleted the folders where it was installed.

If there is anything else i should do or uninstall that you find in the logs, please let me know and i shall do so.

I followed the link and downloaded the x64 version of the software.Here is the first file i got.

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014

Ran by Patry (administrator) on CASA-PC on 19-02-2014 18:03:11

Running from C:\Users\Patry\Downloads

Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

 

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE

(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE

() C:\Windows\SysWOW64\PnkBstrA.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIIFA.EXE

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

 

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)

HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-11-16] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\S-1-5-21-1057617592-2629091738-1980757831-1003\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673184 2013-07-03] (Disc Soft Ltd)

HKU\S-1-5-21-1057617592-2629091738-1980757831-1003\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIFA.EXE [278112 2011-11-01] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1057617592-2629091738-1980757831-1003\...\Run: [office360] - C:\ProgramData\SysWOW64office0\riaiccapeaj.exe [0 ] ()

HKU\S-1-5-21-1057617592-2629091738-1980757831-1003\...\Run: [sUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6563608 2014-01-06] (SUPERAntiSpyware)

IFEO\rstrui.exe: [Debugger] jfoqk_.exe

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEAC0E5EBC52CCF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es-ar

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

 

FireFox:

========

FF ProfilePath: C:\Users\Patry\AppData\Roaming\Mozilla\Firefox\Profiles\2tzjqjd5.default

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Extension: Adblock Plus - C:\Users\Patry\AppData\Roaming\Mozilla\Firefox\Profiles\2tzjqjd5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-18]

 

Chrome: 

=======

CHR DefaultSearchKeyword: google.com.ar

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File

CHR Extension: (Google Docs) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-19]

CHR Extension: (Google Drive) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-19]

CHR Extension: (YouTube) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-19]

CHR Extension: (Búsqueda de Google) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-19]

CHR Extension: (Google Wallet) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]

CHR Extension: (Gmail) - C:\Users\Patry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-19]

 

==================== Services (Whitelisted) =================

 

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-11-16] (Advanced Micro Devices, Inc.)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-07-19] ()

 

==================== Drivers (Whitelisted) ====================

 

R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-07-20] (Disc Soft Ltd)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2008-11-11] (LG Electronics Inc.)

S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [27136 2008-11-11] (LG Electronics Inc.)

S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [33792 2008-11-11] (LG Electronics Inc.)

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2014-02-19 18:03 - 2014-02-19 18:03 - 00008088 _____ () C:\Users\Patry\Downloads\FRST.txt

2014-02-19 18:03 - 2014-02-19 18:03 - 00000000 ____D () C:\FRST

2014-02-19 18:02 - 2014-02-19 18:02 - 02153472 _____ (Farbar) C:\Users\Patry\Downloads\FRST64.exe

2014-02-19 14:18 - 2014-02-19 14:18 - 00010572 _____ () C:\Users\Patry\Desktop\attach.txt

2014-02-19 14:18 - 2014-02-19 14:18 - 00009106 _____ () C:\Users\Patry\Desktop\dds.txt

2014-02-19 14:17 - 2014-02-19 14:17 - 00688992 ____R (Swearware) C:\Users\Patry\Downloads\dds.com

2014-02-19 12:08 - 2014-02-19 12:09 - 02347384 _____ (ESET) C:\Users\Patry\Downloads\esetsmartinstaller_esn (1).exe

2014-02-19 12:02 - 2014-02-19 12:02 - 00009799 _____ () C:\ComboFix.txt

2014-02-19 11:53 - 2011-06-26 03:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-19 11:53 - 2010-11-07 14:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-19 11:53 - 2009-04-20 01:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-19 11:53 - 2000-08-30 21:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-19 11:53 - 2000-08-30 21:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-19 11:53 - 2000-08-30 21:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-19 11:53 - 2000-08-30 21:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-19 11:53 - 2000-08-30 21:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-19 11:51 - 2014-02-19 12:02 - 00000000 ____D () C:\Qoobox

2014-02-19 11:51 - 2014-02-19 12:00 - 00000000 ____D () C:\Windows\erdnt

2014-02-19 11:50 - 2014-02-19 11:51 - 05183341 ____R (Swearware) C:\Users\Patry\Downloads\ComboFix.exe

2014-02-19 11:47 - 2014-02-19 11:48 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\GetRightToGo

2014-02-19 09:22 - 2014-02-19 09:22 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-19 09:21 - 2014-02-19 09:22 - 02347384 _____ (ESET) C:\Users\Patry\Downloads\esetsmartinstaller_esn.exe

2014-02-18 15:04 - 2014-02-18 15:04 - 00000000 ____D () C:\Windows\Sun

2014-02-18 15:02 - 2014-02-18 15:02 - 00003164 _____ () C:\Windows\System32\Tasks\{0C8823AE-F3E0-4E3E-BF5C-2CF1C6DB30D3}

2014-02-18 15:01 - 2014-02-18 15:01 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\ProgramData\Sun

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-18 14:59 - 2014-02-18 15:00 - 00921000 _____ (Oracle Corporation) C:\Users\Patry\Downloads\chromeinstall-7u51.exe

2014-02-18 14:57 - 2014-02-18 14:57 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-02-18 14:55 - 2014-02-18 14:55 - 00002257 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-18 14:54 - 2014-02-19 17:59 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-18 14:54 - 2014-02-19 17:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-18 14:54 - 2014-02-18 14:54 - 00004094 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-02-18 14:54 - 2014-02-18 14:54 - 00003842 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-02-18 14:54 - 2014-02-18 14:54 - 00000000 ____D () C:\Users\Patry\AppData\Local\Deployment

2014-02-18 14:54 - 2014-02-18 14:54 - 00000000 ____D () C:\Users\Patry\AppData\Local\Apps\2.0

2014-02-18 13:30 - 2014-02-18 13:35 - 00000000 ____D () C:\AdwCleaner

2014-02-18 13:29 - 2014-02-19 11:17 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-18 13:29 - 2014-02-18 13:29 - 00000000 ____D () C:\Users\Patry\Desktop\MBARB

2014-02-18 11:58 - 2014-02-19 17:57 - 00000504 _____ () C:\Windows\setupact.log

2014-02-18 11:58 - 2014-02-19 13:29 - 00003172 _____ () C:\Windows\PFRO.log

2014-02-18 11:58 - 2014-02-18 11:58 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-18 09:30 - 2014-02-18 09:30 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\Malwarebytes

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-18 09:30 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-02-18 08:06 - 2014-02-19 18:00 - 00037188 _____ () C:\Windows\WindowsUpdate.log

2014-02-18 08:06 - 2014-02-18 08:07 - 00000000 ____D () C:\Users\Patry\Desktop\shexview-x64

2014-02-18 07:40 - 2014-02-18 07:40 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\SUPERAntiSpyware.com

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware

2014-02-12 20:09 - 2014-02-12 20:09 - 00000000 ____D () C:\Users\Marcelo\AppData\Roaming\Mozilla

2014-02-12 20:07 - 2014-02-12 20:07 - 00283032 _____ (Mozilla) C:\Users\Marcelo\Downloads\Firefox Setup Stub 27.0.exe

2014-02-12 20:00 - 2014-02-12 20:01 - 00026354 _____ () C:\Users\Marcelo\Desktop\cc_20140212_200028.reg

2014-02-12 19:55 - 2014-02-12 19:55 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC

2014-02-12 19:55 - 2014-02-12 19:55 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-02-12 19:55 - 2014-02-12 19:55 - 00000000 ____D () C:\Program Files\CCleaner

2014-02-08 19:41 - 2014-02-08 19:41 - 00001913 _____ () C:\Users\Marcelo\Desktop\Resident Evil 6.lnk

2014-02-08 19:26 - 2014-02-08 19:45 - 00000000 ____D () C:\Program Files (x86)\Resident Evil 6

2014-02-04 12:38 - 2014-02-04 12:38 - 00000000 ____D () C:\Users\Marcelo\Documents\CAPCOM

2014-02-03 16:29 - 2014-02-03 16:29 - 00000000 ____D () C:\Users\Patry\Documents\CAPCOM

2014-02-02 14:54 - 2014-02-02 14:54 - 05696668 _____ () C:\Users\Marcelo\Downloads\19 Canzoneta-Tango.- Con Carlos Lazzari.wma

2014-02-01 20:23 - 2014-02-01 20:22 - 00000055 _____ () C:\Users\Patry\Desktop\Links.txt

2014-01-30 17:21 - 2014-01-30 17:21 - 01050624 _____ (Unity Technologies ApS) C:\Users\Patry\Downloads\UnityWebPlayer.exe

2014-01-28 20:34 - 2014-01-28 20:34 - 01307736 _____ (BitTorrent Inc.) C:\Users\Patry\Downloads\utorrent.exe

2014-01-25 20:15 - 2014-01-25 20:15 - 00000850 _____ () C:\Users\Zarze\Desktop\µTorrent.lnk

2014-01-25 20:15 - 2014-01-25 20:15 - 00000830 _____ () C:\Users\Zarze\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk

2014-01-25 20:14 - 2014-01-25 20:23 - 00000000 ____D () C:\Users\Zarze\AppData\Roaming\uTorrent

2014-01-25 20:13 - 2014-01-25 20:13 - 01307736 _____ (BitTorrent Inc.) C:\Users\Zarze\Downloads\utorrent.exe

 

==================== One Month Modified Files and Folders =======

 

2014-02-19 18:03 - 2014-02-19 18:03 - 00008088 _____ () C:\Users\Patry\Downloads\FRST.txt

2014-02-19 18:03 - 2014-02-19 18:03 - 00000000 ____D () C:\FRST

2014-02-19 18:02 - 2014-02-19 18:02 - 02153472 _____ (Farbar) C:\Users\Patry\Downloads\FRST64.exe

2014-02-19 18:01 - 2013-08-03 09:14 - 00742532 _____ () C:\Windows\system32\perfh00A.dat

2014-02-19 18:01 - 2013-08-03 09:14 - 00156638 _____ () C:\Windows\system32\perfc00A.dat

2014-02-19 18:01 - 2009-07-14 02:13 - 01669262 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-19 18:00 - 2014-02-18 08:06 - 00037188 _____ () C:\Windows\WindowsUpdate.log

2014-02-19 17:59 - 2014-02-18 14:54 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-19 17:57 - 2014-02-18 14:54 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-19 17:57 - 2014-02-18 11:58 - 00000504 _____ () C:\Windows\setupact.log

2014-02-19 17:57 - 2009-07-14 02:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-19 14:18 - 2014-02-19 14:18 - 00010572 _____ () C:\Users\Patry\Desktop\attach.txt

2014-02-19 14:18 - 2014-02-19 14:18 - 00009106 _____ () C:\Users\Patry\Desktop\dds.txt

2014-02-19 14:17 - 2014-02-19 14:17 - 00688992 ____R (Swearware) C:\Users\Patry\Downloads\dds.com

2014-02-19 13:37 - 2009-07-14 01:45 - 00021248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-19 13:37 - 2009-07-14 01:45 - 00021248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-19 13:29 - 2014-02-18 11:58 - 00003172 _____ () C:\Windows\PFRO.log

2014-02-19 12:09 - 2014-02-19 12:08 - 02347384 _____ (ESET) C:\Users\Patry\Downloads\esetsmartinstaller_esn (1).exe

2014-02-19 12:05 - 2009-07-14 02:32 - 00000000 ____D () C:\Windows\addins

2014-02-19 12:02 - 2014-02-19 12:02 - 00009799 _____ () C:\ComboFix.txt

2014-02-19 12:02 - 2014-02-19 11:51 - 00000000 ____D () C:\Qoobox

2014-02-19 12:00 - 2014-02-19 11:51 - 00000000 ____D () C:\Windows\erdnt

2014-02-19 11:59 - 2009-07-13 23:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-19 11:51 - 2014-02-19 11:50 - 05183341 ____R (Swearware) C:\Users\Patry\Downloads\ComboFix.exe

2014-02-19 11:48 - 2014-02-19 11:47 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\GetRightToGo

2014-02-19 11:17 - 2014-02-18 13:29 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-19 09:22 - 2014-02-19 09:22 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-02-19 09:22 - 2014-02-19 09:21 - 02347384 _____ (ESET) C:\Users\Patry\Downloads\esetsmartinstaller_esn.exe

2014-02-19 09:20 - 2009-07-14 02:32 - 00000000 ____D () C:\Windows\system32\FxsTmp

2014-02-18 20:28 - 2013-07-19 16:44 - 00000000 ___HD () C:\Windows\msdownld.tmp

2014-02-18 15:07 - 2013-07-27 11:30 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\Media Player Classic

2014-02-18 15:05 - 2013-07-20 10:16 - 00000000 ____D () C:\Program Files (x86)\VictorVal

2014-02-18 15:04 - 2014-02-18 15:04 - 00000000 ____D () C:\Windows\Sun

2014-02-18 15:02 - 2014-02-18 15:02 - 00003164 _____ () C:\Windows\System32\Tasks\{0C8823AE-F3E0-4E3E-BF5C-2CF1C6DB30D3}

2014-02-18 15:01 - 2014-02-18 15:01 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-02-18 15:01 - 2014-02-18 15:01 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\ProgramData\Sun

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\ProgramData\Oracle

2014-02-18 15:01 - 2014-02-18 15:01 - 00000000 ____D () C:\Program Files (x86)\Java

2014-02-18 15:00 - 2014-02-18 14:59 - 00921000 _____ (Oracle Corporation) C:\Users\Patry\Downloads\chromeinstall-7u51.exe

2014-02-18 14:57 - 2014-02-18 14:57 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-02-18 14:57 - 2013-07-19 14:52 - 00000000 ____D () C:\ProgramData\Adobe

2014-02-18 14:55 - 2014-02-18 14:55 - 00002257 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-18 14:55 - 2013-07-19 14:36 - 00000000 ____D () C:\Program Files (x86)\Google

2014-02-18 14:54 - 2014-02-18 14:54 - 00004094 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-02-18 14:54 - 2014-02-18 14:54 - 00003842 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-02-18 14:54 - 2014-02-18 14:54 - 00000000 ____D () C:\Users\Patry\AppData\Local\Deployment

2014-02-18 14:54 - 2014-02-18 14:54 - 00000000 ____D () C:\Users\Patry\AppData\Local\Apps\2.0

2014-02-18 13:35 - 2014-02-18 13:30 - 00000000 ____D () C:\AdwCleaner

2014-02-18 13:29 - 2014-02-18 13:29 - 00000000 ____D () C:\Users\Patry\Desktop\MBARB

2014-02-18 11:58 - 2014-02-18 11:58 - 00000000 _____ () C:\Windows\setuperr.log

2014-02-18 11:49 - 2013-07-19 19:09 - 00000000 ____D () C:\Program Files (x86)\Ares

2014-02-18 09:30 - 2014-02-18 09:30 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\Malwarebytes

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-02-18 09:30 - 2014-02-18 09:30 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-18 09:19 - 2013-09-08 17:24 - 00000000 ____D () C:\Users\Patry\AppData\Local\Adobe

2014-02-18 08:07 - 2014-02-18 08:06 - 00000000 ____D () C:\Users\Patry\Desktop\shexview-x64

2014-02-18 08:05 - 2013-09-13 14:19 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-02-18 08:05 - 2013-08-09 20:12 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\DAEMON Tools Lite

2014-02-18 08:05 - 2013-07-20 06:06 - 00000000 ____D () C:\Windows\Panther

2014-02-18 08:02 - 2013-12-07 11:30 - 00000000 ____D () C:\Program Files (x86)\Sniper Elite Nazi Zombie Army 2

2014-02-18 07:40 - 2014-02-18 07:40 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\Users\Patry\AppData\Roaming\SUPERAntiSpyware.com

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com

2014-02-18 07:40 - 2014-02-18 07:40 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware

2014-02-18 07:03 - 2013-07-19 15:40 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack x64

2014-02-12 20:22 - 2013-08-14 08:20 - 00000000 ____D () C:\Users\Marcelo\AppData\Local\Adobe

2014-02-12 20:09 - 2014-02-12 20:09 - 00000000 ____D () C:\Users\Marcelo\AppData\Roaming\Mozilla

2014-02-12 20:07 - 2014-02-12 20:07 - 00283032 _____ (Mozilla) C:\Users\Marcelo\Downloads\Firefox Setup Stub 27.0.exe

2014-02-12 20:01 - 2014-02-12 20:00 - 00026354 _____ () C:\Users\Marcelo\Desktop\cc_20140212_200028.reg

2014-02-12 19:55 - 2014-02-12 19:55 - 00002776 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC

2014-02-12 19:55 - 2014-02-12 19:55 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-02-12 19:55 - 2014-02-12 19:55 - 00000000 ____D () C:\Program Files\CCleaner

2014-02-08 19:45 - 2014-02-08 19:26 - 00000000 ____D () C:\Program Files (x86)\Resident Evil 6

2014-02-08 19:41 - 2014-02-08 19:41 - 00001913 _____ () C:\Users\Marcelo\Desktop\Resident Evil 6.lnk

2014-02-08 18:39 - 2013-07-19 19:11 - 00000000 ____D () C:\Users\Marcelo\Desktop\My Shared Folder

2014-02-04 12:38 - 2014-02-04 12:38 - 00000000 ____D () C:\Users\Marcelo\Documents\CAPCOM

2014-02-03 16:29 - 2014-02-03 16:29 - 00000000 ____D () C:\Users\Patry\Documents\CAPCOM

2014-02-02 14:54 - 2014-02-02 14:54 - 05696668 _____ () C:\Users\Marcelo\Downloads\19 Canzoneta-Tango.- Con Carlos Lazzari.wma

2014-02-01 20:22 - 2014-02-01 20:23 - 00000055 _____ () C:\Users\Patry\Desktop\Links.txt

2014-02-01 20:17 - 2014-02-01 20:17 - 00000000 ____D () C:\Users\Patry\AppData\Local\MegaDownloader

2014-01-30 17:21 - 2014-01-30 17:21 - 01050624 _____ (Unity Technologies ApS) C:\Users\Patry\Downloads\UnityWebPlayer.exe

2014-01-28 20:34 - 2014-01-28 20:34 - 01307736 _____ (BitTorrent Inc.) C:\Users\Patry\Downloads\utorrent.exe

2014-01-26 00:28 - 2013-12-02 18:33 - 00000000 ____D () C:\Users\Patry\AppData\Local\Mozilla

2014-01-25 20:23 - 2014-01-25 20:14 - 00000000 ____D () C:\Users\Zarze\AppData\Roaming\uTorrent

2014-01-25 20:15 - 2014-01-25 20:15 - 00000850 _____ () C:\Users\Zarze\Desktop\µTorrent.lnk

2014-01-25 20:15 - 2014-01-25 20:15 - 00000830 _____ () C:\Users\Zarze\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk

2014-01-25 20:13 - 2014-01-25 20:13 - 01307736 _____ (BitTorrent Inc.) C:\Users\Zarze\Downloads\utorrent.exe

2014-01-25 18:47 - 2013-12-05 17:06 - 00000000 ____D () C:\Users\Zarze\AppData\Local\Mozilla

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

 

LastRegBack: 2014-02-18 12:58

 

==================== End Of Log ============================

Addition.txt

[kevinf80]

Upload a File to Virustotal

Go to http://www.virustotal.com/

• Click the Choose file button
• Navigate to the file C:\ProgramData\SysWOW64office0\riaiccapeaj.exe or just copy/paste it in.
• Click the Scan it tab
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Copy and paste the results back here please.
  

 

Kevin.....

[zarzelius]

Weird, cant find that folder.There is no SysWOW64Office folder inside programdata  in C.

It is not hidden either because i already set the folder options to show hidden ones.

Any ideas?

[kevinf80]

I believe is malicious, cannot find any information on that file, ok we continue..

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Next,

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 

• Double click on AdwCleaner.exe to run the tool.
  
• Vista/Windows 7/8 users right-click and select Run As Administrator
  
• Click on the Scan button.
  
• AdwCleaner will begin...be patient as the scan may take some time to complete.
  
• When it's done you'll see: Pending: Uncheck any elements you don't want removed.
  
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  
• Look over the log especially under Files/Folders for any program you want to save.
  
• If there's a program you want to save, just uncheck it from AdwCleaner.
  
• If you're not sure, post the log for review.
  
• If you're ready to clean it all up.....click the Clean button.
  
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  
• Copy and paste the contents of that logfile in your next reply.
  
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  
• To restore an item that has been deleted (if necessary):
  
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
  
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  
• The tool will open and start scanning your system.
  
• Please be patient as this can take a while to complete depending on your system's specifications.
  
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  
• Post the contents of JRT.txt into your next message.
  

 

Next,

 

Run Malwarebytes,  Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Full scan

Make sure that everything is checked, and click Remove Selected on any found items.

 

Post the produced log

 

Let me see those logs in next reply....

 

Kevin

fixlist.txt

[zarzelius]

Ill do it as soon as i get home and post the results here.Thanx!

[kevinf80]

Thank you  for the update....

[zarzelius]

I havent been home yet.Im sorry about the delay in the response but i have been working outside and will be till tonight.

It is ok if i do it tonight and send you the logs tomorrow first thing in the morning?

Again sorry and thanx for your help!

[kevinf80]

Anytime you`re ready is ok by me....

[zarzelius]

I couldnt finish the junkware removal tool because  it got stucked on the registry scan for 2 hours so i closed it.

The rest worked wonderfully.

The last malwarebytes scan came clean but i still have problems with the browser altho im not sure is related now.

I want to tell you that i ran the fix you gave me twice , and that is why i attached 2 of those fixlogs.It was because the 1st time it couldnt remove one file, but it was successfull on the second.

I know you didnt adviced me to do it but i thought it wouldnt hurt.Sorry if it was a mistake.

 

Fixlog.txt

AdwCleanerS1.txt

mbam-log-2014-02-21 (10-10-23).txt

Fixlog2.txt

[kevinf80]

Which browser is the issue with, also what is the issue..

[zarzelius]

Im using chrome and it crashes randomly.I havent tried firefox which was crashing due to a shockwave flash plugin error.

Also havent tried to install adobe flash player which was impossible before due to the installation crashing half way from finishing.

Want me to try that and see if it works now?

[kevinf80]

Run the following, when complete see how each browser responds..

 

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save that zip file to your Desktop. Make sure to select direct on the word “Zip”

 

Double click zip file and extract to your  Desktop:

 

 

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

http://i121.photobucket.com/albums/o239/kevinf80/Zoek%20Scanner/Zoeke.jpg[/img]

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

 

 

Copy and paste the following script from the code box and paste into the field.

 

 

standardsearch;autoruns;autoclean;emptyclsid;emptyalltemp;installedprogs;FFdefaults;CHRdefaults; 

 

 

Select the "Run Script" tab. The following window will open:

 

 

 

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

 

Post the produced log in your next reply…..

 

Kevin....

[zarzelius]

Sorry for the delay but i was away.

 

Here is the log file.I will leave chrome open and see if it crashes now.It seems to be working better now.

zoek-results.txt

[kevinf80]

What is the status of Chrome, also Firefox, any improvement?

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• click on the Run ESET Online Scanner button
  
• Tick the box next to YES, I accept the Terms of Use.
  Click Start
  
• When asked, allow the add/on to be installed
  Click Start
  
• Make sure that the option Remove found threats is unticked
  
• Click on Advanced Settings, ensure the options
  
• Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  Click Scan
  
• wait for the virus definitions to be downloaded
  
• Wait for the scan to finish
  

 

When the scan is complete

 

• If no threats were found
  
• put a checkmark in "Uninstall application on close"
  
• close program
  
• report to me that nothing was found
  

 

If threats were found

 

• click on "list of threats found"
  
• click on "export to text file" and save it as ESET SCAN and save to the desktop
  
• Click on back
  
• put a checkmark in "Uninstall application on close"
  
• click on finish
  

 

close program

 

copy and paste the report in next reply

 

Next,

 

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)

Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

Kevin...

[zarzelius]

Ok .So far im using chrome and is working as a charm.

Pc seems to be working flawlessly so im glad for that.

I will run the eset scan tonight and post the result later.

 

Just to know, any free resident tool that i can leave on that computer after finishing so it will lower the chances of getting infected again?

Thanx!

[kevinf80]

Good to hear your system is responding well, post the ESET log whenever you`re ready...

 

Regarding security,  Read the following link to fully understand PC security and best practices, you may find it useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

My own security set up for Windows 7 is :-

 

Windows own Firewall, Microsoft Security Essentials and Malwarebytes Pro. Windows FW and MSE are free, MB does also have a free version, however I prefer the pro version as it provides auto updates and realtime protection.

 

As an extra layer I also use WinPatrol, the free version is adeqaute for general home use. Available here: http://www.winpatrol.com/download.html

 

For my browser I use Firefox with these addons: Web of Trust, Adblock Plus, Flash Block, NoScipt, Ghostery. When Firefox is open select these keys together :- Ctrl - Shift - A that will access Addons manger, this gives access to find addons, use, start, stop or disable those features etc....

Before using NoScript read from this link http://noscript.net/ makes it easy to understand....

 

Understanding Windows 7 Firewall - http://windows.microsoft.com/en-GB/windows7/Understanding-Windows-Firewall-settings

 

Understanding Microsoft Security Essentials - http://www.microsoft.com/en-gb/security/pc-security/mse.aspx

 

Understanding Malwarebytes, how to create an exclusion in MSE - http://forums.malwarebytes.org/index.php?showtopic=10138&st=0&p=162100entry162100

 

Understanding WinPatrol - http://www.winpatrol.com/features.html

 

I also use the Professional version of Sandboxie, I believe there is also free version available. Visit this link http://www.sandboxie.com/ for access to d/l, also make sure to use the "Help and FAQ" option to understand its uses, specifically how to run your browser sandboxed!.

 

I have also just started using CryptoGuard by Hitman Pro, once installed it will protect all Browsers against crypto ransomware infections, is also free. Go to following link for instructions, it will work with the set up I describe above..

 

http://www.surfright.nl/en/alert/cryptoguard'>http://www.surfright.nl/en/alert/cryptoguard

[zarzelius]

Thanx for exelent support and feedback on my last question.Ill try to post the eset scan as soon as i get back but my gf told me is working perfect so i believe iwe wont have more problems( i hope)

Ill also try the sofware you recoment, sounds really good.

[kevinf80]

Thanks for the update, post ESET log when you`re ready, we should be able to clean up and remove tools etc when ESET is done...

 

Thanks,

 

Kevin

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!