shyguy80 Posted February 16, 2015 ID:940197 Share Posted February 16, 2015 Popped up on me while i was chatting on skype. Dont think skype had anything to do with it though. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015Ran by Exodus (administrator) on EXODUS-PC on 16-02-2015 15:27:14Running from C:\Users\Exodus\DownloadsLoaded Profiles: Exodus (Available profiles: Exodus)Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 10 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe(AMD) C:\Windows\System32\atieclxx.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Camshare Inc.) C:\Program Files (x86)\Camfrog\Camfrog Video Chat\update\cf_update_service.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\NetBak.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe() C:\Windows\System32\PnkBstrA.exe(Cyber Power Systems, Inc.) C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe(QNAP Systems, Inc.) C:\Program Files\QNAP\NetBak\QVssService.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Cyber Power Systems, Inc.) C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe(Dropbox, Inc.) C:\Users\Exodus\AppData\Roaming\Dropbox\bin\Dropbox.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.3733\Agent.exe(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtAvAC.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.5522\Battle.net.exe(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosSkypeApl.exe(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe(Trend Micro Inc.) C:\Users\Exodus\Downloads\HijackThis.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor)HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [12697368 2014-10-14] (Logitech Inc.)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)HKLM-x32\...\Run: [PowerPanel Personal Edition User Interaction] => C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\pppeuser.exe [362896 2014-06-23] (Cyber Power Systems, Inc.)HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\Run: [steam] => C:\Program Files (x86)\Steam\steam.exe [2874048 2015-02-13] (Valve Corporation)HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\Run: [battle.net] => C:\Program Files (x86)\Battle.net\Battle.net Launcher.exe [2861104 2015-02-05] (Blizzard Entertainment)HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30879328 2014-12-11] (Skype Technologies S.A.)HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\Run: [HP ENVY 4500 series (NET)] => C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\MountPoints2: {4b7c9b8a-69a3-11e4-b501-d0509929872f} - G:\VZW_Software_upgrade_assistant.exeHKU\S-1-5-18\...\RunOnce: [sPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-08-16] (Microsoft Corporation)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnkShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnkShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{3A435941-E398-438A-9CAF-31D8996CF7C8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)Startup: C:\Users\Exodus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehpSearchScopes: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000 -> DefaultScope {14FC8396-931C-47F7-8BB8-C596891FD322} URL = https://www.google.com/search?q={searchTerms}SearchScopes: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000 -> {14FC8396-931C-47F7-8BB8-C596891FD322} URL = https://www.google.com/search?q={searchTerms}SearchScopes: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000 -> {F97C2835-23F8-4E7E-BE9A-C2428C1C9504} URL = http://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBoxBHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox:========FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: =======CHR HomePage: Default -> hxxp://www.google.com/CHR StartupUrls: Default -> "hxxp://www.google.com/"CHR Profile: C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Docs) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-16]CHR Extension: (Google Drive) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-16]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-16]CHR Extension: (YouTube) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-16]CHR Extension: (Adblock Plus) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-16]CHR Extension: (Google Search) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-16]CHR Extension: (Google Wallet) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-16]CHR Extension: (Gmail) - C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-16] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 camfrog_update_service; C:\Program Files (x86)\Camfrog\Camfrog Video Chat\update\cf_update_service.exe [1032680 2014-10-02] (Camshare Inc.)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1900400 2014-11-26] (Electronic Arts)R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-09-29] ()R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-17] ()R2 ppped; C:\Program Files (x86)\CyberPower PowerPanel Personal Edition\ppped.exe [1034640 2014-06-23] (Cyber Power Systems, Inc.)R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [344576 2014-04-17] (Qualcomm Atheros) [File not signed]R2 QVssService; C:\Program Files\QNAP\NetBak\QVssService.exe [2203824 2014-06-11] (QNAP Systems, Inc.)R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [82096 2014-04-10] (Qualcomm Atheros, Inc.)R3 CORK70; C:\Windows\System32\drivers\CORK70.sys [25600 2012-10-31] ( )S3 CorsairVBusDriver; C:\Windows\System32\DRIVERS\CorsairVBusDriver.sys [48808 2014-11-25] (Corsair)S3 CorsairVHidDriver; C:\Windows\System32\DRIVERS\CorsairVHidDriver.sys [22696 2014-11-25] (Corsair)R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-18] ()R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [129200 2014-03-12] (Qualcomm Atheros, Inc.)R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49264 2014-07-28] (Visicom Media Inc.)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-16] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35440 2014-05-13] (Visicom Media Inc.)R3 QDrive; \??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys [X]S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]S3 tsusbhub; system32\drivers\tsusbhub.sys [X]S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 15:27 - 2015-02-16 15:27 - 00017884 _____ () C:\Users\Exodus\Downloads\FRST.txt2015-02-16 15:26 - 2015-02-16 15:27 - 00000000 ____D () C:\FRST2015-02-16 15:25 - 2015-02-16 15:26 - 02085888 _____ (Farbar) C:\Users\Exodus\Downloads\FRST64.exe2015-02-16 15:17 - 2015-02-16 15:17 - 00388608 _____ (Trend Micro Inc.) C:\Users\Exodus\Downloads\HijackThis.exe2015-02-16 14:48 - 2015-02-16 14:53 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)2015-02-16 14:43 - 2015-02-16 14:53 - 00000000 ____D () C:\Users\Exodus\Desktop\mbar2015-02-16 14:43 - 2015-02-16 14:43 - 16466552 _____ (Malwarebytes Corp.) C:\Users\Exodus\Downloads\mbar-1.08.3.1004.exe2015-02-16 14:37 - 2015-02-16 14:40 - 00000000 ____D () C:\ProgramData\HitmanPro2015-02-16 13:28 - 2015-02-16 13:28 - 00358912 ____T () C:\ProgramData\CC70E0638.zot2015-02-15 01:12 - 2015-02-15 01:12 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar2015-02-13 21:26 - 2015-02-13 21:26 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task2015-02-09 17:50 - 2015-02-09 17:50 - 00181656 _____ (Microsoft Corporation) C:\Users\Exodus\Downloads\trilogyi.exe2015-02-09 17:49 - 2015-02-09 17:49 - 00374784 _____ (Microsoft Corporation) C:\Users\Exodus\Downloads\wm9viz.exe2015-02-09 17:47 - 2015-02-09 17:47 - 00173264 _____ (Microsoft Corporation) C:\Users\Exodus\Downloads\colorcubesviz.exe2015-02-05 04:58 - 2015-02-05 04:58 - 00000000 ____D () C:\Users\Exodus\AppData\Local\Steam2015-01-17 09:06 - 2015-01-17 09:06 - 02941091 _____ () C:\Users\Exodus\Downloads\HDT Havok Object v1.2.7z2015-01-17 00:57 - 2015-01-17 00:57 - 03570964 _____ () C:\Users\Exodus\Downloads\HDT Hold Capital Guard Cloaks Replacers - Cloaks Of Skyrim.7z ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-16 15:26 - 2014-08-16 05:09 - 00000000 ____D () C:\Users\Exodus\AppData\Local\Battle.net2015-02-16 15:23 - 2014-08-16 01:01 - 00000000 ____D () C:\Users\Exodus\AppData\Roaming\Skype2015-02-16 15:17 - 2014-08-15 21:42 - 00000000 ____D () C:\Users\Exodus\AppData\Local\VirtualStore2015-02-16 15:09 - 2014-08-16 00:45 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-02-16 15:04 - 2014-08-16 00:36 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-02-16 15:00 - 2009-07-13 23:45 - 00014048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-02-16 15:00 - 2009-07-13 23:45 - 00014048 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-02-16 14:59 - 2009-07-14 00:13 - 00781790 _____ () C:\Windows\system32\PerfStringBackup.INI2015-02-16 14:57 - 2014-08-15 21:43 - 01206553 _____ () C:\Windows\WindowsUpdate.log2015-02-16 14:54 - 2014-08-22 05:22 - 00000000 ___RD () C:\Users\Exodus\Dropbox2015-02-16 14:54 - 2014-08-22 05:21 - 00000000 ____D () C:\Users\Exodus\AppData\Roaming\Dropbox2015-02-16 14:54 - 2009-07-13 23:51 - 00032725 _____ () C:\Windows\setupact.log2015-02-16 14:53 - 2014-12-04 00:48 - 00000000 ____D () C:\Program Files (x86)\CyberPower PowerPanel Personal Edition2015-02-16 14:53 - 2014-08-16 01:22 - 00000000 ____D () C:\Program Files (x86)\Steam2015-02-16 14:53 - 2014-08-16 00:36 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-02-16 14:53 - 2014-08-16 00:00 - 00031596 _____ () C:\Windows\PFRO.log2015-02-16 14:53 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\addins2015-02-16 14:53 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-02-16 14:43 - 2014-08-16 00:45 - 00097496 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2015-02-16 14:13 - 2014-11-11 08:10 - 00000000 ____D () C:\Windows\pss2015-02-16 13:37 - 2014-08-16 00:36 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-02-16 13:09 - 2014-08-16 05:20 - 00000000 ____D () C:\Users\Exodus\AppData\Roaming\vlc2015-02-15 15:22 - 2014-08-16 02:14 - 00000000 ____D () C:\Users\Exodus\AppData\Roaming\Camfrog2015-02-15 01:12 - 2009-07-14 00:32 - 00000000 ____D () C:\Program Files\Windows Sidebar2015-02-13 21:27 - 2014-08-22 05:22 - 00000982 _____ () C:\Users\Exodus\Desktop\Dropbox.lnk2015-02-13 21:27 - 2014-08-22 05:21 - 00000000 ____D () C:\Users\Exodus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox2015-02-13 21:25 - 2014-10-16 20:56 - 00000000 ___RD () C:\Program Files (x86)\Skype2015-02-13 21:25 - 2014-08-16 01:01 - 00000000 ____D () C:\ProgramData\Skype2015-02-13 21:24 - 2014-08-15 21:42 - 00000000 ____D () C:\Users\Exodus2015-02-12 07:03 - 2014-08-16 00:46 - 00000343 _____ () C:\Users\Exodus\Desktop\Bills.txt2015-02-06 11:07 - 2014-08-16 00:36 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2015-02-05 20:51 - 2014-08-16 05:09 - 00000000 ____D () C:\Program Files (x86)\Battle.net2015-02-05 09:37 - 2015-01-14 05:37 - 05070512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2015-02-05 09:37 - 2014-08-16 00:36 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-02-05 09:37 - 2014-08-16 00:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-02-05 09:37 - 2014-08-16 00:36 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-02-04 17:59 - 2014-08-16 00:36 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-02-04 17:59 - 2014-08-16 00:36 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-02-04 02:54 - 2014-10-17 09:57 - 00000000 ____D () C:\Users\Exodus\AppData\Local\ManyCam2015-01-28 18:34 - 2014-10-25 13:18 - 00000000 ____D () C:\ProgramData\Camfrog Update2015-01-20 05:19 - 2014-08-16 03:22 - 00002282 _____ () C:\Users\Exodus\Desktop\New Text Document.txt ==================== Files in the root of some directories ======= 2014-09-26 21:30 - 2014-12-18 06:14 - 0000175 _____ () C:\Users\Exodus\AppData\Roaming\Camdata.ini2014-09-26 21:30 - 2014-12-18 06:14 - 0000408 _____ () C:\Users\Exodus\AppData\Roaming\CamLayout.ini2014-09-26 21:30 - 2014-12-18 06:14 - 0000408 _____ () C:\Users\Exodus\AppData\Roaming\CamShapes.ini2014-09-26 21:30 - 2014-12-18 06:14 - 0004596 _____ () C:\Users\Exodus\AppData\Roaming\CamStudio.cfg2014-10-06 00:06 - 2014-10-06 00:06 - 80188244 _____ () C:\Users\Exodus\AppData\Roaming\minecraftserv.rar2014-09-26 21:26 - 2014-10-02 22:16 - 0000096 _____ () C:\Users\Exodus\AppData\Roaming\version2.xml2014-08-15 21:43 - 2014-08-15 21:43 - 0000000 _____ () C:\Users\Exodus\AppData\Local\Driver_LOM_8161Present.flag2014-08-16 03:36 - 2014-11-26 19:39 - 0007597 _____ () C:\Users\Exodus\AppData\Local\Resmon.ResmonCfg2014-10-24 15:49 - 2014-10-24 15:49 - 0000057 _____ () C:\ProgramData\Ament.ini2015-02-16 13:28 - 2015-02-16 13:28 - 0358912 ____T () C:\ProgramData\CC70E0638.zot2014-08-22 04:46 - 2014-08-22 04:46 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Some content of TEMP:====================C:\Users\Exodus\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbrrlul.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 00:11 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2015Ran by Exodus at 2015-02-16 15:27:25Running from C:\Users\Exodus\DownloadsBoot Mode: Normal========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)AMD Catalyst Install Manager (HKLM\...\{C6982BF7-07FB-5D79-2001-831F4CB2A901}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.23028 - Electronic Arts)Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB)Bejeweled® 3 (HKLM-x32\...\{E99C27B2-EB2E-4244-9F5C-A96F55100F0C}) (Version: 1.1.13.4753 - Electronic Arts, Inc.)Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v9.10.01 - TOSHIBA CORPORATION)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)Burnout Paradise: The Ultimate Box (HKLM-x32\...\Steam App 24740) (Version: - Criterion Games)CameraHelperMsi (x32 Version: 13.40.836.0 - Logitech) HiddenCamfrog Video Chat 6.9 (HKLM-x32\...\Camfrog) (Version: 6.9.437 - Camshare, Inc.)CamStudio version 2.7 (HKLM-x32\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7 - CamStudio Open Source)Canon MP950 (HKLM\...\{00DD3B64-74A4-4be7-BAC4-934499C5E34C}) (Version: - )Core FTP LE (x64) (HKLM-x32\...\CoreFTP(x64)) (Version: - )Corsair K70 Firmware Update Application (HKLM-x32\...\{8C9DA353-2101-4658-BAA7-53F88EA0D3AB}_is1) (Version: - )Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version: - Valve)CPUID HWMonitor 1.25 (HKLM\...\CPUID HWMonitor_is1) (Version: - )CyberPower PowerPanel Personal Edition 1.4.3 (HKLM-x32\...\{DEC7E1CD-31A2-4F2F-BEE5-CF80E8E58C2A}) (Version: 1.4.3 - Cyber Power Systems, Inc.)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDamned (HKLM-x32\...\Steam App 251170) (Version: - 9heads Game Studios)Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version: - Eidos Montreal)Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)DiRT 3 (HKLM-x32\...\Steam App 44320) (Version: - Codemasters Racing Studio)Dropbox (HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)Elite Dangerous Launcher version 0.3.1411.0 (HKLM-x32\...\{696F8871-C91D-4CB1-825D-36BE18065575}_is1) (Version: 0.3.1411.0 - Frontier Developments)erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenGarry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Facepunch Studios)Geeks3D FurMark 1.13.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version: - Geeks3D)Glyph (HKLM-x32\...\Glyph) (Version: - Trion Worlds, Inc.)Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.26.9 - Google Inc.) HiddenGuild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)Hitman: Absolution (HKLM-x32\...\Steam App 203140) (Version: - IO Interactive)HP ENVY 4500 series Basic Device Software (HKLM\...\{6915424E-704F-4F5D-9057-9C7B406B36DB}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)HydraVision (x32 Version: 4.2.252.0 - Advanced Micro Devices, Inc.) HiddenIrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)Jamestown (HKLM-x32\...\Steam App 94200) (Version: - Final Form Games)Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF}) (Version: 7.0.670 - Oracle)Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) HiddenKilling Floor (HKLM-x32\...\Steam App 1250) (Version: - Tripwire Interactive)Logitech Gaming Software 8.57 (HKLM\...\Logitech Gaming Software) (Version: 8.57.145 - Logitech Inc.)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.40 - Logitech Inc.)LWS VideoEffects (Version: 13.30.1379.0 - Logitech) HiddenMalwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)ManyCam 4.0.110 (HKLM-x32\...\ManyCam) (Version: 4.0.110 - Visicom Media Inc.)Mark of the Ninja (HKLM-x32\...\Steam App 214560) (Version: - Klei Entertainment)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)Microsoft Games for Windows Marketplace (HKLM-x32\...\{67F42018-F647-4D3C-BE62-F8CB4FE2FCD5}) (Version: 3.5.67.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{D9C50188-12D5-4D3E-8F00-682346C2AA5F}) (Version: 1.20.146.0 - Microsoft)Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.52.3 - Black Tree Gaming)Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9 - )NVIDIA PhysX (HKLM-x32\...\{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}) (Version: 9.11.1111 - NVIDIA Corporation)Oddworld: Abe's Oddysee (HKLM-x32\...\Steam App 15700) (Version: - Oddworld Inhabitants)OpenAL (HKLM-x32\...\OpenAL) (Version: - )OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)Origin (HKLM-x32\...\Origin) (Version: 9.4.20.386 - Electronic Arts, Inc.)PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)QNAP NetBak Replicator (HKLM-x32\...\NetBak) (Version: 4.3.2.0611 - QNAP Systems, Inc.)Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.1.42.1291 - Qualcomm Atheros) HiddenQualcomm Atheros Killer E220x Drivers (Version: 1.1.42.1291 - Qualcomm Atheros) HiddenQualcomm Atheros Killer Network Manager Suite (HKLM-x32\...\{00D4DA5D-EA32-4A7C-A855-A7FDC372049B}) (Version: 1.1.42.1291 - Qualcomm Atheros)Qualcomm Atheros Network Manager (Version: 1.1.42.1291 - Qualcomm Atheros) HiddenRapture3D 2.4.8 Game (HKLM-x32\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version: - Blue Ripple Sound)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)Resident Evil 6 / Biohazard 6 (HKLM-x32\...\Steam App 221040) (Version: - Capcom)Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)Sonic Adventure DX (HKLM-x32\...\Steam App 71250) (Version: - SEGA)Starbound (HKLM-x32\...\Steam App 211820) (Version: - )StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic)The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)Trove (HKLM-x32\...\Glyph Trove) (Version: - Trion Worlds, Inc.)VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)WBFS Manager 3.0 (HKLM-x32\...\WBFS Manager 3.0) (Version: 3.0 - AlexDP)Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)WinRAR 5.11 beta 1 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.1 - win.rar GmbH) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}\InprocServer32 -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\sys\x64\TosBtExt.dll (TOSHIBA)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-2557308010-2909836500-3839796682-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Exodus\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.) ==================== Restore Points ========================= 08-08-2014 08:11:29 Scheduled Checkpoint15-08-2014 13:55:00 Windows Update15-08-2014 17:17:36 3DMark 1115-08-2014 17:17:44 Installed DirectX16-08-2014 05:06:24 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.5072716-08-2014 05:06:44 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.5072720-01-2015 09:02:39 Scheduled Checkpoint28-01-2015 00:00:01 Scheduled Checkpoint04-02-2015 15:21:14 Scheduled Checkpoint11-02-2015 15:29:13 Scheduled Checkpoint14-02-2015 18:54:13 Windows Modules Installer16-02-2015 14:04:24 123416-02-2015 14:53:22 Malwarebytes Anti-Rootkit Restore Point ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0C85D581-9322-41B6-8E81-EEE077644684} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)Task: {7881E4F9-ED96-40F4-B1F0-0EA7DBDDEE84} - System32\Tasks\NetBak-Exodus-PC-Exodus-AutoStartup => C:\Program Files\QNAP\NetBak\NetBak.exe [2014-06-11] (QNAP Systems, Inc.)Task: {95CD2F16-1F30-4915-B699-C6C6E04647E2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-16] (Google Inc.)Task: {D6C86C57-C67A-4728-B51A-3ACD9FE31ECA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)Task: {E111EA92-4F2C-42E6-A000-75FDF51C12FB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\NetBak-Exodus-PC-Exodus-Job1.job => C:\Program Files\QNAP\NetBak\NetBak.exe ==================== Loaded Modules (whitelisted) ============== 2014-08-17 00:01 - 2013-10-17 10:32 - 00020472 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll2014-06-11 04:14 - 2014-06-11 04:14 - 00142512 _____ () C:\Program Files\QNAP\NetBak\RdiffDll.dll2014-09-29 08:29 - 2014-09-29 08:29 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe2014-09-18 02:23 - 2014-09-18 02:23 - 00866584 _____ () C:\Program Files\Logitech Gaming Software\libGLESv2.dll2014-10-14 13:51 - 2014-10-14 13:51 - 01050904 _____ () C:\Program Files\Logitech Gaming Software\platforms\qwindows.dll2014-09-18 02:23 - 2014-09-18 02:23 - 00059160 _____ () C:\Program Files\Logitech Gaming Software\libEGL.dll2014-10-14 13:51 - 2014-10-14 13:51 - 00242456 _____ () C:\Program Files\Logitech Gaming Software\imageformats\qjpeg.dll2014-04-17 12:27 - 2014-04-17 12:27 - 00300544 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe2013-06-05 17:51 - 2013-06-05 17:51 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll2013-06-05 17:51 - 2013-06-05 17:51 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResourcesNet4.dll2014-08-16 01:23 - 2014-11-11 13:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll2014-12-03 23:45 - 2014-12-01 19:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll2014-12-03 23:45 - 2014-12-01 19:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll2014-12-03 23:45 - 2014-12-01 19:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll2014-08-16 01:23 - 2015-02-13 22:23 - 02360000 _____ () C:\Program Files (x86)\Steam\video.dll2014-08-28 21:25 - 2014-12-01 16:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll2014-08-28 21:25 - 2014-12-01 16:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll2014-08-28 21:25 - 2014-12-01 16:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll2014-08-28 21:25 - 2014-12-01 16:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll2014-08-28 21:25 - 2014-12-01 16:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll2014-08-16 01:23 - 2015-02-13 22:23 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL2011-11-11 13:08 - 2011-11-11 13:08 - 02145304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll2011-11-11 13:08 - 2011-11-11 13:08 - 07956504 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll2011-11-11 13:08 - 2011-11-11 13:08 - 00342552 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll2011-11-11 13:08 - 2011-11-11 13:08 - 00029208 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll2011-11-11 13:08 - 2011-11-11 13:08 - 00128536 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll2015-02-10 16:00 - 2015-02-10 16:00 - 00750080 _____ () C:\Users\Exodus\AppData\Roaming\Dropbox\bin\libGLESv2.dll2015-02-16 14:54 - 2015-02-16 14:54 - 00043008 _____ () c:\users\exodus\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbrrlul.dll2015-02-10 16:00 - 2015-02-10 16:00 - 00047616 _____ () C:\Users\Exodus\AppData\Roaming\Dropbox\bin\libEGL.dll2015-02-10 16:00 - 2015-02-10 16:00 - 00865280 _____ () C:\Users\Exodus\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll2015-02-10 16:00 - 2015-02-10 16:00 - 00200704 _____ () C:\Users\Exodus\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll2014-08-16 01:23 - 2015-01-27 20:30 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll2015-02-05 20:45 - 2015-02-05 20:45 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\libcef.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\libGLESv2.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00908288 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\platforms\qwindows.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\libEGL.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00020992 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qgif.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00021504 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qico.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00205312 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qjpeg.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00225792 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qmng.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00015872 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qsvg.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00312832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\imageformats\qtiff.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\qml\QtQuick.2\qtquick2plugin.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00054272 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\qml\QtQuick\Layouts\qquicklayoutsplugin.dll2015-02-05 20:45 - 2015-02-05 20:45 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.5522\qml\QtQml\Models.2\modelsplugin.dll2015-02-05 09:37 - 2015-02-05 09:37 - 16852144 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll2014-03-31 23:35 - 2014-03-31 23:35 - 00270016 _____ () C:\Program Files (x86)\Windows Live\Writer\en\WindowsLive.Writer.Localization.resources.dll2015-02-06 11:07 - 2015-02-04 04:02 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libglesv2.dll2015-02-06 11:07 - 2015-02-04 04:02 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libegl.dll2015-02-06 11:07 - 2015-02-04 04:02 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) =============== (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2557308010-2909836500-3839796682-1000\Control Panel\Desktop\\Wallpaper -> DNS Servers: 192.168.1.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Exodus^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CC70E0638.lnk => C:\Windows\pss\CC70E0638.lnk.StartupMSCONFIG\startupfolder: C:^Users^Exodus^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^program.lnk => C:\Windows\pss\program.lnk.StartupMSCONFIG\startupreg: ITSecMng => %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START ==================== Accounts: ============================= Administrator (S-1-5-21-2557308010-2909836500-3839796682-500 - Administrator - Disabled)Exodus (S-1-5-21-2557308010-2909836500-3839796682-1000 - Administrator - Enabled) => C:\Users\ExodusGuest (S-1-5-21-2557308010-2909836500-3839796682-501 - Limited - Disabled)HomeGroupUser$ (S-1-5-21-2557308010-2909836500-3839796682-1002 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: PCI Simple Communications ControllerDescription: PCI Simple Communications ControllerClass Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: SM Bus ControllerDescription: SM Bus ControllerClass Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Universal Serial Bus (USB) ControllerDescription: Universal Serial Bus (USB) ControllerClass Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28)Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors:==================Error: (02/16/2015 02:40:47 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Users\Exodus\Downloads\HitmanPro_x64.exe ; Description = Checkpoint by HitmanPro; Error = 0x8007043c). Error: (02/16/2015 02:40:21 PM) (Source: System Restore) (EventID: 8193) (User: )Description: Failed to create restore point (Process = C:\Users\Exodus\Downloads\HitmanPro_x64.exe ; Description = Checkpoint by HitmanPro; Error = 0x8007043c). Error: (02/15/2015 01:13:32 AM) (Source: ESENT) (EventID: 489) (User: )Description: taskhost (5132) An attempt to open the file "C:\Users\Exodus\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). Error: (02/14/2015 06:52:54 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17514, time stamp: 0x4ce7a144Faulting module name: DUI70.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdf25Exception code: 0xc0000005Fault offset: 0x0000000000014b99Faulting process id: 0x59cFaulting application start time: 0xExplorer.EXE0Faulting application path: Explorer.EXE1Faulting module path: Explorer.EXE2Report Id: Explorer.EXE3 Error: (02/05/2015 07:13:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short System errors:=============Error: (02/16/2015 02:54:55 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (02/16/2015 02:54:54 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC) Error: (02/16/2015 02:42:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC) Error: (02/16/2015 02:42:25 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (02/16/2015 02:39:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (02/16/2015 02:39:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (02/16/2015 02:39:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (02/16/2015 02:37:50 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1068BITS{4991D34B-80A1-4291-83B6-3328366B9097} Error: (02/16/2015 02:37:42 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F} Error: (02/16/2015 02:37:42 PM) (Source: DCOM) (EventID: 10005) (User: )Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF} Microsoft Office Sessions:=========================Error: (02/16/2015 02:40:47 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Users\Exodus\Downloads\HitmanPro_x64.exe Checkpoint by HitmanPro0x8007043c Error: (02/16/2015 02:40:21 PM) (Source: System Restore) (EventID: 8193) (User: )Description: C:\Users\Exodus\Downloads\HitmanPro_x64.exe Checkpoint by HitmanPro0x8007043c Error: (02/15/2015 01:13:32 AM) (Source: ESENT) (EventID: 489) (User: )Description: taskhost5132C:\Users\Exodus\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat-1032 (0xfffffbf8)32 (0x00000020)The process cannot access the file because it is being used by another process. Error: (02/14/2015 06:52:54 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Explorer.EXE6.1.7601.175144ce7a144DUI70.dll6.1.7600.163854a5bdf25c00000050000000000014b9959c01d048b00149672cC:\Windows\Explorer.EXEC:\Windows\system32\DUI70.dll97400207-b4a4-11e4-b7a1-d0509929872f Error: (02/05/2015 07:13:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:07 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short Error: (02/05/2015 07:13:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )Description: DNS Message from 192.99.219.128:9964 to 192.168.1.102:5353 length 4 too short ==================== Memory info =========================== Processor: Intel® Core i7-4790K CPU @ 4.00GHzPercentage of memory in use: 20%Total physical RAM: 16335.08 MBAvailable physical RAM: 12946.25 MBTotal Pagefile: 32668.34 MBAvailable Pagefile: 28790.24 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:476.84 GB) (Free:161.23 GB) NTFSDrive d: (Storage) (Fixed) (Total:149.01 GB) (Free:58.66 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive e: () (Fixed) (Total:111.57 GB) (Free:3.49 GB) NTFS ==================== MBR & Partition Table ================== ========================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 476.9 GB) (Disk ID: 222E0CB6)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=476.8 GB) - (Type=07 NTFS) ========================================================Disk: 1 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: 733B82BB)Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS) ========================================================Disk: 2 (Size: 111.8 GB) (Disk ID: C895ED6A) Partition: GPT Partition Type. ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
shyguy80 Posted February 16, 2015 Author ID:940200 Share Posted February 16, 2015 I was hoping to edit my post because I forgot something, but Malwarebytes did not detect it. Nor did the beta of the rootkit program. I have the premium version. Link to post Share on other sites More sharing options...
kevinf80 Posted February 16, 2015 ID:940218 Share Posted February 16, 2015 Hello and welome, P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. What popped up whilst you chatted on Skype? Next, Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export" Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply. Next, Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/ Quit all running programs.For Windows XP, double-click to start.For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.Read and accept the EULA (End User Licene Agreement)Click Scan to scan the system.When the scan completes select "Report", log will open. Close the program > Don't Fix anything!Post back the report which should also be located here: C:\Programdata\RogueKiller\Logs <-------- W7/8C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP Post those logs, also let me know if there are any remaining issues or concerns... Kevin. Fixlist.txt Link to post Share on other sites More sharing options...
shyguy80 Posted February 16, 2015 Author ID:940227 Share Posted February 16, 2015 Some full screen thing about the FBI locked my computer or something. Send a moneypak or whatever. For the most part, I've done the Malwarebytes stuff already and it will not detect it at all. I had already set it to look for rootkits and the other options you told me about prior to posting. Its on the computer I'm using now and I had to disable it in msconfig just to use my computer. Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 2/16/2015Scan Time: 4:28:59 PMLogfile: Administrator: Yes Version: 2.00.4.1028Malware Database: v2015.02.16.09Rootkit Database: v2015.02.03.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: Exodus Scan Type: Threat ScanResult: CompletedObjects Scanned: 336976Time Elapsed: 3 min, 45 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 0(No malicious items detected) Physical Sectors: 0(No malicious items detected) (end) RogueKiller V10.3.0.0 [Feb 16 2015] by Adlice Softwaremail : http://www.adlice.com/contact/Feedback : http://forum.adlice.comWebsite : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser : Exodus [Administrator]Mode : Scan -- Date : 02/16/2015 16:43:24 ¤¤¤ Processes : 1 ¤¤¤[suspicious.Path] (SVC) QDrive -- \??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys[x] -> Stopped ¤¤¤ Registry : 21 ¤¤¤[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_8813\ControlSet001\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_8813\ControlSet002\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet003\Services\QDrive (\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys) -> Found[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_8813\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8FF73F26-CE4B-42A4-90CE-C6F8709C2032} | DhcpNameServer : 8.8.8.8 216.252.23.242 [uNITED STATES (US)] -> Found[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_E_8813\ControlSet002\Services\Tcpip\Parameters\Interfaces\{8FF73F26-CE4B-42A4-90CE-C6F8709C2032} | DhcpNameServer : 8.8.8.8 216.252.23.242 [uNITED STATES (US)] -> Found[PUM.StartMenu] (X64) HKEY_USERS\RK_Exodus_ON_E_A091\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found[PUM.StartMenu] (X86) HKEY_USERS\RK_Exodus_ON_E_A091\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2557308010-2909836500-3839796682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2557308010-2909836500-3839796682-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_B63D\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_E_B63D\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_B63D\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_E_B63D\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmt\Parameters | ServiceDll : C:\PROGRA~3\CC70E0638.zot -> Found ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 12 (Driver: Not loaded [0xc000036b]) ¤¤¤[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - OpenServiceW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b92[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - CloseServiceHandle : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b4a[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - OpenSCManagerW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b82[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - StartServiceW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71ba2[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ntdll.dll - NtAlpcConnectPort : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b7a[iAT:Addr(Hook.IEAT)] (chrome.exe @ pdf.dll) GDI32.dll - GetFontData : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x1071fa68[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - OpenServiceW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b92[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - CloseServiceHandle : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b4a[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - OpenSCManagerW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b82[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ADVAPI32.dll - StartServiceW : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71ba2[iAT:Addr(Hook.IEAT)] (chrome.exe @ dwrite.dll) ntdll.dll - NtAlpcConnectPort : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x10b71b7a[iAT:Addr(Hook.IEAT)] (chrome.exe @ pdf.dll) GDI32.dll - GetFontData : C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\chrome_child.dll @ 0x1071fa68 ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤+++++ PhysicalDrive0: Crucial_CT512MX100SSD1 ATA Device +++++--- User ---[MBR] 6b11fa98fa44288f5783be4c4b4d3948[bSP] af046c763b2e2fd4a6a60520e8c74b63 : Windows Vista/7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 488284 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]User = LL1 ... OKUser = LL2 ... OK +++++ PhysicalDrive1: ST3160815AS ATA Device +++++--- User ---[MBR] a36e2393b4015ace4ae71f534cf83ea1[bSP] 5c002d77316d23fedcca12106e260e06 : Windows Vista/7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 152586 MB [Windows Vista/7/8 Bootstrap | Windows XP Bootloader]User = LL1 ... OKUser = LL2 ... OK +++++ PhysicalDrive2: OCZ-AGILITY3 ATA Device +++++--- User ---[MBR] 212334d7ed18884f1af7c7897848c4ce[bSP] 6bf79d3614dd12211696f3a14b4ec6ea : Empty MBR CodePartition table:0 - [XXXXXX] UNKNOWN (0x0) [VISIBLE] Offset (sectors): 1 | Size: 2097151 MBUser = LL1 ... OKUser = LL2 ... OK Link to post Share on other sites More sharing options...
kevinf80 Posted February 16, 2015 ID:940244 Share Posted February 16, 2015 1.Download Malwarebytes Anti-Rootkit from this link: http://www.malwarebytes.org/products/mbar/ 2. Unzip the File to a convenient location. (Recommend the Desktop)3. Open the folder where the contents were unzipped to run mbar.exe 4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image: 5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.) 6. The following image opens, select Next. 7. The following image opens, select Update 8. When the update completes select Next. 9. In the following window ensure "Targets" are ticked. Then select "Scan" 10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed. 11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.12. If no threats were found you will see the following image, Select Exit: 13. Verify that your system is now running normally, making sure that the following items are functional: Internet access Windows Update Windows Firewall 14. If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder. 15. Select "Y" from your Keyboard, tap Enter. 16. The fix will be applied, select any key to Exit. 17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder: System - logMbar - log Date and time of scan will also be shown Thanks, Kevin... Link to post Share on other sites More sharing options...
shyguy80 Posted February 16, 2015 Author ID:940250 Share Posted February 16, 2015 Yea I tried this earlier too and it didnt find anything. Did it again just to have a recent log though. ---------------------------------------Malwarebytes Anti-Rootkit BETA 1.08.3.1004 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.17028 File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXEDCPU speed: 3.998000 GHzMemory total: 17128574976, free: 13761216512 Downloaded database version: v2015.02.16.08Downloaded database version: v2015.02.03.01Downloaded database version: v2014.12.06.01=======================================Initializing...This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.=======================================Initializing...------------ Kernel report ------------ 02/16/2015 14:48:08------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\vmbus.sys\SystemRoot\system32\drivers\winhv.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\vmstorfl.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\drivers\afd.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\bflwfx64.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\serial.sys\SystemRoot\System32\Drivers\tosrfcom.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\system32\drivers\csc.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\atikmpag.sys\SystemRoot\system32\DRIVERS\atikmdag.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\usbehci.sys\SystemRoot\system32\DRIVERS\USBPORT.SYS\SystemRoot\system32\DRIVERS\e22w7x64.sys\SystemRoot\system32\DRIVERS\serenum.sys\SystemRoot\system32\drivers\wmiacpi.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\ISCTD64.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\mcvidrv.sys\SystemRoot\system32\DRIVERS\STREAM.SYS\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\drivers\mcaudrv_x64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\teamviewervpn.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\serscan.sys\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\LGBusEnum.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\AtihdW76.sys\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\DRIVERS\tosporte.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_dumpata.sys\SystemRoot\System32\Drivers\dump_msahci.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\System32\ATMFD.DLL\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\xusb21.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\drivers\CORK70.sys\SystemRoot\system32\DRIVERS\hidusb.sys\SystemRoot\system32\DRIVERS\HIDCLASS.SYS\SystemRoot\system32\DRIVERS\HIDPARSE.SYS\SystemRoot\system32\DRIVERS\kbdhid.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\DRIVERS\tosrfusb.sys\SystemRoot\system32\DRIVERS\tosrfbd.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\system32\DRIVERS\Tosrfhid.sys\SystemRoot\system32\DRIVERS\lvuvc64.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\drivers\usbaudio.sys\SystemRoot\system32\DRIVERS\lvrs64.sys\SystemRoot\system32\DRIVERS\LGSHidFilt.Sys\SystemRoot\system32\DRIVERS\mouhid.sys\SystemRoot\system32\drivers\LGVirHid.sys\SystemRoot\system32\drivers\tosrfsnd.sys\??\C:\Users\Exodus\AppData\Local\Temp\QDrive.sys\SystemRoot\system32\drivers\spsys.sys\SystemRoot\system32\DRIVERS\WSDPrint.sys\SystemRoot\system32\DRIVERS\WSDScan.sys\SystemRoot\system32\DRIVERS\asyncmac.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\msvcrt.dll\Windows\System32\nsi.dll\Windows\System32\imagehlp.dll\Windows\System32\msctf.dll\Windows\System32\usp10.dll\Windows\System32\iertutil.dll\Windows\System32\gdi32.dll\Windows\System32\ws2_32.dll\Windows\System32\oleaut32.dll\Windows\System32\imm32.dll\Windows\System32\ole32.dll\Windows\System32\urlmon.dll\Windows\System32\difxapi.dll\Windows\System32\kernel32.dll\Windows\System32\rpcrt4.dll\Windows\System32\Wldap32.dll\Windows\System32\shlwapi.dll\Windows\System32\lpk.dll\Windows\System32\user32.dll\Windows\System32\sechost.dll\Windows\System32\wininet.dll\Windows\System32\psapi.dll\Windows\System32\normaliz.dll\Windows\System32\advapi32.dll\Windows\System32\shell32.dll\Windows\System32\clbcatq.dll\Windows\System32\setupapi.dll\Windows\System32\comdlg32.dll\Windows\System32\wintrust.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\userenv.dll\Windows\System32\comctl32.dll\Windows\System32\crypt32.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\KernelBase.dll\Windows\System32\cfgmgr32.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\profapi.dll\Windows\System32\msasn1.dll\Windows\SysWOW64\normaliz.dll----------- End -----------Done! Scan startedDatabase versions: main: v2015.02.16.08 rootkit: v2015.02.03.01 <<<2>>>Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa800cfdc790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cee08a0, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cfdc790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd18060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>><<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...Done!Drive 0This is a System driveScanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 222E0CB6 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 206848 Numsec = 1000005632 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 512110190592 bytesSector size: 512 bytes Done!Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa800cffb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cfdc080, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cffb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd1d060, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 733B82BB Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 312496317 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160000000000 bytesSector size: 512 bytes Done!Physical Sector Size: 512Drive: 2, DevicePointer: 0xfffffa800cffc060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cffcb90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cffc060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd68060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0Drive 2Scanning MBR on drive 2...Inspecting partition table:This drive is a GPT Drive.MBR Signature: 55AADisk Signature: C895ED6A GPT Protective MBR Partition information: Partition 0 type is EFI-GPT (0xee) Partition is NOT ACTIVE. Partition starts at LBA: 1 Numsec = 4294967295 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 GPT Partition information: GPT Header Signature 4546492050415254 GPT Header Revision 65536 Size 92 CRC 4162518817 GPT Header CurrentLba = 1 BackupLba 234441647 GPT Header FirstUsableLba 34 LastUsableLba 234441614 GPT Header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a GPT Header Contains 128 partition entries starting at LBA 2 GPT Header Partition entry size = 128 Backup GPT header Signature 4546492050415254 Backup GPT header Revision 65536 Size 92 CRC 4162518817 Backup GPT header CurrentLba = 234441647 BackupLba 1 Backup GPT header FirstUsableLba 34 LastUsableLba 234441614 Backup GPT header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a Backup GPT header Contains 128 partition entries starting at LBA 234441615 Backup GPT header Partition entry size = 128 Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b Partition ID b9a2927a-1269-4883-848e-393d145a3647 FirstLBA 2048 Last LBA 206847 Attributes 0 Partition Name EFI system partition GPT Partition 0 is bootable Partition 1 Type e3c9e316-b5c-4db8-817d-f92df0215ae Partition ID a3ed5762-9601-4507-8668-384f4f882f7 FirstLBA 206848 Last LBA 468991 Attributes 0 Partition Name Microsoft reserved partition Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Partition ID 9f02c474-67c6-47da-8432-2291541d864f FirstLBA 468992 Last LBA 234440703 Attributes 0 Partition Name Basic data partition Disk Size: 120034123776 bytesSector size: 512 bytes Done!Infected: C:\ProgramData\8360E07CC.cpp --> [Trojan.Agent.ED]Infected: C:\Users\Exodus\AppData\Local\Temp\Low\lkfej.dll --> [Trojan.Agent.ED]Scan finishedCreating System Restore point...Cleaning up...Removal scheduling successful. System shutdown needed.System shutdown occurred======================================= Removal queue found; removal startedRemoving C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-63-i.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...Removal finished---------------------------------------Malwarebytes Anti-Rootkit BETA 1.08.3.1004 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.17028 File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXEDCPU speed: 3.998000 GHzMemory total: 17128574976, free: 12155133952 Downloaded database version: v2015.02.16.09=======================================Initializing...------------ Kernel report ------------ 02/16/2015 17:49:46------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\System32\drivers\imofugc.sys\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\vmbus.sys\SystemRoot\system32\drivers\winhv.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\vmstorfl.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\drivers\afd.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\bflwfx64.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\serial.sys\SystemRoot\System32\Drivers\tosrfcom.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\system32\drivers\csc.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\atikmpag.sys\SystemRoot\system32\DRIVERS\atikmdag.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\usbehci.sys\SystemRoot\system32\DRIVERS\USBPORT.SYS\SystemRoot\system32\DRIVERS\e22w7x64.sys\SystemRoot\system32\DRIVERS\serenum.sys\SystemRoot\system32\drivers\wmiacpi.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\ISCTD64.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\mcvidrv.sys\SystemRoot\system32\DRIVERS\STREAM.SYS\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\drivers\mcaudrv_x64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\teamviewervpn.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\serscan.sys\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\LGBusEnum.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\AtihdW76.sys\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\DRIVERS\tosporte.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_dumpata.sys\SystemRoot\System32\Drivers\dump_msahci.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\System32\ATMFD.DLL\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\xusb21.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\drivers\CORK70.sys\SystemRoot\system32\DRIVERS\hidusb.sys\SystemRoot\system32\DRIVERS\HIDCLASS.SYS\SystemRoot\system32\DRIVERS\HIDPARSE.SYS\SystemRoot\system32\DRIVERS\kbdhid.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\DRIVERS\tosrfusb.sys\SystemRoot\system32\DRIVERS\tosrfbd.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\Tosrfhid.sys\SystemRoot\system32\DRIVERS\lvuvc64.sys\SystemRoot\system32\drivers\usbaudio.sys\SystemRoot\system32\DRIVERS\lvrs64.sys\SystemRoot\system32\DRIVERS\LGSHidFilt.Sys\SystemRoot\system32\DRIVERS\mouhid.sys\SystemRoot\system32\drivers\LGVirHid.sys\SystemRoot\system32\drivers\tosrfsnd.sys\SystemRoot\system32\DRIVERS\WSDPrint.sys\SystemRoot\system32\DRIVERS\WSDScan.sys\SystemRoot\system32\DRIVERS\asyncmac.sys\SystemRoot\system32\drivers\MSPQM.sys\SystemRoot\system32\drivers\MSPCLOCK.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\rpcrt4.dll\Windows\System32\usp10.dll\Windows\System32\oleaut32.dll\Windows\System32\wininet.dll\Windows\System32\ole32.dll\Windows\System32\sechost.dll\Windows\System32\setupapi.dll\Windows\System32\clbcatq.dll\Windows\System32\shell32.dll\Windows\System32\urlmon.dll\Windows\System32\user32.dll\Windows\System32\lpk.dll\Windows\System32\normaliz.dll\Windows\System32\comdlg32.dll\Windows\System32\ws2_32.dll\Windows\System32\iertutil.dll\Windows\System32\nsi.dll\Windows\System32\imm32.dll\Windows\System32\advapi32.dll\Windows\System32\gdi32.dll\Windows\System32\psapi.dll\Windows\System32\difxapi.dll\Windows\System32\kernel32.dll\Windows\System32\msctf.dll\Windows\System32\msvcrt.dll\Windows\System32\Wldap32.dll\Windows\System32\imagehlp.dll\Windows\System32\shlwapi.dll\Windows\System32\cfgmgr32.dll\Windows\System32\comctl32.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\KernelBase.dll\Windows\System32\userenv.dll\Windows\System32\crypt32.dll\Windows\System32\wintrust.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\msasn1.dll\Windows\System32\profapi.dll\Windows\SysWOW64\normaliz.dll----------- End -----------Done! Scan startedDatabase versions: main: v2015.02.16.09 rootkit: v2015.02.03.01 <<<2>>>Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa800cfcc790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cfcc2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cfcc790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd3a060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>><<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...Done!Drive 0This is a System driveScanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 222E0CB6 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 206848 Numsec = 1000005632 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 512110190592 bytesSector size: 512 bytes Done!Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa800cfeb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cfebb90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cfeb060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd3f060, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 733B82BB Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 312496317 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160000000000 bytesSector size: 512 bytes Done!Physical Sector Size: 512Drive: 2, DevicePointer: 0xfffffa800cfec060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa800cfecb90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800cfec060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800cd6a060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0Drive 2Scanning MBR on drive 2...Inspecting partition table:This drive is a GPT Drive.MBR Signature: 55AADisk Signature: C895ED6A GPT Protective MBR Partition information: Partition 0 type is EFI-GPT (0xee) Partition is NOT ACTIVE. Partition starts at LBA: 1 Numsec = 4294967295 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 GPT Partition information: GPT Header Signature 4546492050415254 GPT Header Revision 65536 Size 92 CRC 4162518817 GPT Header CurrentLba = 1 BackupLba 234441647 GPT Header FirstUsableLba 34 LastUsableLba 234441614 GPT Header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a GPT Header Contains 128 partition entries starting at LBA 2 GPT Header Partition entry size = 128 Backup GPT header Signature 4546492050415254 Backup GPT header Revision 65536 Size 92 CRC 4162518817 Backup GPT header CurrentLba = 234441647 BackupLba 1 Backup GPT header FirstUsableLba 34 LastUsableLba 234441614 Backup GPT header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a Backup GPT header Contains 128 partition entries starting at LBA 234441615 Backup GPT header Partition entry size = 128 Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b Partition ID b9a2927a-1269-4883-848e-393d145a3647 FirstLBA 2048 Last LBA 206847 Attributes 0 Partition Name EFI system partition GPT Partition 0 is bootable Partition 1 Type e3c9e316-b5c-4db8-817d-f92df0215ae Partition ID a3ed5762-9601-4507-8668-384f4f882f7 FirstLBA 206848 Last LBA 468991 Attributes 0 Partition Name Microsoft reserved partition Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Partition ID 9f02c474-67c6-47da-8432-2291541d864f FirstLBA 468992 Last LBA 234440703 Attributes 0 Partition Name Basic data partition Disk Size: 120034123776 bytesSector size: 512 bytes Done!Scan finished======================================= Scan startedDatabase versions: main: v2015.02.16.09 rootkit: v2015.02.03.01 <<<2>>><<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>><<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>><<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...Done!Drive 0This is a System driveScanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 222E0CB6 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 206848 Numsec = 1000005632 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 512110190592 bytesSector size: 512 bytes Done!Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 733B82BB Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 312496317 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160000000000 bytesSector size: 512 bytes Done!Drive 2Scanning MBR on drive 2...Inspecting partition table:This drive is a GPT Drive.MBR Signature: 55AADisk Signature: C895ED6A GPT Protective MBR Partition information: Partition 0 type is EFI-GPT (0xee) Partition is NOT ACTIVE. Partition starts at LBA: 1 Numsec = 4294967295 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 GPT Partition information: GPT Header Signature 4546492050415254 GPT Header Revision 65536 Size 92 CRC 4162518817 GPT Header CurrentLba = 1 BackupLba 234441647 GPT Header FirstUsableLba 34 LastUsableLba 234441614 GPT Header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a GPT Header Contains 128 partition entries starting at LBA 2 GPT Header Partition entry size = 128 Backup GPT header Signature 4546492050415254 Backup GPT header Revision 65536 Size 92 CRC 4162518817 Backup GPT header CurrentLba = 234441647 BackupLba 1 Backup GPT header FirstUsableLba 34 LastUsableLba 234441614 Backup GPT header Guid c7f91a49-e141-4ade-bc31-fe9f69a8fe9a Backup GPT header Contains 128 partition entries starting at LBA 234441615 Backup GPT header Partition entry size = 128 Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b Partition ID b9a2927a-1269-4883-848e-393d145a3647 FirstLBA 2048 Last LBA 206847 Attributes 0 Partition Name EFI system partition GPT Partition 0 is bootable Partition 1 Type e3c9e316-b5c-4db8-817d-f92df0215ae Partition ID a3ed5762-9601-4507-8668-384f4f882f7 FirstLBA 206848 Last LBA 468991 Attributes 0 Partition Name Microsoft reserved partition Partition 2 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7 Partition ID 9f02c474-67c6-47da-8432-2291541d864f FirstLBA 468992 Last LBA 234440703 Attributes 0 Partition Name Basic data partition Disk Size: 120034123776 bytesSector size: 512 bytes Done! Malwarebytes Anti-Rootkit BETA 1.08.3.1004www.malwarebytes.org Database version: main: v2015.02.16.09 rootkit: v2015.02.03.01 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.17028Exodus :: EXODUS-PC [administrator] 2/16/2015 5:49:50 PMmbar-log-2015-02-16 (17-49-50).txt Scan type: Quick scanScan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/ShurikenScan options disabled: Objects scanned: 337077Time elapsed: 2 minute(s), 45 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 0(No malicious items detected) Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 0(No malicious items detected) Physical Sectors Detected: 0(No malicious items detected) (end) Link to post Share on other sites More sharing options...
kevinf80 Posted February 16, 2015 ID:940260 Share Posted February 16, 2015 MBAR kill and remove infection, what is current status of your system? Done!Infected: C:\ProgramData\8360E07CC.cpp --> [Trojan.Agent.ED]Infected: C:\Users\Exodus\AppData\Local\Temp\Low\lkfej.dll --> [Trojan.Agent.ED]Scan finishedCreating System Restore point...Cleaning up...Removal scheduling successful. System shutdown needed.System shutdown occurred Run the following and post logs: Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log Let me see those logs... Link to post Share on other sites More sharing options...
shyguy80 Posted February 17, 2015 Author ID:940504 Share Posted February 17, 2015 # AdwCleaner v4.110 - Logfile created 17/02/2015 at 16:20:34# Updated 05/02/2015 by Xplode# Database : 2015-02-14.2 [server]# Operating system : Windows 7 Ultimate Service Pack 1 (x64)# Username : Exodus - EXODUS-PC# Running from : C:\Users\Exodus\Downloads\AdwCleaner.exe# Option : Cleaning ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Users\Exodus\AppData\Local\CrashRptFile Deleted : C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorageFile Deleted : C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journalFile Deleted : C:\Users\Exodus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal ***** [ Scheduled tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** [x] Not Deleted : HKLM\SOFTWARE\Email NotifierKey Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\bitchcrawler.comKey Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.comData Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local ***** [ Web browsers ] ***** -\\ Internet Explorer v10.0.9200.17028 -\\ Google Chrome v40.0.2214.111 ************************* AdwCleaner[R0].txt - [1533 bytes] - [17/02/2015 16:18:30]AdwCleaner[s0].txt - [1480 bytes] - [17/02/2015 16:20:34] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1539 bytes] ########## Link to post Share on other sites More sharing options...
shyguy80 Posted February 17, 2015 Author ID:940505 Share Posted February 17, 2015 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.4.2 (02.02.2015:1)OS: Windows 7 Ultimate x64Ran by Exodus on Tue 02/17/2015 at 16:24:11.70~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Tue 02/17/2015 at 16:25:39.34End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link to post Share on other sites More sharing options...
shyguy80 Posted February 17, 2015 Author ID:940506 Share Posted February 17, 2015 ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.15, August 2014 (build 5.15.10500.0)Started On Fri Aug 15 22:17:45 2014 Engine: 1.1.10802.0Signatures: 1.179.1796.0 Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 15 22:17:54 2014 Return code: 0 (0x0) ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.21, February 2015 (build 5.21.11102.0)Started On Tue Feb 17 16:27:36 2015 Engine: 1.1.11302.0Signatures: 1.191.3593.0 Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Feb 17 16:29:47 2015 Return code: 0 (0x0) Link to post Share on other sites More sharing options...
shyguy80 Posted February 17, 2015 Author ID:940508 Share Posted February 17, 2015 Not sure if it matters, but the program/file from the malware is still in my msconfig, its just not checked off to start up. There were only 2 mysterious startup files that didnt look right. C:\Windows\system32\rundll32.exe C:\PROGRA~3\8360E07CC.cpp,workC:\Windows\system32\rundll32.exe C:\PROGRA~3\8360E07C.cpp,zSS1 I had disabled another one that looked iffy, but I think its just my usb bluetooth adapter. Link to post Share on other sites More sharing options...
kevinf80 Posted February 17, 2015 ID:940526 Share Posted February 17, 2015 Can you navigate to and delete those entries? Is your system responding ok, are there any other remaining issues or concerns Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 3, 2015 Root Admin ID:944594 Share Posted March 3, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts