What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

email backdoor windows 8 [Closed]

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
my email account was logged into from Russia yesterday and sent scam emails to all of my contacts. I have changed yahoo email password. I'd would like to know if my bank details are safe This is a new computer & operating system and I'm unfamiliar with it. I'm not a tech head but can follow instructions. thank you
Post #2
:welcome:

Most likely not, but good choice changing your password for your mail, I would also change them for any online banking you do or sites your frequent using a credit card for purchases.

Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)








Important! Please do not perform any fix options offered in aswMBR

Please download aswMBR to your desktop.


  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the Save Log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Post #3 last edited
Hi Ken545 thanks for your reply Im such a luddite am having trouble attaching files for you. I hope I've done the right thing now. DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16519 Run by [removed] at 12:39:59 on 2013-05-06 Microsoft Windows 8 6.2.9200.0.1252.61.1033.18.3977.1976 [GMT 10:00] . AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k NetworkService C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe C:\windows\system32\WLANExt.exe C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\ProgramData\Clickfree\BoxSoftware\UACProxy.exe C:\Program Files\Intel\iCLS Client\HeciServer.exe C:\windows\system32\dashost.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe C:\windows\system32\svchost.exe -k imgsvc C:\Windows\system32\TODDSrv.exe C:\Program Files (x86)\TrustDefender\TrustDefender\TrustDefender.exe C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe C:\Program Files\TOSHIBA\Teco\TecoService.exe C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\System32\svchost.exe -k LocalServicePeerNet C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\wbem\unsecapp.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe C:\windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe C:\windows\System32\dwm.exe C:\windows\system32\taskhostex.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccSvcHst.exe c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe C:\windows\Explorer.EXE C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Windows\System32\igfxtray.exe C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe C:\Program Files\TOSHIBA\Teco\TecoResident.exe C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe C:\ProgramData\Clickfree\BoxSoftware\reminder\SacReminder.exe C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe C:\Program Files (x86)\TrustDefender\TrustDefender\TDWatchdog.exe C:\Windows\System32\RuntimeBroker.exe C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE C:\windows\system32\wuauclt.exe C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\windows\SysWOW64\NOTEPAD.EXE C:\windows\system32\wbem\wmiprvse.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://toshiba13.msn.com uDefault_Page_URL = hxxp://toshiba13.msn.com mWinlogon: Userinit = userinit.exe BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\coieplg.dll BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ips\ipsbho.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\coieplg.dll mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [TPUReg(x86)] "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes mRun: [TPUReg] "C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe" /Retimes mRun: [SacReminderBOX] C:\ProgramData\Clickfree\BoxSoftware\reminder\SacReminder.exe mRun: [Intel AppUp(SM) center] "C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" –domain-id F0399437-FD0C-4A48-B101-F0314A6172E4 mRun: [vProt] "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe" mRun: [TrustDefenderWD] "C:\Program Files (x86)\TrustDefender\TrustDefender\TDWatchdog.exe" IE: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIE.dll IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\ONBttnIELinkedNotes.dll IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 TCP: NameServer = 10.0.0.1 TCP: Interfaces\{16000359-F22C-4611-B9F7-30215659CE57} : DHCPNameServer = 10.0.0.1 Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.0.0\ViProtocol.dll SSODL: WebCheck - x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\urlredir.dll x64-Run: [IgfxTray] C:\windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe x64-Run: [Persistence] C:\windows\System32\igfxpers.exe x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-Run: [TCrdMain] C:\Program Files (x86)\TOSHIBA\Hotkey\TCrdMain_Win8.exe x64-Run: [TecoResident] C:\Program Files\TOSHIBA\Teco\TecoResident.exe x64-Run: [TosWaitSrv] C:\Program Files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe x64-Run: [TODDMain] C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\onbttnie.dll x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\msosb.dll x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - x64-Notify: igfxcui - igfxdev.dll x64-SSODL: WebCheck - . ============= SERVICES / DRIVERS =============== . R0 iaStorA;iaStorA;C:\windows\System32\Drivers\iaStorA.sys [2012-12-11 645952] R0 THAccel;THAccel;C:\windows\System32\Drivers\THAccel.sys [2012-12-11 131520] R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\Drivers\tos_sps64.sys [2012-12-11 499096] R1 tdtdi;tdtdi;C:\windows\System32\Drivers\tdtdi.sys [2013-3-8 56464] R2 CFUACProxy_boxsoftware;CFUACProxy_boxsoftware;C:\ProgramData\Clickfree\BoxSoftware\UACProxy.exe [2012-12-11 83792] R2 GFNEXSrv;GFNEX Service;C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [2011-10-14 156672] R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-21 635104] R2 Intel® ME Service;Intel® ME Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [2012-12-11 129856] R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2012-12-11 166720] R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe [2013-4-27 144520] R2 OfficeSvc;Microsoft Office Service;C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-4-27 1817704] R2 PEGAGFN;PEGAGFN;C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [2009-9-12 14344] R2 SplashtopRemoteService;Splashtop® Remote Service;C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2013-1-28 551264] R2 SSUService;Splashtop Software Updater Service;C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2013-1-25 583456] R2 THAccelSvc;TOSHIBA HDD Accelerator Service;C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [2012-8-11 214488] R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\Teco\TecoService.exe [2012-8-25 291240] R2 TrustDefender;TrustDefender;C:\Program Files (x86)\TrustDefender\TrustDefender\TrustDefender.exe [2013-3-8 2003856] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\Drivers\TVALZFL.sys [2012-7-22 16768] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-12-11 365376] R2 vToolbarUpdater15.0.0;vToolbarUpdater15.0.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.0.0\ToolbarUpdater.exe [2013-3-27 990896] R3 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-4-13 1390680] R3 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\System32\Drivers\NISx64\1403010.016\ccsetx64.sys [2013-4-27 168096] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-3-10 138912] R3 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130505.002\IDSviA64.sys [2013-5-6 513184] R3 IntcDAud;Intel® Display Audio;C:\windows\System32\Drivers\IntcDAud.sys [2012-6-20 342528] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\Drivers\RtsUStor.sys [2012-12-11 252048] R3 RTL8168;Realtek 8168 NT Driver;C:\windows\System32\Drivers\Rt630x64.sys [2012-12-11 690832] R3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;C:\windows\System32\Drivers\rtwlane.sys [2012-6-30 1498256] R3 SmbDrvI;SmbDrvI;C:\windows\System32\Drivers\Smb_driver_Intel.sys [2012-9-11 43832] R3 SymDS;Symantec Data Store;C:\windows\System32\Drivers\NISx64\1403010.016\symds64.sys [2013-4-27 493656] R3 SymEFA;Symantec Extended File Attributes;C:\windows\System32\Drivers\NISx64\1403010.016\symefa64.sys [2013-4-27 1139800] R3 SymIRON;Symantec Iron Driver;C:\windows\System32\Drivers\NISx64\1403010.016\ironx64.sys [2013-4-27 224416] R3 SymNetS;Symantec Network Security WFP Driver;C:\windows\System32\Drivers\NISx64\1403010.016\symnets.sys [2013-4-27 432800] R3 TMachInfo;TMachInfo;C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2012-7-28 53384] R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2012-7-29 458152] S0 SymELAM;Symantec ELAM Driver;C:\windows\System32\Drivers\NISx64\1403010.016\symelam.sys [2013-4-27 23448] S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-13 206072] S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE [2012-11-22 178776] S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\Drivers\rtwlane.sys [2012-6-30 1498256] . =============== Created Last 30 ================ . 2013-04-28 04:36:15 ——– d—–w- C:\Users\Lyn\AppData\Local\Microsoft Help 2013-04-27 05:50:25 432800 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\symnets.sys 2013-04-27 05:50:24 796248 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\srtsp64.sys 2013-04-27 05:50:24 493656 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\symds64.sys 2013-04-27 05:50:24 36952 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\srtspx64.sys 2013-04-27 05:50:24 23448 —-a-r- C:\windows\System32\drivers\NISx64\1403010.016\symelam.sys 2013-04-27 05:50:24 224416 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\ironx64.sys 2013-04-27 05:50:24 168096 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\ccsetx64.sys 2013-04-27 05:50:24 1139800 —-a-w- C:\windows\System32\drivers\NISx64\1403010.016\symefa64.sys 2013-04-27 05:50:06 ——– d—–w- C:\windows\System32\drivers\NISx64\1403010.016 2013-04-27 05:37:41 ——– d—–r- C:\Users\Lyn\SkyDrive 2013-04-27 05:37:40 ——– d—–w- C:\Program Files (x86)\Microsoft SkyDrive 2013-04-27 05:37:27 ——– d—–w- C:\ProgramData\Microsoft SkyDrive 2013-04-27 05:33:05 809072 —-a-w- C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe 2013-04-27 05:31:35 ——– d—–w- C:\Program Files\Microsoft Office 15 2013-04-11 10:59:01 ——– d—–w- C:\Users\Lyn\AppData\Local\AVG Secure Search . ==================== Find3M ==================== . 2013-03-27 01:33:07 169488 —-a-w- C:\DUMP4b9f.tmp 2013-03-26 22:14:46 39768 —-a-w- C:\windows\System32\drivers\avgtpx64.sys 2013-03-08 01:26:31 56464 —-a-w- C:\windows\System32\drivers\tdtdi.sys 2013-03-05 23:07:25 78168 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-05 23:07:25 692568 —-a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2013-03-02 08:22:18 361984 —-a-w- C:\windows\SysWow64\MFMediaEngine.dll 2013-03-02 02:44:30 468992 —-a-w- C:\windows\System32\MFMediaEngine.dll 2013-02-12 01:30:04 44032 —-a-w- C:\windows\SysWow64\UXInit.dll 2013-02-12 00:56:19 53760 —-a-w- C:\windows\System32\UXInit.dll 2013-02-12 00:25:18 4041728 —-a-w- C:\windows\System32\win32k.sys 2013-02-12 00:17:50 20992 —-a-w- C:\windows\System32\drivers\usb8023.sys 2013-02-07 04:09:56 69864 —-a-w- C:\windows\System32\drivers\pdc.sys 2013-02-07 03:34:58 10115072 —-a-w- C:\windows\System32\twinui.dll 2013-02-07 03:33:47 2302464 —-a-w- C:\windows\System32\authui.dll 2013-02-07 03:33:42 2146816 —-a-w- C:\windows\System32\actxprxy.dll 2013-02-07 01:34:00 8856576 —-a-w- C:\windows\SysWow64\twinui.dll 2013-02-07 01:33:03 2033664 —-a-w- C:\windows\SysWow64\authui.dll 2013-02-07 01:33:01 754176 —-a-w- C:\windows\SysWow64\actxprxy.dll 2013-02-05 22:31:11 622080 —-a-w- C:\windows\System32\drivers\srv2.sys 2013-02-05 22:29:09 370688 —-a-w- C:\windows\System32\drivers\mrxsmb.sys 2013-02-05 22:28:48 247808 —-a-w- C:\windows\System32\drivers\srvnet.sys 2013-02-05 22:28:36 215552 —-a-w- C:\windows\System32\drivers\mrxsmb20.sys 2013-02-05 04:58:01 1766912 —-a-w- C:\windows\SysWow64\wininet.dll 2013-02-05 04:56:33 2877952 —-a-w- C:\windows\SysWow64\jscript9.dll 2013-02-05 04:56:27 61440 —-a-w- C:\windows\SysWow64\iesetup.dll 2013-02-05 04:56:27 109056 —-a-w- C:\windows\SysWow64\iesysprep.dll 2013-02-05 03:55:27 2706432 —-a-w- C:\windows\SysWow64\mshtml.tlb . ============= FINISH: 12:40:12.29 ===============

Attachments:

Post #4 last edited
ken545 here is the avast file log thanks Lyn aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software Run date: 2013-05-06 13:47:31 —————————– 13:47:31.292 OS Version: Windows x64 5.1.2600 Service Pack 3 13:47:31.292 Number of processors: 2 586 0x2A07 13:47:31.292 ComputerName: LILLY UserName: Lyn 13:47:31.948 Initialze error 1 13:56:47.472 AVAST engine defs: 13050500 13:57:38.291 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000035 13:57:38.291 Disk 0 Vendor: TOSHIBA_MK6475GSX GT001M Size: 610480MB BusType: 11 13:57:38.338 Disk 0 MBR read successfully 13:57:38.338 Disk 0 MBR scan 13:57:38.353 Disk 0 unknown MBR code 13:57:38.369 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1 13:57:38.400 Disk 0 scanning C:\windows\system32\drivers 13:57:38.400 Service scanning 13:57:39.041 Modules scanning 13:57:39.041 Disk 0 trace - called modules: 13:57:39.072 ntoskrnl.exe CLASSPNP.SYS disk.sys Wdf01000.sys THAccel.sys hal.dll 13:57:39.072 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006089740] 13:57:39.072 3 CLASSPNP.SYS[fffff88000b628aa] -> nt!IofCallDriver -> [0xfffffa800608bc70] 13:57:39.588 AVAST engine scan C:\windows 13:57:39.588 AVAST engine scan C:\windows\system32 13:57:39.604 AVAST engine scan C:\windows\system32\drivers 13:57:39.619 AVAST engine scan C:\Users\Lyn 13:57:39.635 AVAST engine scan C:\ProgramData 13:57:39.635 Scan finished successfully 13:58:00.651 Disk 0 MBR has been saved successfully to "C:\Users\Lyn\Desktop\MBR.dat" 13:58:00.651 The log file has been saved successfully to "C:\Users\Lyn\Desktop\aswMBR.txt"

Attachments:

Post #5
Hello Lyn

Actually I prefer to have the logs we ask for just copied and pasted into the thread , its easier for us to analyze.

aswMBR is showing nothing suspicious

OTL is showing a remote access program, are you aware of this and do you use it ?
http://www.splashtop.com/home

Its also showing this which is powered by ASK that supports adware
AVG SafeGuard toolbar




Please download Malwarebytes Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.





OTL by OldTimer
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Click the "Scan All Users" checkbox.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI