Misread link, downloaded .jpg instantly from tinyurl

pezuy · November 11, 2014

I am not sure if I am allowed to paste a link with a path provided by preview.tinyurl.com, so at this point I will not paste it but I will if needed.

So short story:

I was browsing gaming forum and there was imgur link from one of the posters, which actually was tinyurl.com/IMAGE-xXxXxXx (xxxx are really numbers but I will keep them away since I do no think its appropriate to post infected links here), but I misread it and clicked it. It instantly downloaded picture to my computer, but as soon as I realized this I went to the file location and deleted instantly without opening it.

I have tried scanning my computer with safe modes on, with Malwarebytes, Norton 360 and Spybot too, but have not found anything and now I am being paranoid all the time wether or not I should even log to emails etc without some prick getting my informations.

So do I have malware on loose or should I just let it be? Thank you for reading!

pezuy · November 13, 2014

Posted this thread 11.11, its 13th now, I am not sure if allowed to bump or not. Still in need of help ;c Computer feels slower after I clicked the link but so far I have found nothing that implies to malware nor virus. Might be in my head too

Naathim · November 13, 2014

Hi

First of all don't get paranoid. Let me check what is going on there.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;process;services-list;systemspecs;startupall;skipfix-iedefaults;firefoxlook;chromelook;filesrcm;installedprogs;

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

pezuy · November 14, 2014

Hello! Thank you for replying! I did what you asked, but when I hit "scan" there were options to quick scan, deep scan, quick scan + clean and deep scan + clean. But I only did the deep scan. But here are the notepad that popped in the end:

-----------------------------------------------------------------------------

Zoek.exe v5.0.0.0 Updated 13-November-2014

Tool run by Petri on pe 14.11.2014 at 16:23:06,59.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Petri\Downloads\zoek.exe [scan all users] [Deep Scan]

==== System Restore Info ======================

14.11.2014 16:27:36 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Users\Petri\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Adobe\Photoshop Elements 12\PhotoshopElementsEditor.exe

C:\Users\Petri\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe

C:\Users\Petri\AppData\Local\Google\Chrome\Application\chrome.exe

C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe

C:\Users\Petri\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Battle.net\Battle.net.5191\Battle.net.exe

C:\Users\Petri\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\cmd.exe

C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe

C:\Windows\SysWOW64\cmd.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe

==== System Specs ======================

Windows: Windows 7 Professional Edition (64-bit) Service Pack 1 (Build 7601)

Memory (RAM): 8169 MB

CPU Info: Intel® Core i5-2500K CPU @ 3.30GHz

CPU Speed: 3307,8 MHz

Sound Card: PHILIPS FTV-4 (NVIDIA High Defi |

Speakers (Realtek High Definiti |

Realtek Digital Output (Realtek |

Realtek Digital Output(Optical) |

SPDIF Out (Creative SB X-Fi) |

Monitors: 2x; Generic PnP Monitor | Generic PnP Monitor |

Screen Resolution: 1920 X 1080 - 32 bit

Network: Network Present

Network Adapters: Realtek PCIe GBE Family Controller

CD / DVD Drives: 1x (E: | ) E: DTSOFT BDROM

Ports: COM1 LPT Port NOT Present.

Mouse: 8 Button Wheel Mouse Present

Hard Disks: C: 931,4GB | D: 232,9GB | X: 119,2GB

Hard Disks - Free: C: 428,2GB | D: 19,5GB | X: 64,5GB

Manufacturer *: American Megatrends Inc.

BIOS Info: AT/AT COMPATIBLE | 02/05/10 | ALASKA - 1072009

Time Zone: FLE Standard Time

Motherboard *: ASUSTeK Computer INC. P8P67 REV 3.1

Country: Suomi

Language: FIN

==== System Specs (Software) ======================

Anti-Virus: Norton 360 On-access scanning disabled (Outdated)

Anti-Spyware: Norton 360 disabled (Outdated)

Anti-Spyware: Windows Defender disabled (Outdated)

Anti-Spyware: Spybot - Search and Destroy disabled (Outdated)

Firewall: Norton 360 disabled

Default Browser: Google Chrome 38.0.2125.111

Internet Explorer version: 8.0.7601.17514

Google Chrome version: 38.0.2125.111

Adobe Reader version: 10.1.8.24

Sun Java version: 1.7.0_06 (32-bit)

Flash Player version: 15.0.0.223

==== Files Recently Created / Modified ======================

====== C:\Windows ====

2014-10-27 18:56:40 01A4FEEB9CB3E8C739CE62EB050D363D 262 ----a-w- C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini

====== C:\Users\Petri\AppData\Local\Temp ====

2014-11-13 22:53:19 5243EF3BDAB96A51C6D4B8F42B058690 30883840 ----a-w- C:\Users\Petri\AppData\Local\Temp\STOPzilla!\SZPRO6.msi

2014-11-13 22:49:47 1BE52FA937585CCFEB9D0B6568B1C9D0 75264 ----a-w- C:\Users\Petri\AppData\Local\Temp\DeskMetrics.dll

2014-11-08 08:47:13 5C73E64374D9BA37AC5569D1F7DE5C9B 665682 ----a-w- C:\Users\Petri\AppData\Local\Temp\sqlite3.dll

2014-11-08 08:33:34 7AAB90847C56E6F7E922BB29D5B3EA8A 601088 ----a-w- C:\Users\Petri\AppData\Local\Temp\Quarantine.exe

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

2014-11-12 07:03:56 9AB39ADD28C7C1A685B1EA8C6A25CF08 146432 ----a-w- C:\Windows\SysWOW64\msaudite.dll

2014-11-12 07:03:56 980EEEE8815DA7593708774D1225BD35 681984 ----a-w- C:\Windows\SysWOW64\adtschema.dll

2014-11-12 07:03:56 9216ABFD53F5EC1F35C3554AD1A175DE 22016 ----a-w- C:\Windows\SysWOW64\secur32.dll

2014-11-12 07:03:56 13E5B1CD503A4B21E9F0A2D55A00198B 96768 ----a-w- C:\Windows\SysWOW64\sspicli.dll

2014-11-12 07:03:52 537184E7306E06BB22C5B93D2AFA4DF8 1237504 ----a-w- C:\Windows\SysWOW64\msxml3.dll

2014-11-12 07:03:52 09FA271EE1F9AD68B2D1C1C210F4B71F 2048 ----a-w- C:\Windows\SysWOW64\msxml3r.dll

2014-11-12 07:03:49 5FDBDEECA34E73325D87C5ACD16A3EEC 701440 ----a-w- C:\Windows\SysWOW64\IMJP10K.DLL

2014-11-12 07:03:45 FD79B005E849DF3D7E9B5EB7A637C528 374784 ----a-w- C:\Windows\SysWOW64\AudioEng.dll

2014-11-12 07:03:45 AA7325057A1E1CC401798C0B1238E182 195584 ----a-w- C:\Windows\SysWOW64\AudioSes.dll

2014-11-12 07:03:45 8D338464B851DDD76E2B876A3E09EB70 442880 ----a-w- C:\Windows\SysWOW64\AUDIOKSE.dll

2014-11-12 07:03:38 B580A6B9932669DE703001AEE66D5BB1 259584 ----a-w- C:\Windows\SysWOW64\msv1_0.dll

2014-11-12 07:03:38 9CEA80FFC617E6B6DD7B52E6225C0D38 65536 ----a-w- C:\Windows\SysWOW64\TSpkg.dll

2014-11-12 07:03:38 8FE6AB488ECDC60930CE973A7051B0D4 221184 ----a-w- C:\Windows\SysWOW64\ncrypt.dll

2014-11-12 07:03:38 8CFAEFCD7F1E004950FCAE870A501B3E 248832 ----a-w- C:\Windows\SysWOW64\schannel.dll

2014-11-12 07:03:38 8205E55DFB11809E5F2AAD1C48840535 17408 ----a-w- C:\Windows\SysWOW64\credssp.dll

2014-11-12 07:03:38 3B3B8BA16DC999EA17D075D2F1064DE4 550912 ----a-w- C:\Windows\SysWOW64\kerberos.dll

2014-11-12 07:03:38 37BC079204BF9B087D6DE6B728908B4B 172032 ----a-w- C:\Windows\SysWOW64\wdigest.dll

2014-11-12 07:03:33 0F39AC3274312EFFD03928291E8BA7CA 67584 ----a-w- C:\Windows\SysWOW64\packager.dll

2014-11-12 07:03:29 CB55B9AAB060C803BE4AD229AA0FEC28 2363904 ----a-w- C:\Windows\SysWOW64\msi.dll

2014-11-12 07:03:27 EDA54D2E17C0271D2CDA946ABE344110 571904 ----a-w- C:\Windows\SysWOW64\oleaut32.dll

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2014-11-12 07:03:56 C4C1B73FC2FF151BA08E1EAFDE2A2FAF 1460736 ----a-w- C:\Windows\Sysnative\lsasrv.dll

2014-11-12 07:03:56 7184AEACDA13E64B10F84E9DD79C8A01 146432 ----a-w- C:\Windows\Sysnative\msaudite.dll

2014-11-12 07:03:56 58F87BF5659C8EBC61EB439C916F2F9A 681984 ----a-w- C:\Windows\Sysnative\adtschema.dll

2014-11-12 07:03:56 008CD4EBFABCF78D0F19B3778492648C 683520 ----a-w- C:\Windows\Sysnative\termsrv.dll

2014-11-12 07:03:52 D005697F0467BBDDAB7638496DA5DB52 2048 ----a-w- C:\Windows\Sysnative\msxml3r.dll

2014-11-12 07:03:52 364ECFF4ABD9D575F4F7CF7EB7928EF3 1882624 ----a-w- C:\Windows\Sysnative\msxml3.dll

2014-11-12 07:03:49 1FEBD408F32DFC523882E7DA5AC57819 878080 ----a-w- C:\Windows\Sysnative\IMJP10K.DLL

2014-11-12 07:03:45 FAFCB80D42A65964B6F4945283B8C10F 296448 ----a-w- C:\Windows\Sysnative\AudioSes.dll

2014-11-12 07:03:45 DE3E38431B00C2EA247C53675DCF01A0 680960 ----a-w- C:\Windows\Sysnative\audiosrv.dll

2014-11-12 07:03:45 B1BB7B91C3C878FDB2874138CE81C4EF 284672 ----a-w- C:\Windows\Sysnative\EncDump.dll

2014-11-12 07:03:45 A2C9E45F4069A002E985D1563D16813B 440832 ----a-w- C:\Windows\Sysnative\AudioEng.dll

2014-11-12 07:03:45 9383B21A4B77C130940262DDC5F3F49B 500224 ----a-w- C:\Windows\Sysnative\AUDIOKSE.dll

2014-11-12 07:03:40 A71B81AC2C14ABA013CCF1225D9E3E36 342016 ----a-w- C:\Windows\Sysnative\schannel.dll

2014-11-12 07:03:39 109CC0DF72CC07A6CB59D2995255A1DA 309760 ----a-w- C:\Windows\Sysnative\ncrypt.dll

2014-11-12 07:03:38 DF30FC54FFF79BC744B22A4850A3CF92 86528 ----a-w- C:\Windows\Sysnative\TSpkg.dll

2014-11-12 07:03:38 55F0CF40479A1FC89CFA578909A540F2 210944 ----a-w- C:\Windows\Sysnative\wdigest.dll

2014-11-12 07:03:38 47C48C705F4F1EFC99B50B43AE4301FE 314880 ----a-w- C:\Windows\Sysnative\msv1_0.dll

2014-11-12 07:03:38 336BA030AB7B05300CB0B5C6AFB27176 22016 ----a-w- C:\Windows\Sysnative\credssp.dll

2014-11-12 07:03:38 028D99F83CBB31DB7995530B89EA13CF 728064 ----a-w- C:\Windows\Sysnative\kerberos.dll

2014-11-12 07:03:33 934735F508E297504460935B71E99F0B 77824 ----a-w- C:\Windows\Sysnative\packager.dll

2014-11-12 07:03:31 93C055B6AAD76360A60CB7E59A491531 3198976 ----a-w- C:\Windows\Sysnative\win32k.sys

2014-11-12 07:03:29 2720C94ADCC1727A66365CCB1CE456C4 3241984 ----a-w- C:\Windows\Sysnative\msi.dll

2014-11-12 07:03:27 B938AF16A521C913791C6F7AFF032757 861696 ----a-w- C:\Windows\Sysnative\oleaut32.dll

2014-11-11 16:06:12 82446D358A9FB51CB9DA32A5C901D7A0 21040 ----a-w- C:\Windows\Sysnative\sdnclean64.exe

====== C:\Windows\Sysnative\drivers =====

2014-11-13 21:43:22 975F2CAA23B9CF4420EAB6439BE4D233 37624 ----a-w- C:\Windows\Sysnative\drivers\TrueSight.sys

2014-11-12 07:03:56 41774FF331F609EF442B7398EE6202B1 155064 ----a-w- C:\Windows\Sysnative\drivers\ksecpkg.sys

2014-11-10 15:13:21 17D683EEA9FFD741A1ED8731ABBC23D1 131800 ----a-w- C:\Windows\Sysnative\drivers\MBAMSwissArmy.sys

2014-11-10 15:13:08 95EF63A7827D4E3A229CBBCB42619E93 63704 ----a-w- C:\Windows\Sysnative\drivers\mwac.sys

2014-11-10 15:13:08 5C3669B71657F22E67A1D4BD49D2CBE7 25816 ----a-w- C:\Windows\Sysnative\drivers\mbam.sys

2014-11-10 15:13:08 3540DDFAC8A076B983F86EB2A79D8FBD 96472 ----a-w- C:\Windows\Sysnative\drivers\mbamchameleon.sys

2014-10-21 07:14:47 64AEB5790901EA8854884981F104CAA6 18960 ----a-w- C:\Windows\Sysnative\drivers\LNonPnP.sys

2014-10-16 20:24:02 FE571E088C2D83619D2D48D4E961BF41 212480 ----a-w- C:\Windows\Sysnative\drivers\rdpwd.sys

2014-10-16 20:24:02 E232A3B43A894BB327FC161529BD9ED1 39936 ----a-w- C:\Windows\Sysnative\drivers\tssecsrv.sys

====== C:\Windows\Tasks ======

2014-11-13 22:50:01 5446ABB5635AB581E585E4C362030E2D 3146 ----a-w- C:\Windows\Sysnative\Tasks\{A0B6906C-6056-453F-8B04-F542F37EDCE4}

2014-11-11 16:06:29 -------- d-----w- C:\Windows\Sysnative\Tasks\Safer-Networking

====== C:\Windows\Temp ======

======= C:\Program Files =====

2014-11-13 07:36:10 -------- d-----w- C:\Program Files\iPod

2014-11-13 07:36:08 -------- d-----w- C:\Program Files\iTunes

2014-10-27 18:56:43 -------- d-----w- C:\Program Files\Ventrilo

======= C:\PROGRA~2 =====

2014-11-13 07:36:08 -------- d-----w- C:\PROGRA~2\iTunes

2014-11-07 17:12:05 -------- d-----w- C:\PROGRA~2\Battle.net

2014-10-27 19:02:34 -------- d-----w- C:\PROGRA~2\VentSrv

2014-10-27 18:56:07 -------- d-----w- C:\PROGRA~2\COMMON~1\Wise Installation Wizard

2014-10-20 12:22:47 -------- d-----w- C:\PROGRA~2\Steam

2014-10-18 21:21:26 -------- d-----w- C:\PROGRA~2\Microsoft ASP.NET

======= C: =====

====== C:\Users\Petri\AppData\Roaming ======

2014-11-11 16:08:44 -------- d-----w- C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Programs

2014-10-27 18:56:45 -------- d-----w- C:\Users\Petri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo

2014-10-23 21:28:09 -------- d-----w- C:\Users\Petri\AppData\Local\PAYDAY 2

2014-10-22 03:48:09 -------- d-----w- C:\Users\Petri\AppData\Local\NPE

2014-10-21 16:49:46 -------- d-----w- C:\Users\Petri\AppData\Roaming\Mumble

====== C:\Users\Petri ======

2014-11-13 22:50:58 5080A6769865315AF11722E0FB5D9AB8 2998656 ----a-w- C:\Users\Petri\Downloads\SpyHunter-Installer.exe

2014-11-13 22:49:33 8F41B14286A6667D7713E9D6B33A1EA2 707664 ----a-w- C:\Users\Petri\Downloads\SZSetup_AID10121_AV.exe

2014-11-13 22:44:32 6504113C2218667814D4F54847BA046A 2140160 ----a-w- C:\Users\Petri\Downloads\adwcleaner_4.101.exe

2014-11-13 21:43:19 -------- d-----w- C:\ProgramData\RogueKiller

2014-11-13 21:41:53 47C6E378E9D4819109AEAD73A72E4B80 17535064 ----a-w- C:\Users\Petri\Downloads\RogueKillerX64.exe

2014-11-13 10:24:40 02D817FF481EB12FE0CC34363809C05B 2116096 ----a-w- C:\Users\Petri\Downloads\frst64.exe

2014-11-13 07:36:38 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-11-13 07:36:08 -------- d-----w- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2014-11-11 17:45:48 405E11DD1024625E4ABB8925F3C3CBDA 14439144 ----a-w- C:\Users\Petri\Downloads\mbar-1.08.0.1001.exe

2014-11-11 16:28:15 2AD9820E4B17E78110A6AA06BF5C1CE2 4184008 ----a-w- C:\Users\Petri\Downloads\tdsskiller.exe

2014-11-11 15:17:22 9A8336796A7C71E9F33DE848B8320ED3 380416 ----a-w- C:\Users\Petri\Downloads\7bcbk4bb.exe

2014-11-11 14:54:43 8B968045D75783A09592C3105F2865DA 688992 ------r- C:\Users\Petri\Downloads\dds.com

2014-11-11 14:25:07 9A8336796A7C71E9F33DE848B8320ED3 380416 ----a-w- C:\Users\Petri\Downloads\p1nu1hwm.exe

2014-11-10 15:12:29 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Petri\Downloads\mbam-setup-2.0.3.1025.exe

2014-11-08 00:03:25 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone

2014-11-07 17:22:57 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft

2014-11-07 17:12:05 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net

2014-11-07 17:06:20 D53611191CFBBB805C1DC68FBF2485EF 2868792 ----a-w- C:\Users\Petri\Downloads\Battle.net-Setup-enGB.exe

2014-10-27 19:02:34 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VentSrv

2014-10-21 16:48:59 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mumble

2014-10-20 12:22:47 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

====== C: exe-files ==

2014-11-14 07:56:27 FF014FC26936DDB5FED71323C8C8B602 4375312 ----a-w- C:\Users\Petri\AppData\Local\NVIDIA\NvBackend\Packages\000067c0\DAO.19053070.exe

2014-11-14 07:56:27 E9252383496C120FA55CE9A03D31E94C 426056 ----a-w- C:\Users\Petri\AppData\Local\NVIDIA\NvBackend\Packages\000067be\CoProc update.19053990.exe

2014-11-13 22:50:58 5080A6769865315AF11722E0FB5D9AB8 2998656 ----a-w- C:\Users\Petri\Downloads\SpyHunter-Installer.exe

2014-11-13 22:49:33 8F41B14286A6667D7713E9D6B33A1EA2 707664 ----a-w- C:\Users\Petri\Downloads\SZSetup_AID10121_AV.exe

2014-11-13 22:44:32 6504113C2218667814D4F54847BA046A 2140160 ----a-w- C:\Users\Petri\Downloads\adwcleaner_4.101.exe

2014-11-13 21:41:53 47C6E378E9D4819109AEAD73A72E4B80 17535064 ----a-w- C:\Users\Petri\Downloads\RogueKillerX64.exe

2014-11-13 10:24:40 02D817FF481EB12FE0CC34363809C05B 2116096 ----a-w- C:\Users\Petri\Downloads\frst64.exe

2014-11-13 07:32:05 2BF25BB82936758771C99A2C70754E09 77104 ----a-w- C:\ProgramData\Apple Computer\Installer Cache\iTunes 12.0.1.26\SetupAdmin.exe

2014-11-12 07:55:32 C04B2A7C132168E175EFD142D28B9199 32352984 ----a-w- C:\ProgramData\NVIDIA Corporation\NetService\fb02833e-a93d-43c2-9ff2-1324f701c4bf\GeForce_Experience_Update_v2.1.4.0.exe

2014-11-11 17:46:42 C68AA07C443FB26A44E17A6649EE1D3C 821560 ----a-w- C:\Users\Petri\Desktop\mbar\Plugins\fixdamage.exe

2014-11-11 17:46:42 3CADE61FCDF50CC17ECB7664220E31DC 54072 ----a-w- C:\Users\Petri\Desktop\mbar\mbamdor.exe

2014-11-11 17:46:42 0A4EC663BF58FB4290674679FD075F58 1211192 ----a-w- C:\Users\Petri\Desktop\mbar\mbar.exe

2014-11-11 17:45:48 405E11DD1024625E4ABB8925F3C3CBDA 14439144 ----a-w- C:\Users\Petri\Downloads\mbar-1.08.0.1001.exe

2014-11-11 16:28:15 2AD9820E4B17E78110A6AA06BF5C1CE2 4184008 ----a-w- C:\Users\Petri\Downloads\tdsskiller.exe

2014-11-11 15:17:22 9A8336796A7C71E9F33DE848B8320ED3 380416 ----a-w- C:\Users\Petri\Downloads\7bcbk4bb.exe

2014-11-11 14:25:07 9A8336796A7C71E9F33DE848B8320ED3 380416 ----a-w- C:\Users\Petri\Downloads\p1nu1hwm.exe

2014-11-10 15:12:29 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Petri\Downloads\mbam-setup-2.0.3.1025.exe

2014-11-08 08:33:34 7AAB90847C56E6F7E922BB29D5B3EA8A 601088 ----a-w- C:\Users\Petri\AppData\Local\Temp\Quarantine.exe

2014-11-08 00:03:25 F62699E0CBAA07AF65048EFC33A8C720 10400304 ----a-w- C:\Hearthstone\Hearthstone.exe

2014-11-08 00:03:25 B8E8942CEAC065FC740B96AD6A8C6E7A 3055152 ----a-w- C:\Hearthstone\Hearthstone Beta Launcher.exe

2014-11-07 17:12:05 C69442812638BB1F21C1789D10E62013 1971760 ----a-w- C:\Program Files (x86)\Battle.net\SystemSurvey.exe

2014-11-07 17:12:05 C2703038EDF286117EC4ABE77897038D 399408 ----a-w- C:\Program Files (x86)\Battle.net\Battle.net.exe

2014-11-07 17:12:05 A829DDDC417B4BB4D8175DF1846B8BAA 1337424 ----a-w- C:\Program Files (x86)\Common Files\Blizzard Entertainment\Battle.net\Uninstall.exe

2014-11-07 17:12:05 9281BA1479347C2757EF6FBB52697921 333360 ----a-w- C:\Program Files (x86)\Battle.net\BlizzardError.exe

2014-11-07 17:12:05 65E168CE4D531B15C0E7DD52460DDE7B 9986608 ----a-w- C:\Program Files (x86)\Battle.net\Battle.net.5191\Battle.net.exe

2014-11-07 17:12:05 0FB5EB5C3639C88A02DADA0BBC079A58 2864688 ----a-w- C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe

2014-11-07 17:08:17 C714408EEFF4EA72239A39A97FA062E6 10615856 ----a-w- C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe

2014-11-07 17:06:20 D53611191CFBBB805C1DC68FBF2485EF 2868792 ----a-w- C:\Users\Petri\Downloads\Battle.net-Setup-enGB.exe

=== C: other files ==

2014-11-13 21:43:22 975F2CAA23B9CF4420EAB6439BE4D233 37624 ----a-w- C:\Windows\System32\drivers\TrueSight.sys

2014-11-12 07:03:56 41774FF331F609EF442B7398EE6202B1 155064 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2014-11-12 07:03:31 93C055B6AAD76360A60CB7E59A491531 3198976 ----a-w- C:\Windows\System32\win32k.sys

2014-11-11 14:54:43 8B968045D75783A09592C3105F2865DA 688992 ------r- C:\Users\Petri\Downloads\dds.com

2014-11-10 15:13:21 17D683EEA9FFD741A1ED8731ABBC23D1 131800 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys

2014-11-10 15:13:08 95EF63A7827D4E3A229CBBCB42619E93 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys

2014-11-10 15:13:08 5C3669B71657F22E67A1D4BD49D2CBE7 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys

2014-11-10 15:13:08 3540DDFAC8A076B983F86EB2A79D8FBD 96472 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-11-08 17:52:20 9A92A30DB657636DDF39781660EDFF09 15654 ----a-w- C:\Users\Petri\Downloads\the.walking.dead.slabtown.(2014).eng.1cd.(5880611).zip

==== Startup Registry Enabled ======================

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CtxfiReg"="CTXFIREG.exe /FAIL1"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-1149593954-1596858650-3402885492-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe /c"

"Spotify Web Helper"="C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

"Spotify Web Helper"=""C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" "

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]

"CtxfiReg"="CTXFIREG.exe /FAIL1"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SDTray"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe /c"

"Spotify Web Helper"="C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

"Spotify Web Helper"=""C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" "

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"ShadowPlay"="C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart"

"NvBackend"="C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

"Launch LCore"="C:\Program Files\Logitech Gaming Software\LCore.exe /minimized"

==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\APSDaemon]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="APSDaemon"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AthBtTray]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="AthBtTray"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\Bluetooth Suite\\AthBtTray.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AtherosBtStack]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="AtherosBtStack"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\Bluetooth Suite\\BtvStack.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AtwtusbIcon]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="AtwtusbIcon"

"hkey"="HKLM"

"command"="AtwtusbIcon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CAHeadless]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="CAHeadless"

"hkey"="HKCU"

"command"="C:\\Program Files (x86)\\Adobe\\Elements 12 Organizer\\CAHeadless\\ElementsAutoAnalyzer.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTxfiHlp]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="CTxfiHlp"

"hkey"="HKLM"

"command"="CTXFIHLP.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Dyyno Launcher]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Dyyno Launcher"

"hkey"="HKCU"

"command"="\"C:\\Program Files (x86)\\Dyyno\\Dyyno Broadcaster\\dyyno_launcher.exe\" 30100 30101 30102 30103 30104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EADM]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="EADM"

"hkey"="HKCU"

"command"="\"C:\\Program Files (x86)\\Origin\\Origin.exe\" -AutoStart"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Family Tree Builder Update]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Family Tree Builder Update"

"hkey"="HKLM"

"command"="C:\\Program Files (x86)\\MyHeritage\\Bin\\FTBCheckUpdates.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="iTunesHelper"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msnmsgr]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="msnmsgr"

"hkey"="HKCU"

"command"="\"C:\\Program Files (x86)\\Windows Live\\Messenger\\msnmsgr.exe\" /background"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Skype"

"hkey"="HKCU"

"command"="\"C:\\Program Files (x86)\\Skype\\Phone\\Skype.exe\" /minimized /regrun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Spotify Web Helper]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Spotify Web Helper"

"hkey"="HKCU"

"command"="\"C:\\Users\\Petri\\AppData\\Roaming\\Spotify\\Data\\SpotifyWebHelper.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="WinampAgent"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\Apple Mobile Device]

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [13.11.2014 20:05]

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1149593954-1596858650-3402885492-1000Core.job --a------ [undetermined Task]

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1149593954-1596858650-3402885492-1000UA.job --a------ C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe [31.03.2012 12:40]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\SysNative\tasks\AdobeAAMUpdater-1.0-Petri-PC-Petri" [C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe]

"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskUserS-1-5-21-1149593954-1596858650-3402885492-1000Core" [C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskUserS-1-5-21-1149593954-1596858650-3402885492-1000UA" [C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\Norton WSC Integration" ["C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\WSCStub.exe"]

"C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]

"C:\Windows\SysNative\tasks\Norton 360\Norton Error Analyzer" [C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe]

"C:\Windows\SysNative\tasks\Norton 360\Norton Error Processor" [C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe]

"C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

"C:\Windows\SysNative\tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates" ["C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"]

"C:\Windows\SysNative\tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization" ["C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe"]

"C:\Windows\SysNative\tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system" ["C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe"]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF" [18.11.2013 17:01]

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

iikflkcanblccfahdhdonehdalibjnif - No path found[]

mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\Exts\Chrome.crx[20.09.2014 10:52]

YouTube - Petri\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - Petri\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Google Wallet - Petri\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - Petri\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

undetermined - Petri\AppData\Local\Google\Chrome\User Data\Default\Extensions\1.93.rar

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

No DefaultScope Set For HKCU

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{00574AAA-C4D3-4fff-9AAB-3D0C612BB2F8} Yahoo Url="http://fi.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{7910D2B8-97D5-48ba-96D2-B4C0D214775E} Google Url="http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=fi&q={searchTerms}"

==== HijackThis Entries ======================

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

R3 - URLSearchHook: (no name) - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll

O4 - HKLM\..\Run: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\Petri\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Petri\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CtxfiReg] CTXFIREG.exe /FAIL1 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CtxfiReg] CTXFIREG.exe /FAIL1 (User 'Default user')

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab

O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} (Creative Software AutoUpdate 2) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)

O23 - Service: Adobe Active File Monitor V12 (AdobeActiveFileMonitor12.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe

O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe

O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: WTService - Unknown owner - C:\Windows\system32\atwtusb.exe (file missing)

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== EOF on pe 14.11.2014 at 16:33:48,12 ======================

Naathim · November 14, 2014

This is not what I was asking for.

I gave you complete instructions what you have to do - please re-read them carefully and do this again

pezuy · November 14, 2014

Sorry. I noticed some odd in my task manager "pevz.exe" it appeared after disabling Norton Smart Firewall. Googled says its malicious trojan

however here are the results

---

Zoek.exe v5.0.0.0 Updated 13-November-2014

Tool run by Petri on pe 14.11.2014 at 16:58:20,27.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Petri\Desktop\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2014-11-14-143348.log 39750 bytes

==== System Restore Info ======================

14.11.2014 16:58:47 Zoek.exe System Restore Point Created Succesfully.

==== Installed Programs ======================

æTorrent

Adobe AIR

Adobe Download Assistant

Adobe Flash Media Live Encoder 3.2

Adobe Flash Player 15 ActiveX

Adobe Flash Player 15 Plugin

Adobe Photoshop Elements 12

Adobe Photoshop Lightroom 5.2 64-bit

Adobe Reader X (10.1.8) - Suomi

Apple Mobile Device Support

Apple Software Update

Applen ohjelmatuki

Asmedia ASM104x USB 3.0 Host Controller Driver

Audacity 2.0

Battle.net

Battlefield 3T

Battlelog Web Plugins

Bonjour

Canon MP250 series MP Drivers

CCleaner

Counter-Strike: Global Offensive

Creative ALchemy

Creative Audio Control Panel

Creative Console Launcher

Creative MediaSource 5

Creative Software AutoUpdate

Creative Sound Blaster Properties x64 Edition

Creative WaveStudio 7

D3DX10

DAEMON Tools Lite

Digital Dogsitter

Elements 12 Organizer

ESN Sonar

Fliqlo Screen Saver

Google Chrome

Hearthstone

Intel® Management Engine Components

iTunes

Java 7 Update 6

Java Auto Updater

Java 6 Update 22

Java 6 Update 31

JavaFX 2.1.0

Junk Mail filter update

Logitech Gaming Software 8.56

Malwarebytes Anti-Malware version 2.0.3.1025

marvell 91xx driver

Microsoft .NET Framework 4.5.1

Microsoft Application Error Reporting

Microsoft ASP.NET MVC 4 Runtime

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106

Microsoft WSE 3.0 Runtime

MSI Afterburner 2.3.1

MSVCRT

MSVCRT_amd64

Mumble 1.2.8

MyHeritage Family Tree Builder

NirSoft BlueScreenView

Norton 360

NVIDIA 3D Vision Controller Driver 344.11

NVIDIA 3D Vision Driver 344.11

NVIDIA Control Panel 344.11

NVIDIA GeForce Experience 2.1.2

NVIDIA GeForce Experience Service

NVIDIA Graphics Driver 344.11

NVIDIA HD Audio Driver 1.3.32.1

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA Network Service

NVIDIA PhysX

NVIDIA ShadowPlay 16.13.42

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 16.13.42

NVIDIA Update Core

NVIDIA Virtual Audio 1.2.25

OpenAL

OpenOffice.org 3.3

Origin

PAYDAY 2

PSE12 STI Installer

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)

Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)

Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)

Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)

Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)

Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)

Security Update for Microsoft .NET Framework 4.5.1 (KB2978128)

Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)

SHIELD Streaming

SHIELD Wireless Controller Driver

SimCity 4 Deluxe

SimCityT

Spotify

Spybot - Search & Destroy

Steam

The SimsT 3

The SimsT 3 70-, 80- ja 90-luku Kamasetti

The SimsT 3 Baana auki Kamasetti

The SimsT 3 Diesel Kamasetti

The SimsT 3 Iltahuvit

The SimsT 3 Leffa Kamasetti

The SimsT 3 Lemmikit

The SimsT 3 Luksuslukaali Kamasetti

The SimsT 3 Maailmanmatkaaja

The SimsT 3 Makkari & Kylpp„ri Kamasetti

The SimsT 3 Paratiisisaari

The SimsT 3 Pihaparatiisi Kamasetti

The SimsT 3 Supernatural

The SimsT 3 Superstara

The SimsT 3 Tulevaisuuteen

The SimsT 3 T„ytt„ El„m„„

The SimsT 3 Unelmaduuni

The SimsT 3 Vuodenajat

The SimsT 3 Yliopistoel„m„„

Trust tablet driver

VC 9.0 Runtime

Ventrilo Client for Windows x64

Ventrilo Server

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Liven asennusty”kalu

Windows Liven s„hk”posti

WinRAR 5.10 beta 4 (64-bit)

VLC media player

World of Warcraft