Hey there. Everytime i start up my computer, this thing comes out C:\Users\MyUsername\AppData\Roaming\Windir\SVCHOST.exe and starts running and this has been making my computer run really slow. Is there any way i can get rid of this? Thanks
Welcome to the forum.DDS from one of the links below and save it to your desktop:dds.scr or dds.com to run the tool, on Vista or Win 7 or Win 8 right click and select Run as administratorRun button if prompted with an Open File - Security Warning dialog box.DDS will open two (2) logs: DDS.txt and Attach.txt Please remove any usb or external drives from the computer before you run this scan! RogueKiller to your desktop.For Windows XP, double-click to start. Scan to scan the system. Don't Fix anything! Don't run any other options, they're not all bad!!!!!!!
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 13/07/2012 03:12:48
System Uptime: 22/02/2013 00:27:14 (0 hours ago)
.
Motherboard: Dell Inc. | | 0K138P
Processor: Intel® Core™2 Duo CPU P8700 @ 2.53GHz | Microprocessor | 1597/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 283 GiB total, 156.319 GiB free.
D: is FIXED (NTFS) - 15 GiB total, 14.543 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP80: 08/02/2013 21:05:52 - Windows Update
RP81: 13/02/2013 16:47:21 - Windows Update
RP82: 13/02/2013 17:56:02 - Windows Update
RP83: 18/02/2013 21:50:38 - avast! Internet Security Setup
RP84: 20/02/2013 01:08:22 - Windows Update
.
==== Installed Programs ======================
.
Adobe Reader XI (11.0.01)
Advanced Audio FX Engine
Air Video Server 2.4.6-beta3
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avast License by ZeNiX [2012-06-29]
avast! Internet Security
BitTorrent
BitTorrentControl_v12 Toolbar
Bonjour
Dell Resource CD
Dell Webcam Central
DivX Setup
Facebook Video Calling 1.2.0.287
Female Voice Pack
GOM Player
Google Chrome
HTC Driver Installer
HTC Sync Manager
IDT Audio
iExplorer [removed]
Intel® Graphics Media Accelerator Driver
IPTInstaller
iTunes
Java 7 Update 7
Java Auto Updater
Java™ 6 Update 6
JavaFX 2.1.1
Live! Cam Avatar Creator
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MorphVOX Pro
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
PowerISO
QuickTime
Realtek 8136 8168 8169 Ethernet Driver
Sanguo XI
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Skype™ 6.1
System Requirements Lab CYRI
System Requirements Lab for Intel
TeamViewer 8
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
VC80CRTRedist - 8.0.50727.6195
WinZip 16.5
.
==== Event Viewer Messages From Past Week ========
.
20/02/2013 20:47:16, Error: Service Control Manager [7031] - The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
20/02/2013 20:17:20, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
20/02/2013 01:20:46, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
.
==== End Of File ===========================
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16464 BrowserJavaVersion: 10.7.2
Run by [removed] at 0:31:26 on 2013-02-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3034.1486 [GMT 11:00]
.
AV: avast! Internet Security *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Internet Security *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: avast! Internet Security *Enabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\BitTorrent\BitTorrent.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Harry\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3225826
uURLSearchHooks: BitTorrentControl_v12 Toolbar: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - C:\Program Files (x86)\BitTorrentControl_v12\prxtbBitT.dll
mURLSearchHooks: BitTorrentControl_v12 Toolbar: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - C:\Program Files (x86)\BitTorrentControl_v12\prxtbBitT.dll
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: BitTorrentControl_v12 Toolbar: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - C:\Program Files (x86)\BitTorrentControl_v12\prxtbBitT.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: BitTorrentControl_v12 Toolbar: {B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14} - C:\Program Files (x86)\BitTorrentControl_v12\prxtbBitT.dll
TB: BitTorrentControl_v12 Toolbar: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - C:\Program Files (x86)\BitTorrentControl_v12\prxtbBitT.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Google Update] "C:\Users\Harry\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [BitTorrent] "C:\Program Files (x86)\BitTorrent\BitTorrent.exe" /MINIMIZED
uRun: [Facebook Update] "C:\Users\Harry\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [18.exe] C:\Users\Harry\AppData\RoamingMicrosoft\System\Services\18.exe
uRun: [HKCU] C:\Users\Harry\AppData\Roaming\WinDir\Svchost.exe
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [AirVideoServer] C:\Program Files (x86)\AirVideoServer\AirVideoServer.exe
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre7\bin\jusched.exe"
mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
TCP: NameServer = 10.14.67.1
TCP: Interfaces\{070F1F38-FFB9-49DB-BB4E-509E289E9E0A} : DHCPNameServer = 10.14.67.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck -
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck -
x64-SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll
x64-STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 aswNdis;avast! Firewall NDIS Filter Service;C:\Windows\System32\drivers\aswNdis.sys [2013-2-20 12368]
R0 aswNdis2;avast! Firewall Core Firewall Service;C:\Windows\System32\drivers\aswNdis2.sys [2013-2-20 262656]
R1 aswFW;avast! TDI Firewall driver;C:\Windows\System32\drivers\aswFW.sys [2013-2-20 132864]
R1 aswKbd;aswKbd;C:\Windows\System32\drivers\aswKbd.sys [2013-2-20 21136]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-2-20 984144]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-2-20 370288]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [2012-7-13 89600]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-2-20 25232]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-2-20 71600]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-2-20 44808]
R2 avast! Firewall;avast! Firewall;C:\Program Files\AVAST Software\Avast\afwServ.exe [2013-2-20 133912]
R2 HTCMonitorService;HTCMonitorService;C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [2012-12-12 87368]
R2 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2013-1-26 167424]
R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-1-29 3467768]
R3 cbfs3;EldoS Callback File System driver v3;C:\Windows\System32\drivers\cbfs3.sys [2013-2-7 352144]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2012-7-24 172704]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-7-13 215040]
R3 ScreamBAudioSvc;ScreamBee Audio;C:\Windows\System32\drivers\ScreamingBAudio64.sys [2010-7-1 38992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]
S3 HTCAND64;HTC Device Driver;C:\Windows\System32\drivers\ANDROIDUSB.sys [2009-11-2 33736]
S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\System32\drivers\htcnprot.sys [2012-12-7 36928]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-7-16 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-4-25 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-7-15 1255736]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2013-02-19 14:16:25 1187697 —-a-w- C:\Windows\unins000.exe
2013-02-19 14:10:24 132864 —-a-w- C:\Windows\System32\drivers\aswFW.sys
2013-02-19 14:10:07 54072 —-a-w- C:\Windows\System32\drivers\aswRdr2.sys
2013-02-19 14:10:07 262656 —-a-w- C:\Windows\System32\drivers\aswNdis2.sys
2013-02-19 14:10:05 21136 —-a-w- C:\Windows\System32\drivers\aswKbd.sys
2013-02-19 14:10:04 984144 —-a-w- C:\Windows\System32\drivers\aswSnx.sys
2013-02-19 14:09:59 71600 —-a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2013-02-19 14:09:36 12368 —-a-w- C:\Windows\System32\drivers\aswNdis.sys
2013-02-19 14:09:25 9161176 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{23094693-7822-4798-B5C5-22DF44F02C3A}\mpengine.dll
2013-02-19 14:09:21 41224 —-a-w- C:\Windows\avastSS.scr
2013-02-18 10:51:00 ——– d—–w- C:\ProgramData\AVAST Software
2013-02-18 10:51:00 ——– d—–w- C:\Program Files\AVAST Software
2013-02-17 12:42:54 647168 —-a-w- C:\Windows\AutoKMS.exe
2013-02-17 12:42:32 78848 —-a-w- C:\Windows\KMSEmulator.exe
2013-02-14 05:11:05 ——– d—–w- C:\Windows\Sanguo XI
2013-02-14 05:11:04 ——– d—–w- C:\Program Files (x86)\Sanguo XI
2013-02-13 08:29:22 996352 —-a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 08:29:22 768000 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 05:52:40 5553512 —-a-w- C:\Windows\System32\ntoskrnl.exe
2013-02-13 05:52:38 3967848 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-02-13 05:52:38 3913064 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-02-13 05:52:26 3153408 —-a-w- C:\Windows\System32\win32k.sys
2013-02-13 05:52:22 215040 —-a-w- C:\Windows\System32\winsrv.dll
2013-02-13 05:52:21 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2013-02-13 05:52:21 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2013-02-13 05:52:21 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-02-13 05:52:20 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2013-02-13 05:52:20 2048 —-a-w- C:\Windows\SysWow64\user.exe
2013-02-13 05:52:17 288088 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2013-02-13 05:52:17 1913192 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2013-02-07 11:19:14 ——– d—–w- C:\Users\Harry\AppData\Local\libimobiledevice
2013-02-07 09:00:47 ——– d—–w- C:\Users\Harry\AppData\Local\Macroplant_LLC
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-02-07 08:59:07 159744 —-a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-02-07 08:58:24 190480 —-a-w- C:\Windows\System32\CbFsMntNtf3.dll
2013-02-07 08:58:24 158224 —-a-w- C:\Windows\SysWow64\CbFsMntNtf3.dll
2013-02-07 08:58:24 141328 —-a-w- C:\Windows\System32\CbFsNetRdr3.dll
2013-02-07 08:58:23 223760 —-a-w- C:\Windows\SysWow64\CbFsNetRdr3.dll
2013-02-07 08:57:20 352144 —-a-w- C:\Windows\System32\drivers\cbfs3.sys
2013-02-07 08:57:12 ——– d—–w- C:\Program Files (x86)\iExplorer
2013-02-07 08:47:42 ——– d—–w- C:\Users\Harry\AppData\Local\Programs
2013-01-30 11:30:29 ——– d—–w- C:\Users\Harry\AppData\Roaming\Unity
2013-01-30 11:00:26 ——– d—–w- C:\Users\Harry\AppData\Local\Unity
2013-01-29 09:09:02 ——– d—–w- C:\Program Files (x86)\TeamViewer
2013-01-29 08:41:28 ——– d—–w- C:\Users\Harry\AppData\Local\AirVideoServer
2013-01-29 08:41:24 ——– d–h–w- C:\jexepackres
2013-01-29 08:41:20 ——– d—–w- C:\Program Files (x86)\AirVideoServer
2013-01-27 05:59:12 ——– d—–w- C:\Program Files (x86)\MSXML 4.0
2013-01-26 12:14:42 ——– d—–w- C:\Users\Harry\AppData\Roaming\HTC Sync
2013-01-26 12:14:31 ——– d—–w- C:\Users\Harry\AppData\Local\HTC MediaHub
2013-01-26 12:06:33 5 —-a-w- C:\Windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
2013-01-26 11:56:40 ——– d—–w- C:\Users\Harry\AppData\Roaming\Outlook
2013-01-26 11:31:37 ——– d—–w- C:\Users\Harry\AppData\Roaming\HTC
2013-01-26 11:31:36 ——– d—–w- C:\ProgramData\HTC
2013-01-26 11:29:40 ——– d—–w- C:\ProgramData\Motorola
2013-01-26 11:28:04 ——– d—–w- C:\Program Files (x86)\Spirent Communications
2013-01-26 11:28:04 ——– d—–w- C:\Program Files (x86)\HTC
2013-01-26 11:26:57 ——– d—–w- C:\Users\Harry\AppData\Local\Downloaded Installations
.
==================== Find3M ====================
.
2013-01-20 03:44:40 154283 —ha-w- C:\Users\Harry\AppData\Roaming\Harry-wchelper.dll
2013-01-16 14:28:58 273840 ——w- C:\Windows\System32\MpSigStub.exe
2013-01-09 01:19:09 2312704 —-a-w- C:\Windows\System32\jscript9.dll
2013-01-09 01:12:03 1392128 —-a-w- C:\Windows\System32\wininet.dll
2013-01-09 01:11:06 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2013-01-09 01:07:51 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:47 599040 —-a-w- C:\Windows\System32\vbscript.dll
2013-01-09 01:04:42 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2013-01-08 22:11:21 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:03:20 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:12 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 21:59:02 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:29 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll
2013-01-08 21:56:23 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-01-04 04:43:21 44032 —-a-w- C:\Windows\apppatch\acwow64.dll
2012-12-16 17:11:22 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-12-16 14:45:03 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-07 13:20:16 441856 —-a-w- C:\Windows\System32\Wpc.dll
2012-12-07 13:15:31 2746368 —-a-w- C:\Windows\System32\gameux.dll
2012-12-07 12:26:17 308736 —-a-w- C:\Windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 —-a-w- C:\Windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 —-a-w- C:\Windows\System32\usk.rs
2012-12-07 11:20:03 43520 —-a-w- C:\Windows\System32\csrr.rs
2012-12-07 11:20:03 23552 —-a-w- C:\Windows\System32\oflc.rs
2012-12-07 11:20:01 45568 —-a-w- C:\Windows\System32\oflc-nz.rs
2012-12-07 11:20:01 44544 —-a-w- C:\Windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 —-a-w- C:\Windows\System32\pegi-fi.rs
2012-12-07 11:20:00 20480 —-a-w- C:\Windows\System32\pegi-pt.rs
2012-12-07 11:19:59 20480 —-a-w- C:\Windows\System32\pegi.rs
2012-12-07 11:19:58 46592 —-a-w- C:\Windows\System32\fpb.rs
2012-12-07 11:19:57 40960 —-a-w- C:\Windows\System32\cob-au.rs
2012-12-07 11:19:57 21504 —-a-w- C:\Windows\System32\grb.rs
2012-12-07 11:19:57 15360 —-a-w- C:\Windows\System32\djctq.rs
2012-12-07 11:19:56 55296 —-a-w- C:\Windows\System32\cero.rs
2012-12-07 11:19:55 51712 —-a-w- C:\Windows\System32\esrb.rs
2012-12-07 07:27:50 36928 —-a-w- C:\Windows\System32\drivers\htcnprot.sys
2012-11-30 05:45:35 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-11-30 05:45:35 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-11-30 05:45:35 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-11-30 05:43:12 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-11-30 05:41:07 424448 —-a-w- C:\Windows\System32\KernelBase.dll
2012-11-30 04:53:59 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-11-30 02:38:59 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 0:32:47.22 ===============
RogueKiller V8.5.1 _x64_ [Feb 21 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog :
http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Harry [Admin rights]
Mode : Scan – Date : 02/22/2013 00:38:02
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 6 ¤¤¤
[RUN][ROGUE ST] HKCU\[…]\Run : 18.exe (C:\Users\Harry\AppData\RoamingMicrosoft\System\Services\18.exe) -> FOUND
[RUN][HJNAME] HKCU\[…]\Run : HKCU (C:\Users\Harry\AppData\Roaming\WinDir\Svchost.exe) [7] -> FOUND
[RUN][ROGUE ST] HKUS\S-1-5-21-3683780057-4010606261-3431098423-1000[…]\Run : 18.exe (C:\Users\Harry\AppData\RoamingMicrosoft\System\Services\18.exe) -> FOUND
[RUN][HJNAME] HKUS\S-1-5-21-3683780057-4010606261-3431098423-1000[…]\Run : HKCU (C:\Users\Harry\AppData\Roaming\WinDir\Svchost.exe) [7] -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BEVT-75ZCT2 ATA Device +++++
— User —
[MBR] 9a92288492440b5df80b57bcc92b0df3
[BSP] f9411680eb20257ebec59c1df8564283 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 290204 Mo
User = LL1 … OK!
User = LL2 … OK!
Finished : << RKreport[1]_S_02222013_02d0038.txt >>
RKreport[1]_S_02222013_02d0038.txt
Run
RogueKiller again and click
Scan
When the scan completes > click on the
Registry tab
Put a check next to all of these and uncheck the rest: (if found)
[RUN][ROGUE ST] HKCU\[…]\Run : 18.exe (C:\Users\Harry\AppData\RoamingMicrosoft\System\Services\18.exe) -> FOUND
Now click
Delete on the right hand column under
Options
——————————————-
Next:
Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.
MBAR tutorial
Download
Malwarebytes Anti-Rootkit from HERE
Unzip the contents to a folder in a convenient location. Open the folder where the contents were unzipped and run mbar.exe Follow the instructions in the wizard to update and allow the program to scan your computer for threats. Click on the Cleanup button to remove any threats and reboot if prompted to do so. Wait while the system shuts down and the cleanup process is performed. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process. When done, please post the two logs produced they will be in the MBAR folder….. mbar-log.txt and system-log.txt
~~~~~~~~~~~~~~~~~~~~~~~
Note:
If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
Internet access
If there are additional problems with your system, such as any of those listed above or other system issues, then run the
fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.
Verify that your system is now functioning normally.
MrC
sorry but can you teach me how to create a system restore point?
it's kinda late i should get to sleep but i'll continue this as early as i can tomorrow. thanks for everything
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
www.malwarebytes.org
Database version: v2013.02.22.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Harry :: HARRY-PC [administrator]
22/02/2013 19:26:26
mbar-log-2013-02-22 (19-26-26).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 29809
Time elapsed: 29 minute(s), 24 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
—————————————
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
© Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 9.0.8112.16421
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.527000 GHz
Memory total: 3181760512, free: 1403588608
———— Kernel report ————
02/22/2013 01:07:48
———— Loaded modules ———–
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\aswNdis2.sys
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\aswNdis.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\Drivers\aswKbd.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\Drivers\aswFW.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\aswrdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\System32\Drivers\SCDEmu.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\bcmwl664.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\drivers\ScreamingBAudio64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\cbfs3.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\stwrt64.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\drivers\kbdhid.sys
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\setupapi.dll
\Windows\System32\kernel32.dll
\Windows\System32\gdi32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\nsi.dll
\Windows\System32\user32.dll
\Windows\System32\psapi.dll
\Windows\System32\urlmon.dll
\Windows\System32\ole32.dll
\Windows\System32\lpk.dll
\Windows\System32\wininet.dll
\Windows\System32\oleaut32.dll
\Windows\System32\usp10.dll
\Windows\System32\shlwapi.dll
\Windows\System32\sechost.dll
\Windows\System32\comdlg32.dll
\Windows\System32\ws2_32.dll
\Windows\System32\imm32.dll
\Windows\System32\shell32.dll
\Windows\System32\difxapi.dll
\Windows\System32\advapi32.dll
\Windows\System32\normaliz.dll
\Windows\System32\msctf.dll
\Windows\System32\iertutil.dll
\Windows\System32\clbcatq.dll
\Windows\System32\msvcrt.dll
\Windows\System32\imagehlp.dll
\Windows\System32\comctl32.dll
\Windows\System32\devobj.dll
\Windows\System32\wintrust.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\KernelBase.dll
\Windows\System32\crypt32.dll
\Windows\System32\msasn1.dll
———– End ———–
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800331e680
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8002eb01f0
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.02.21.06
Initializing…
Done!
<<<2>>>
Device number: 0, partition: 3
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800331e680, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
——— Disk Stack ——
DevicePointer: 0xfffffa800331f040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800331e680, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8002eb01f0, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a004d379a0, 0xfffffa800331e680, 0xfffffa8005505190
Lower DeviceData: 0xfffff8a0040c5b40, 0xfffffa8002eb01f0, 0xfffffa80058e9580
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers…
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7BA3704B
Partition information:
Partition 0 type is Other (0xde)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 80262
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 81920 Numsec = 30720000
Partition 2 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 30801920 Numsec = 594338480
Partition file system is NTFS
Partition is bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 320072933376 bytes
Sector size: 512 bytes
Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)…
Done!
Performing system, memory and registry scan…
Infected: c:\Windows\AutoKMS.exe –> [Riskware.Keygen]
Infected: c:\Windows\KMSEmulator.exe –> [RiskWare.Tool.CK]
Infected: c:\Users\Harry\Desktop\Downloads\mplayer_Setup.exe –> [PUP.Bundle.Installer.OI]
Infected: c:\Users\Harry\AppData\Roaming\WinDir\Svchost.exe –> [Trojan.Agent]
Infected: c:\Users\Harry\AppData\Roaming\Harry-wchelper.dll –> [Trojan.Agent.Gen]
Done!
Scan finished
Creating System Restore point…
Scheduling clean up…
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================
—————————————
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
© Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 9.0.8112.16421
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.527000 GHz
Memory total: 3181760512, free: 2158878720
Removal queue found; removal started
Removing c:\Windows\AutoKMS.exe…
Removing c:\Windows\KMSEmulator.exe…
Removing c:\Users\Harry\Desktop\Downloads\mplayer_Setup.exe…
Removing c:\Users\Harry\AppData\Roaming\WinDir\Svchost.exe…
Removing c:\Users\Harry\AppData\Roaming\Harry-wchelper.dll…
Removal finished
=======================================
—————————————
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
© Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 9.0.8112.16421
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.527000 GHz
Memory total: 3181760512, free: 1493221376
———— Kernel report ————
02/22/2013 18:56:25
———— Loaded modules ———–
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\aswNdis2.sys
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\aswNdis.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\Drivers\aswKbd.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\Drivers\aswFW.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\aswrdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\System32\Drivers\SCDEmu.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\bcmwl664.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\drivers\ScreamingBAudio64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\cbfs3.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\stwrt64.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\drivers\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\DRIVERS\monitor.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\Wldap32.dll
\Windows\System32\gdi32.dll
\Windows\System32\user32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\usp10.dll
\Windows\System32\ws2_32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\lpk.dll
\Windows\System32\setupapi.dll
\Windows\System32\shlwapi.dll
\Windows\System32\iertutil.dll
\Windows\System32\normaliz.dll
\Windows\System32\shell32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\sechost.dll
\Windows\System32\urlmon.dll
\Windows\System32\nsi.dll
\Windows\System32\imm32.dll
\Windows\System32\kernel32.dll
\Windows\System32\psapi.dll
\Windows\System32\wininet.dll
\Windows\System32\imagehlp.dll
\Windows\System32\comdlg32.dll
\Windows\System32\msctf.dll
\Windows\System32\difxapi.dll
\Windows\System32\advapi32.dll
\Windows\System32\ole32.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\wintrust.dll
\Windows\System32\devobj.dll
\Windows\System32\KernelBase.dll
\Windows\System32\crypt32.dll
\Windows\System32\comctl32.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
———– End ———–
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80032fd060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8002e281f0
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.02.21.07
Downloaded database version: v2013.02.21.08
Downloaded database version: v2013.02.21.09
Downloaded database version: v2013.02.21.10
Downloaded database version: v2013.02.21.11
Downloaded database version: v2013.02.22.01
Initializing…
Done!
<<<2>>>
Device number: 0, partition: 3
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80032fd060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
——— Disk Stack ——
DevicePointer: 0xfffffa80032fdb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80032fd060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8002e281f0, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a001091be0, 0xfffffa80032fd060, 0xfffffa8002853790
Lower DeviceData: 0xfffff8a00c8ac240, 0xfffffa8002e281f0, 0xfffffa8005800a90
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers…
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7BA3704B
Partition information:
Partition 0 type is Other (0xde)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 80262
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 81920 Numsec = 30720000
Partition 2 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 30801920 Numsec = 594338480
Partition file system is NTFS
Partition is bootable
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 320072933376 bytes
Sector size: 512 bytes
Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)…
Done!
Performing system, memory and registry scan…
Done!
Scan finished
=======================================
Next………..
Please download and run
ComboFix .
The most important things to remember when running it is to
disable all your malware programs and run
Combofix from your
desktop .
Please visit this webpage for download links, and instructions for running
ComboFix
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Information on disabling your malware programs can be found
Here .
Make sure you run
ComboFix from your
desktop .
Give it at least 30-45 minutes to finish if needed.
Please include the
C:\ComboFix.txt in your next reply for further review.
———->NOTE<———-
If you get the message
Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix….please reboot the computer, this should resolve the problem. You may have to do this several times if needed.
MrC
ComboFix 13-02-22.01 - Harry 23/02/2013 14:49:27.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3034.1983 [GMT 11:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Internet Security *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Internet Security *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Harry\AppData\Roaming\WinDir
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Files Created from 2013-01-23 to 2013-02-23 )))))))))))))))))))))))))))))))
.
.
2013-02-23 03:58 . 2013-02-23 03:58 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-02-23 03:49 . 2013-02-23 03:49 76232 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ABF1EBF5-EFE1-473C-BDDF-2575E73976F2}\offreg.dll
2013-02-22 07:00 . 2013-02-08 00:28 9162192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ABF1EBF5-EFE1-473C-BDDF-2575E73976F2}\mpengine.dll
2013-02-21 14:56 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys
2013-02-21 14:56 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll
2013-02-21 14:56 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll
2013-02-21 14:56 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-02-21 14:56 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll
2013-02-21 14:56 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll
2013-02-21 14:56 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll
2013-02-21 14:56 . 2012-05-04 11:00 366592 —-a-w- c:\windows\system32\qdvd.dll
2013-02-21 14:56 . 2012-05-04 09:59 514560 —-a-w- c:\windows\SysWow64\qdvd.dll
2013-02-21 14:07 . 2013-02-21 14:07 ——– d—–w- c:\programdata\Malwarebytes
2013-02-19 14:16 . 2013-02-19 14:16 1187697 —-a-w- c:\windows\unins000.exe
2013-02-19 14:10 . 2012-10-30 22:51 370288 —-a-w- c:\windows\system32\drivers\aswSP.sys
2013-02-19 14:10 . 2012-10-30 22:51 25232 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-02-19 14:10 . 2012-10-30 22:51 132864 —-a-w- c:\windows\system32\drivers\aswFW.sys
2013-02-19 14:10 . 2012-10-30 22:51 262656 —-a-w- c:\windows\system32\drivers\aswNdis2.sys
2013-02-19 14:10 . 2012-10-15 15:59 54072 —-a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-02-19 14:10 . 2012-10-30 22:51 59728 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2013-02-19 14:10 . 2012-10-30 22:51 21136 —-a-w- c:\windows\system32\drivers\aswKbd.sys
2013-02-19 14:10 . 2012-10-30 22:51 984144 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2013-02-19 14:09 . 2012-10-30 22:51 71600 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-02-19 14:09 . 2012-10-30 22:50 285328 —-a-w- c:\windows\system32\aswBoot.exe
2013-02-19 14:09 . 2012-09-21 07:26 12368 —-a-w- c:\windows\system32\drivers\aswNdis.sys
2013-02-19 14:09 . 2012-10-30 22:51 41224 —-a-w- c:\windows\avastSS.scr
2013-02-19 14:09 . 2012-10-30 22:50 227648 —-a-w- c:\windows\SysWow64\aswBoot.exe
2013-02-18 10:51 . 2013-02-19 14:09 ——– d—–w- c:\programdata\AVAST Software
2013-02-18 10:51 . 2013-02-19 14:09 ——– d—–w- c:\program files\AVAST Software
2013-02-15 22:04 . 2013-02-15 22:04 208448 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-02-14 05:11 . 2013-02-14 05:11 ——– d—–w- c:\windows\Sanguo XI
2013-02-14 05:11 . 2013-02-14 05:11 ——– d—–w- c:\program files (x86)\Sanguo XI
2013-02-13 08:29 . 2013-01-09 01:10 996352 —-a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 08:29 . 2013-01-08 22:01 768000 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 05:52 . 2013-01-05 05:53 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-02-13 05:52 . 2013-01-05 05:00 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-02-13 05:52 . 2013-01-05 05:00 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-02-13 05:52 . 2013-01-04 03:26 3153408 —-a-w- c:\windows\system32\win32k.sys
2013-02-13 05:52 . 2013-01-04 05:46 215040 —-a-w- c:\windows\system32\winsrv.dll
2013-02-13 05:52 . 2013-01-04 02:47 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2013-02-13 05:52 . 2013-01-04 02:47 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2013-02-13 05:52 . 2013-01-04 02:47 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2013-02-13 05:52 . 2013-01-04 04:51 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2013-02-13 05:52 . 2013-01-04 02:47 2048 —-a-w- c:\windows\SysWow64\user.exe
2013-02-13 05:52 . 2013-01-03 06:00 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-02-13 05:52 . 2013-01-03 06:00 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-07 11:19 . 2013-02-07 11:19 ——– d—–w- c:\users\Harry\AppData\Local\libimobiledevice
2013-02-07 09:00 . 2013-02-07 09:00 ——– d—–w- c:\users\Harry\AppData\Local\Macroplant_LLC
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-02-07 08:59 . 2013-02-07 08:59 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-02-07 08:58 . 2013-02-07 08:59 ——– d—–w- c:\program files (x86)\QuickTime
2013-02-07 08:58 . 2012-04-09 05:27 190480 —-a-w- c:\windows\system32\CbFsMntNtf3.dll
2013-02-07 08:58 . 2012-04-09 05:27 158224 —-a-w- c:\windows\SysWow64\CbFsMntNtf3.dll
2013-02-07 08:58 . 2012-04-09 05:27 141328 —-a-w- c:\windows\system32\CbFsNetRdr3.dll
2013-02-07 08:58 . 2012-04-09 05:27 223760 —-a-w- c:\windows\SysWow64\CbFsNetRdr3.dll
2013-02-07 08:57 . 2012-04-09 05:27 352144 —-a-w- c:\windows\system32\drivers\cbfs3.sys
2013-02-07 08:57 . 2013-02-07 08:57 ——– d—–w- c:\program files (x86)\iExplorer
2013-02-07 08:47 . 2013-02-07 08:47 ——– d—–w- c:\users\Harry\AppData\Local\Programs
2013-01-30 12:40 . 2013-01-30 12:40 ——– d—–w- c:\program files (x86)\Common Files\Adobe
2013-01-30 11:30 . 2013-01-30 11:30 ——– d—–w- c:\users\Harry\AppData\Roaming\Unity
2013-01-30 11:00 . 2013-01-30 11:00 ——– d—–w- c:\users\Harry\AppData\Local\Unity
2013-01-29 09:09 . 2013-01-29 09:09 ——– d—–w- c:\program files (x86)\TeamViewer
2013-01-29 08:41 . 2013-01-29 08:45 ——– d—–w- c:\users\Harry\AppData\Local\AirVideoServer
2013-01-29 08:41 . 2013-02-23 03:38 ——– d—–w- C:\jexepackres
2013-01-29 08:41 . 2013-01-29 08:41 ——– d—–w- c:\program files (x86)\AirVideoServer
2013-01-27 05:59 . 2013-01-27 05:59 ——– d—–w- c:\program files (x86)\MSXML 4.0
2013-01-26 12:14 . 2013-01-26 12:14 ——– d—–w- c:\users\Harry\AppData\Roaming\HTC Sync
2013-01-26 12:14 . 2013-02-23 03:37 ——– d—–w- c:\users\Harry\AppData\Local\HTC MediaHub
2013-01-26 12:14 . 2013-01-26 12:14 ——– d—–w- c:\program files (x86)\Common Files\Nero
2013-01-26 12:06 . 2013-01-26 12:07 5 —-a-w- c:\windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
2013-01-26 11:56 . 2013-01-26 11:56 ——– d—–w- c:\users\Harry\AppData\Roaming\Outlook
2013-01-26 11:31 . 2013-01-26 11:31 ——– d—–w- c:\users\Harry\AppData\Roaming\HTC
2013-01-26 11:31 . 2013-01-26 11:31 ——– d—–w- c:\programdata\HTC
2013-01-26 11:29 . 2013-01-26 11:29 ——– d—–w- c:\programdata\Motorola
2013-01-26 11:28 . 2013-01-26 12:13 ——– d—–w- c:\program files (x86)\HTC
2013-01-26 11:28 . 2013-01-26 11:28 ——– d—–w- c:\program files (x86)\Spirent Communications
2013-01-26 11:26 . 2013-01-26 11:26 ——– d—–w- c:\users\Harry\AppData\Local\Downloaded Installations
2013-01-25 02:22 . 2013-01-25 02:22 ——– d—–w- c:\program files (x86)\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-13 08:32 . 2012-07-24 11:50 70004024 —-a-w- c:\windows\system32\MRT.exe
2013-01-21 23:33 . 2013-01-21 23:33 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2013-01-21 23:33 . 2013-01-21 23:33 2876528 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2013-01-21 23:33 . 2013-01-21 23:33 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2013-01-21 23:33 . 2013-01-21 23:33 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-01-16 14:28 . 2012-07-13 02:07 273840 ——w- c:\windows\system32\MpSigStub.exe
2013-01-11 23:56 . 2013-01-11 23:56 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2013-01-11 23:56 . 2013-01-11 23:56 2876528 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-01-11 23:55 . 2013-01-11 23:55 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-01-11 23:55 . 2013-01-11 23:55 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2013-01-04 04:43 . 2013-02-13 05:52 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-12-16 17:11 . 2012-12-21 05:44 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-21 05:44 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 05:44 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-21 05:44 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-07 13:20 . 2013-01-09 17:08 441856 —-a-w- c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-09 17:08 2746368 —-a-w- c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-09 17:08 308736 —-a-w- c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-09 17:08 2576384 —-a-w- c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-09 17:08 30720 —-a-w- c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-09 17:08 43520 —-a-w- c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-09 17:08 23552 —-a-w- c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-09 17:08 45568 —-a-w- c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-09 17:08 44544 —-a-w- c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-09 17:08 20480 —-a-w- c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-09 17:08 20480 —-a-w- c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-09 17:08 20480 —-a-w- c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-09 17:08 46592 —-a-w- c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-09 17:08 40960 —-a-w- c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-09 17:08 21504 —-a-w- c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-09 17:08 15360 —-a-w- c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-09 17:08 55296 —-a-w- c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-09 17:08 51712 —-a-w- c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-09 17:08 43520 —-a-w- c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-09 17:08 30720 —-a-w- c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-09 17:08 45568 —-a-w- c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-09 17:08 44544 —-a-w- c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-09 17:08 20480 —-a-w- c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-09 17:08 23552 —-a-w- c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-09 17:08 20480 —-a-w- c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-09 17:08 46592 —-a-w- c:\windows\SysWow64\fpb.rs
2012-12-07 10:46 . 2013-01-09 17:08 20480 —-a-w- c:\windows\SysWow64\pegi.rs
2012-12-07 10:46 . 2013-01-09 17:08 21504 —-a-w- c:\windows\SysWow64\grb.rs
2012-12-07 10:46 . 2013-01-09 17:08 40960 —-a-w- c:\windows\SysWow64\cob-au.rs
2012-12-07 10:46 . 2013-01-09 17:08 15360 —-a-w- c:\windows\SysWow64\djctq.rs
2012-12-07 10:46 . 2013-01-09 17:08 55296 —-a-w- c:\windows\SysWow64\cero.rs
2012-12-07 10:46 . 2013-01-09 17:08 51712 —-a-w- c:\windows\SysWow64\esrb.rs
2012-12-07 07:27 . 2012-12-07 07:27 36928 —-a-w- c:\windows\system32\drivers\htcnprot.sys
2012-11-30 05:45 . 2013-01-09 17:07 362496 —-a-w- c:\windows\system32\wow64win.dll
2012-11-30 05:45 . 2013-01-09 17:07 243200 —-a-w- c:\windows\system32\wow64.dll
2012-11-30 05:45 . 2013-01-09 17:07 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2012-11-30 05:43 . 2013-01-09 17:07 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2012-11-30 05:41 . 2013-01-09 17:07 424448 —-a-w- c:\windows\system32\KernelBase.dll
2012-11-30 05:41 . 2013-01-09 17:07 1161216 —-a-w- c:\windows\system32\kernel32.dll
2012-11-30 05:38 . 2013-01-09 17:07 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 17:07 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-11-30 04:53 . 2013-01-09 17:07 274944 —-a-w- c:\windows\SysWow64\KernelBase.dll
2012-11-30 04:45 . 2013-01-09 17:07 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 17:07 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14}"= "c:\program files (x86)\BitTorrentControl_v12\prxtbBitT.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14}]
2011-05-09 09:49 176936 —-a-w- c:\program files (x86)\BitTorrentControl_v12\prxtbBitT.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14}"= "c:\program files (x86)\BitTorrentControl_v12\prxtbBitT.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 05:27 158224 —-a-w- c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="c:\program files (x86)\BitTorrent\BitTorrent.exe" [2013-01-03 980376]
"Facebook Update"="c:\users\Harry\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-10-30 138096]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]
"AirVideoServer"="c:\program files (x86)\AirVideoServer\AirVideoServer.exe" [2012-07-19 4935112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2008-07-07 167936]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2012-12-07 36928]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-15 1255736]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2012-09-21 12368]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [2009-03-02 89600]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2012-10-30 133912]
S2 HTCMonitorService;HTCMonitorService;c:\program files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [2012-12-12 87368]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2012-12-07 167424]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
S3 cbfs3;EldoS Callback File System driver v3;c:\windows\system32\DRIVERS\cbfs3.sys [2012-04-09 352144]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-09 539240]
S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2010-07-01 38992]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3683780057-4010606261-3431098423-1000Core.job
- c:\users\Harry\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-30 12:37]
.
2013-02-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3683780057-4010606261-3431098423-1000UA.job
- c:\users\Harry\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-30 12:37]
.
2013-02-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3683780057-4010606261-3431098423-1000Core.job
- c:\users\Harry\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-18 13:23]
.
2013-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3683780057-4010606261-3431098423-1000UA.job
- c:\users\Harry\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-18 13:23]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 133400 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 05:27 190480 —-a-w- c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 162584]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-13 386840]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-13 417560]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3225826
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.14.67.1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-SunJavaUpdateSched - c:\program files (x86)\Java\jre7\bin\jusched.exe
WebBrowser-{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14} - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{B6AC5E3C-5CEB-4E72-B451-F0E1BA983C14}"=hex:51,66,7a,6c,4c,1d,38,12,52,5d,bf,
b2,d9,12,1c,0b,cb,47,b3,a1,bf,c6,78,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-02-23 15:01:31
ComboFix-quarantined-files.txt 2013-02-23 04:01
.
Pre-Run: 166,543,544,320 bytes free
Post-Run: 166,964,506,624 bytes free
.
- - End Of File - - 3366A914365EF61003195B540F590DD3
Looks Good……Next:
Please download
AdwCleaner from
here and save it on your Desktop.
AdwCleaner is a reliable removal tool for Adware , Foistware , toolbars and potentially unwanted programs.
Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application. Now click on the Search tab. Please post the contents of the log-file created in your next post. Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <– Denotes the number of times the application has been ran, so in this should be something like R1.
Please look over what was found, we're going to delete it all in the next step….if there's something you may want to keep…please let me know and I'll explain to why it shouldn't be on your system.
MrC
