What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help needed, all kinds of things, wiped computer several times, rootki

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have had this problem for days and tried all sorts to get rid of it. Then all of a sudden it will come back, I have two hard drives in my computer a SSD and a normal one, apart from wiping them both again. I dont know what to do, any help would be very appreciated. I have attached my logs in a zip file . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 11:58:54.11 on 01/10/2011 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.8175.5834 [GMT 1:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC} FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch D:\apps (x86)\IObit\Advanced SystemCare 5\ASCService.exe C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS D:\apps\COMODO Internet Security\COMODO\COMODO Internet Security\cmdagent.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork D:\apps (x86)\IObit\IObit Malware Fighter\IMFsrv.exe D:\apps (x86)\Norton Ghost\Agent\VProSvc.exe C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe C:\Windows\system32\wbem\wmiprvse.exe D:\apps (x86)\Spybot - Search & Destroy\SDWinSec.exe C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe D:\apps (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Program Files (x86)\Everything\Everything.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files (x86)\Windows Sidebar\sidebar.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe D:\apps (x86)\Mozilla Firefox\firefox.exe D:\apps (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\explorer.exe C:\Users\Banny\Downloads\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uSearch Page = www.google.com uStart Page = about:blank mWinlogon: Userinit=userinit.exe, BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - D:\APPS(X~1\SPYBOT~1\SDHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll uRun: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun uPolicies-explorer: NoResolveTrack = 1 (0x1) mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - D:\APPS(X~1\SPYBOT~1\SDHelper.dll LSP: %SystemRoot%\system32\vsocklib.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab TCP: {4501D8EC-5422-4941-858F-46315EE1B491} = 156.154.70.22,156.154.71.22 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File mRun-x64: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s mRun-x64: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun-x64: [Everything] "c:\program files (x86)\everything\everything.exe" -startup AppInit_DLLs-X64: C:\Windows\system32\guard64.dll STS-X64: {E31004D1-A431-41B8-826F-E902F9D95C81} - No File SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL Hosts: 127.0.0.1 www.spywareinfo.com . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Banny\AppData\Roaming\Mozilla\Firefox\Profiles\3k9qhajz.default\ FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - plugin: D:\apps (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll . —- FIREFOX POLICIES —- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: browser.xul.error_pages.enabled - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 3000000 FF - user.js: content.maxtextrun - 8191 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: network.http.max-connections - 32 FF - user.js: network.http.max-connections-per-server - 8 FF - user.js: network.http.max-persistent-connections-per-proxy - 8 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-9-28 55280] R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\System32\drivers\cmdGuard.sys [2011-6-30 252344] R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\System32\drivers\cmdhlp.sys [2011-6-30 41712] R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2011-4-18 189440] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;D:\apps (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-9-28 478040] R2 CLPSLS;COMODO livePCsupport Service;C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe [2011-5-26 161080] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] R2 IMFservice;IMF Service;D:\apps (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2011-9-28 820568] R2 SBSDWSCService;SBSD Security Center Service;D:\apps (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-9-27 1153368] R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-8-21 846448] R2 VMwareHostd;VMware Workstation Server;C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2011-8-22 11837440] R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\System32\drivers\EtronHub3.sys [2011-3-7 40832] R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\System32\drivers\EtronXHCI.sys [2011-3-7 65280] R3 GenericMount;Generic Mount Driver;C:\Windows\System32\drivers\GenericMount.sys [2009-9-21 66608] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-10-19 56344] R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2011-4-18 40832] R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 84864] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-9-27 413800] R3 SymSnapService;SymSnapService;D:\apps (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2009-9-21 2963960] S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168] S3 GenericMount Helper Service;GenericMount Helper Service;D:\apps (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2010-2-12 2227216] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536] S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992] S3 RegFilter;RegFilter;D:\apps (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2011-9-28 33184] S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;C:\Windows\System32\dllhost.exe [2009-7-14 9728] S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2011-4-12 88960] S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2011-4-12 34816] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232] S3 tsusbhub;tsusbhub;C:\Windows\System32\drivers\tsusbhub.sys [2011-4-12 117248] S3 UrlFilter;UrlFilter;D:\apps (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\UrlFilter.sys [2011-9-28 21328] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-9-28 1255736] S4 FileMonitor;FileMonitor;D:\apps (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2011-9-28 20336] S4 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-9-27 2214504] . =============== Created Last 30 ================ . 2011-10-01 10:34:30 ——– d—–w- C:\Users\Banny\AppData\Local\Microsoft_Corporation 2011-10-01 09:16:11 ——– d—–w- C:\Users\Banny\AppData\Local\Google 2011-10-01 08:32:14 69000 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{666C9CFE-EEC5-4020-B799-0F1A780DF086}\offreg.dll 2011-10-01 08:32:13 9049936 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{666C9CFE-EEC5-4020-B799-0F1A780DF086}\mpengine.dll 2011-09-28 23:03:20 ——– d—–w- C:\Windows\pss 2011-09-28 21:36:52 ——– d—–w- C:\Users\Banny\AppData\Local\gtk-2.0 2011-09-28 21:35:04 ——– d—–w- C:\Users\Banny\AppData\Local\webkit 2011-09-28 21:28:43 ——– d—–w- C:\Program Files (x86)\Adobe Story 2011-09-28 21:28:17 55280 ——w- C:\Windows\System32\drivers\PxHlpa64.sys 2011-09-28 21:28:17 10224 ——w- C:\Windows\System32\drivers\cdralw2k.sys 2011-09-28 21:28:17 10224 ——w- C:\Windows\System32\drivers\cdr4_xp.sys 2011-09-28 21:28:17 ——– d—–w- C:\Program Files (x86)\My Company Name 2011-09-28 21:28:17 ——– d—–w- C:\Program Files (x86)\Common Files\Sonic Shared 2011-09-28 21:28:17 ——– d—–w- C:\Program Files (x86)\Common Files\PX Storage Engine 2011-09-28 20:16:53 757760 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll 2011-09-28 20:16:53 69715 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll 2011-09-28 20:16:53 65024 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe 2011-09-28 20:16:53 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe 2011-09-28 20:16:53 32768 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll 2011-09-28 20:16:53 274432 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll 2011-09-28 20:16:53 204800 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll 2011-09-28 20:16:52 331908 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll 2011-09-28 20:16:52 200836 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll 2011-09-28 20:10:30 ——– d—–w- C:\Users\Banny\AppData\Roaming\GlarySoft 2011-09-28 19:35:41 ——– d—–w- C:\Program Files\Microsoft Synchronization Services 2011-09-28 19:35:30 ——– d—–w- C:\Windows\PCHEALTH 2011-09-28 19:35:30 ——– d—–w- C:\Program Files\Microsoft SQL Server Compact Edition 2011-09-28 19:33:17 ——– d—–w- C:\Program Files (x86)\Microsoft Visual Studio 8 2011-09-28 19:32:57 ——– d—–w- C:\Program Files\Microsoft Analysis Services 2011-09-28 19:32:57 ——– d—–w- C:\Program Files (x86)\Microsoft Analysis Services 2011-09-28 19:32:55 ——– d—–w- C:\Windows\SHELLNEW 2011-09-28 19:32:42 ——– d—–w- C:\Users\Banny\AppData\Local\Microsoft Help 2011-09-28 19:22:25 ——– d—–w- C:\PROGRA~3\Tweaking.com 2011-09-28 19:20:58 ——– d—–w- C:\Users\Banny\AppData\Roaming\Wieldraaijer 2011-09-28 19:19:34 152848 —-a-w- C:\Windows\SysWow64\comdlg32.OCX 2011-09-28 19:19:34 124688 —-a-w- C:\Windows\SysWow64\mswinsck.ocx 2011-09-28 19:19:34 ——– d—–w- C:\Users\Banny\AppData\Roaming\Convivea 2011-09-28 19:18:12 ——– d—–w- C:\Program Files\WinPcap 2011-09-28 19:18:10 ——– d—–w- C:\Program Files (x86)\VSO 2011-09-28 19:04:39 ——– d—–w- C:\Users\Banny\AppData\Roaming\uTorrent 2011-09-28 19:04:39 ——– d—–w- C:\Users\Banny\AppData\Local\uTorrent 2011-09-28 19:02:45 ——– d—–w- C:\Users\Banny\AppData\Roaming\BearWare.dk 2011-09-28 19:02:44 ——– d—–w- C:\Program Files\TeamTalk4 2011-09-28 18:43:54 62064 —-a-w- C:\Windows\System32\drivers\vmx86.sys 2011-09-28 18:43:31 354416 —-a-w- C:\Windows\SysWow64\vmnetdhcp.exe 2011-09-28 18:43:27 432752 —-a-w- C:\Windows\SysWow64\vmnat.exe 2011-09-28 18:43:27 30320 —-a-w- C:\Windows\System32\drivers\vmnetuserif.sys 2011-09-28 18:43:24 942192 —-a-w- C:\Windows\System32\vnetlib64.dll 2011-09-28 18:43:23 39024 —-a-w- C:\Windows\System32\drivers\hcmon.sys 2011-09-28 18:43:08 ——– d—–w- C:\Program Files (x86)\VMware 2011-09-28 18:43:08 ——– d—–w- C:\Program Files (x86)\Common Files\VMware 2011-09-28 18:43:04 ——– d—–w- C:\Program Files\Common Files\VMware 2011-09-28 18:24:10 ——– d—–w- C:\Program Files (x86)\Everything 2011-09-28 18:17:02 ——– d—–w- C:\PROGRA~3\regid.1986-12.com.adobe 2011-09-28 17:38:52 ——– d—–w- C:\Users\Banny\AppData\Local\Adobe 2011-09-28 17:29:04 ——– d—–w- C:\Users\Banny\AppData\Roaming\Dropbox 2011-09-28 16:32:34 22872 —-a-w- C:\Windows\System32\RegistryDefragBootTime.exe 2011-09-28 16:32:31 ——– d—–w- C:\Windows\System32\appmgmt 2011-09-28 16:32:09 ——– dc—-w- C:\Users\Banny\AppData\Local\MigWiz 2011-09-28 05:45:00 ——– d—–w- C:\Users\Banny\AppData\Roaming\Symantec 2011-09-28 05:45:00 ——– d—–w- C:\Users\Banny\AppData\Local\Symantec_Corporation 2011-09-28 05:22:58 976896 —-a-w- C:\Windows\System32\inetcomm.dll 2011-09-28 02:20:34 404640 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-09-28 02:01:17 ——– d—–w- C:\Users\Banny\.swt 2011-09-28 00:46:10 ——– d—–w- C:\Users\Banny\AppData\Local\Sony 2011-09-28 00:33:57 ——– d—–w- C:\Users\Banny\AppData\Roaming\NVIDIA 2011-09-28 00:31:52 99384 —-a-w- C:\Users\Banny\AppData\Roaming\inst.exe 2011-09-28 00:31:52 82816 —-a-w- C:\Users\Banny\AppData\Roaming\pcouffin.sys 2011-09-28 00:31:48 ——– d—–w- C:\apps (x86) 2011-09-28 00:13:26 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-09-28 00:11:33 ——– d—–w- C:\Program Files (x86)\Common Files\i4j_jres 2011-09-28 00:10:16 503808 —-a-w- C:\Windows\SysWow64\MSVCP71.DLL 2011-09-28 00:10:16 1060864 —-a-w- C:\Windows\SysWow64\MFC71.DLL 2011-09-28 00:10:16 ——– d—–w- C:\Program Files (x86)\Symantec 2011-09-28 00:10:10 154168 —-a-w- C:\Windows\System32\drivers\WimFltr.sys 2011-09-28 00:09:56 170032 —-a-w- C:\Windows\System32\drivers\symsnap.sys 2011-09-28 00:09:41 20528 —-a-w- C:\Windows\System32\drivers\vproeventmonitor.sys 2011-09-28 00:09:36 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2011-09-28 00:09:36 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2011-09-28 00:09:36 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2011-09-28 00:09:25 ——– d—–w- C:\Program Files (x86)\Common Files\Symantec Shared 2011-09-28 00:09:16 ——– d—–w- C:\PROGRA~3\Symantec 2011-09-28 00:09:16 ——– d—–w- C:\PROGRA~3\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3} 2011-09-27 23:58:38 ——– d—–w- C:\PROGRA~3\IObit 2011-09-27 23:58:04 ——– d—–w- C:\Users\Banny\AppData\Roaming\IObit 2011-09-27 23:36:41 ——– d—–w- C:\PROGRA~3\Uniblue 2011-09-27 23:30:26 ——– d—–w- C:\Users\Banny\AppData\Local\PackageAware 2011-09-27 23:28:26 ——– d—–w- C:\Users\Banny\AppData\Local\WinZip 2011-09-27 23:21:49 ——– d-sh–w- C:\Windows\System32\%APPDATA% 2011-09-27 23:21:01 ——– d—–w- C:\Users\Banny\AppData\Local\VirtualStore 2011-09-27 22:26:46 ——– d—–w- C:\Windows\FreeRapid Downloader 2011-09-27 21:58:39 9049936 —-a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-09-27 21:48:21 ——– d—–w- C:\Users\Banny\AppData\Roaming\Azureus 2011-09-27 21:47:57 ——– d—–w- C:\Program Files (x86)\Vuze 2011-09-27 21:41:52 ——– d—–w- C:\Program Files (x86)\SumatraPDF 2011-09-27 21:38:42 601424 ——w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{415D7FCB-EADC-41C7-B10B-0C670F43E81A}\gapaengine.dll 2011-09-27 21:38:18 ——– d—–w- C:\Users\Banny\AppData\Local\Mozilla 2011-09-27 21:35:21 ——– d—–w- C:\Program Files (x86)\Microsoft Security Client 2011-09-27 21:35:20 ——– d—–w- C:\Program Files\Microsoft Security Client 2011-09-27 21:25:53 118784 —-a-w- C:\Windows\SysWow64\MSSTDFMT.DLL 2011-09-27 21:25:53 1071088 —-a-w- C:\Windows\SysWow64\MSCOMCTL.OCX 2011-09-27 21:20:34 ——– d—–w- C:\Users\Banny\AppData\Roaming\Malwarebytes 2011-09-27 21:20:21 ——– d—–w- C:\PROGRA~3\Malwarebytes 2011-09-27 21:20:19 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-09-27 21:19:59 ——– d—–w- C:\PROGRA~3\Spybot - Search & Destroy 2011-09-27 20:48:39 348160 —-a-w- C:\Windows\SysWow64\msvcr71.dll 2011-09-27 20:48:39 1700352 —-a-w- C:\Windows\SysWow64\gdiplus.dll 2011-09-27 20:48:39 ——– d—–w- C:\Program Files\COMODO 2011-09-27 20:48:39 ——– d—–w- C:\PROGRA~3\Comodo 2011-09-27 20:39:11 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2011-09-27 20:36:34 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll 2011-09-27 20:36:34 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll 2011-09-27 20:36:28 ——– d—–w- C:\Program Files (x86)\Etron Technology 2011-09-27 20:36:24 ——– d-sh–w- C:\Windows\Installer 2011-09-27 20:35:11 ——– d—–w- C:\Program Files\Realtek 2011-09-27 20:35:09 74272 —-a-w- C:\Windows\System32\RtNicProp64.dll 2011-09-27 20:35:09 413800 —-a-w- C:\Windows\System32\drivers\Rt64win7.sys 2011-09-27 20:35:09 107552 —-a-w- C:\Windows\System32\RTNUninst64.dll 2011-09-27 20:34:59 80984 —-a-w- C:\Windows\System32\MBWrp64.dll 2011-09-27 20:34:53 ——– d—–w- C:\Program Files (x86)\Realtek 2011-09-27 20:34:52 ——– d–h–w- C:\Program Files (x86)\Temp 2011-09-27 20:34:51 1698408 —-a-w- C:\Windows\RtlExUpd.dll 2011-09-27 20:34:34 53248 —-a-r- C:\Windows\SysWow64\CSVer.dll 2011-09-27 20:26:18 8192 —-a-w- C:\Windows\SysWow64\srvany.exe . ==================== Find3M ==================== . 2011-09-27 20:28:27 142336 —-a-w- C:\Windows\System32\poqexec.exe 2011-09-27 20:28:27 123904 —-a-w- C:\Windows\SysWow64\poqexec.exe 2011-08-30 16:28:46 3069032 —-a-w- C:\Windows\System32\drivers\RTKVHD64.sys 2011-08-30 12:37:44 2518632 —-a-w- C:\Windows\System32\RtPgEx64.dll 2011-08-24 12:30:06 3201128 —-a-w- C:\Windows\System32\RtkAPO64.dll 2011-08-23 11:06:12 97896 —-a-w- C:\Windows\System32\RCoInst64.dll 2011-08-22 14:40:08 252016 —-a-w- C:\Windows\SysWow64\vmnc.dll 2011-08-22 14:12:26 62064 —-a-w- C:\Windows\System32\vmnetbridge.dll 2011-08-22 14:12:26 48752 —-a-w- C:\Windows\System32\vnetinst.dll 2011-08-22 14:12:26 45680 —-a-w- C:\Windows\System32\drivers\vmnetbridge.sys 2011-08-22 14:12:26 24176 —-a-w- C:\Windows\System32\drivers\vmnet.sys 2011-08-22 14:12:26 20080 —-a-w- C:\Windows\System32\drivers\vmnetadapter.sys 2011-08-19 20:10:26 64600 —-a-w- C:\Windows\System32\MBppld64.dll 2011-08-19 20:10:16 886360 —-a-w- C:\Windows\System32\MBAPO64.dll 2011-08-19 20:10:14 746072 —-a-w- C:\Windows\SysWow64\MBAPO32.dll 2011-08-19 13:54:12 1881704 —-a-w- C:\Windows\System32\RtkApi64.dll 2011-08-08 13:59:12 67184 —-a-w- C:\Windows\System32\vsocklib.dll 2011-08-08 13:59:12 63088 —-a-w- C:\Windows\SysWow64\vsocklib.dll 2011-08-08 13:59:12 116336 —-a-w- C:\Windows\System32\drivers\vmci.sys 2011-07-27 23:55:14 2604376 —-a-w- C:\Windows\System32\WavesGUILib.dll 2011-07-27 23:55:08 2132824 —-a-w- C:\Windows\System32\MaxxAudioEQ.dll 2011-07-22 18:35:22 1247848 —-a-w- C:\Windows\System32\RTCOM64.dll 2011-07-22 05:42:23 2303488 —-a-w- C:\Windows\System32\jscript9.dll 2011-07-22 05:36:16 1389056 —-a-w- C:\Windows\System32\wininet.dll 2011-07-22 05:32:40 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2011-07-22 02:54:43 1797632 —-a-w- C:\Windows\SysWow64\jscript9.dll 2011-07-22 02:48:26 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-07-22 02:44:36 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-07-16 05:41:50 362496 —-a-w- C:\Windows\System32\wow64win.dll 2011-07-16 05:41:49 243200 —-a-w- C:\Windows\System32\wow64.dll 2011-07-16 05:41:49 13312 —-a-w- C:\Windows\System32\wow64cpu.dll 2011-07-16 05:39:10 16384 —-a-w- C:\Windows\System32\ntvdm64.dll 2011-07-16 05:37:12 421888 —-a-w- C:\Windows\System32\KernelBase.dll 2011-07-16 04:29:19 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2011-07-16 04:26:00 44032 —-a-w- C:\Windows\apppatch\acwow64.dll 2011-07-16 04:25:37 25600 —-a-w- C:\Windows\SysWow64\setup16.exe 2011-07-16 04:24:23 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2011-07-16 04:24:22 272384 —-a-w- C:\Windows\SysWow64\KernelBase.dll 2011-07-16 02:21:41 2048 —-a-w- C:\Windows\SysWow64\user.exe 2011-07-16 02:17:19 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2011-07-16 02:17:19 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2011-07-16 02:17:19 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2011-07-16 02:17:19 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2011-07-09 05:26:20 2048 —-a-w- C:\Windows\System32\tzres.dll 2011-07-09 04:29:46 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2011-07-09 02:46:28 288768 —-a-w- C:\Windows\System32\drivers\mrxsmb10.sys . ============= FINISH: 11:59:17.71 ===============

Attachments:

  • [attachment removed: Logs.zip.zip]
Post #2
:welcome:

Just copy and paste any logs we ask for into this thread in lew of attaching them, its easier for us to analyse.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]





ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI