TechSpot

HijackThis Log -- looking to discuss as new to Win7

Inactive
By Jakal30
Sep 24, 2012
  1. Hi

    Please find attached my HijackThis log. I am looking to discuss as I an new to Win7 Pro 64bit and would like to understand a bit more what is in here.

    There are some I would have normally deleted in XP Pro but not so sure and do not want to mess up OS.

    Comments and views welcome. I doubt there is any suspicious activity in it and just looking to know what is safe to delete and why.

    Cheers

    Mike
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 47,172   +264

    This forum deals with infected computers.
    Is your computer infected?
     
  3. Jakal30

    Jakal30 TS Rookie Topic Starter

    I'm unsure. There are a few keys I am unsure about.
     
  4. Broni

    Broni Malware Annihilator Posts: 47,172   +264

    If you think you may be infected...

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  5. Jakal30

    Jakal30 TS Rookie Topic Starter

    Thx for that. forgot about all of those tools. scanning now.
     
  6. Jakal30

    Jakal30 TS Rookie Topic Starter

    Malware Bytes Log:

    Malwarebytes Anti-Malware 1.65.0.1400
    www.malwarebytes.org

    Database version: v2012.09.24.08

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Mike :: MININT-L5G76HC [administrator]

    24/09/2012 18:04:05
    mbam-log-2012-09-24 (18-04-05).txt

    Scan type: Full scan (C:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 532536
    Time elapsed: 8 minute(s), 19 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)

    GMER Log:

    NO MODIFICATIONS.


    DDS log:
    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2
    Run by Mike at 18:26:05 on 2012-09-24
    Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.32714.26627 [GMT 1:00]
    .
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: COMODO Defense+ *Enabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
    FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
    C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe
    C:\Program Files (x86)\ASUS\AAHM\1.00.16\aaHMSvc.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
    C:\Program Files\Mouse\Amoumain.exe
    C:\Program Files (x86)\Vtune\TBPANEL.exe
    C:\Program Files (x86)\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
    C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
    C:\Windows\SysWOW64\DeltaIITray.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe
    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
    C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
    C:\Windows\notepad.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.co.uk/
    uDefault_Page_URL = hxxp://www.scan.co.uk
    mWinlogon: Userinit=userinit.exe
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    uRun: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe /A
    uRun: [Sidebar] C:\Program Files (x86)\Windows Sidebar\sidebar.exe /autoRun
    uRun: [AdobeBridge]
    mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
    mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun: [M-Audio Taskbar Icon] C:\Windows\system32\DeltaIITray.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
    mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    mPolicies-system: EnableLinkedConnections = 1 (0x1)
    TCP: DhcpNameServer = 192.168.1.254
    TCP: Interfaces\{E3675AF0-A79D-4A33-AAAB-31B524684224} : DhcpNameServer = 192.168.1.254
    AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
    BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
    mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
    mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    mRun-x64: [M-Audio Taskbar Icon] C:\Windows\system32\DeltaIITray.exe
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
    mRunOnce-x64: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    AppInit_DLLs-X64: C:\Windows\SysWOW64\guard32.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\74zkb9rg.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shoutcast-chromesbox-en-us&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shoutcast-ab-en-us&query=
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
    FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll
    FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
    FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
    FF - plugin: C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: C:\Program Files\Microsoft Silverlight\npctrl.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin2.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin3.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin4.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin5.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin6.dll
    FF - plugin: C:\Program Files\QuickTime\Plugins\npqtplugin7.dll
    FF - plugin: C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll
    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
    FF - plugin: D:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
    FF - plugin: D:\Program Files\DivX\DivX Web Player\npdivx32.dll
    FF - plugin: D:\Program Files\Microsoft Silverlight\npctrl.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 asahci64;asahci64;C:\Windows\system32\DRIVERS\asahci64.sys --> C:\Windows\system32\DRIVERS\asahci64.sys [?]
    R0 iaStorA;iaStorA;C:\Windows\system32\drivers\iaStorA.sys --> C:\Windows\system32\drivers\iaStorA.sys [?]
    R0 iaStorF;iaStorF;C:\Windows\system32\drivers\iaStorF.sys --> C:\Windows\system32\drivers\iaStorF.sys [?]
    R0 NBVol;Nero Backup Volume Filter Driver;C:\Windows\system32\DRIVERS\NBVol.sys --> C:\Windows\system32\DRIVERS\NBVol.sys [?]
    R0 NBVolUp;Nero Backup Volume Upper Filter Driver;C:\Windows\system32\DRIVERS\NBVolUp.sys --> C:\Windows\system32\DRIVERS\NBVolUp.sys [?]
    R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
    R0 vidsflt67;Acronis Disk Storage Filter (67);C:\Windows\system32\DRIVERS\vsflt67.sys --> C:\Windows\system32\DRIVERS\vsflt67.sys [?]
    R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys --> C:\Windows\system32\DRIVERS\cmdguard.sys [?]
    R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys --> C:\Windows\system32\DRIVERS\cmdhlp.sys [?]
    R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.18\atkexComSvc.exe [2011-10-29 918448]
    R2 asHmComSvc;ASUS HM Com Service;C:\Program Files (x86)\ASUS\AAHM\1.00.16\aaHMSvc.exe [2011-8-9 947328]
    R2 DisplayLinkService;DisplayLinkManager;C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [2011-11-23 8448944]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe [2012-8-1 7168]
    R2 NIHardwareService;NIHardwareService;C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2010-2-26 5017600]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-8-3 1258856]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-8-30 382312]
    R3 appliandMP;appliandMP;C:\Windows\system32\DRIVERS\appliand.sys --> C:\Windows\system32\DRIVERS\appliand.sys [?]
    R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\system32\DRIVERS\asmthub3.sys --> C:\Windows\system32\DRIVERS\asmthub3.sys [?]
    R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\system32\DRIVERS\asmtxhci.sys --> C:\Windows\system32\DRIVERS\asmtxhci.sys [?]
    R3 DELTAII;Service for M-Audio Delta Driver (WDM);C:\Windows\system32\DRIVERS\MAudioDelta.sys --> C:\Windows\system32\DRIVERS\MAudioDelta.sys [?]
    R3 DKRtWrt;DKRtWrt;C:\Windows\system32\DRIVERS\DKRtWrt.sys --> C:\Windows\system32\DRIVERS\DKRtWrt.sys [?]
    R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;C:\Windows\system32\DRIVERS\e1c62x64.sys --> C:\Windows\system32\DRIVERS\e1c62x64.sys [?]
    R3 Lycosa;Lycosa Keyboard;C:\Windows\system32\drivers\Lycosa.sys --> C:\Windows\system32\drivers\Lycosa.sys [?]
    R3 MEIx64;Intel(R) Management Engine Interface ;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
    R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
    R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 appliand;Applian Network Service;C:\Windows\system32\DRIVERS\appliand.sys --> C:\Windows\system32\DRIVERS\appliand.sys [?]
    S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]
    S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-8-1 135584]
    S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-9-9 114144]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
    S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2012-09-24 17:03:36 -------- d-----w- C:\Users\Mike\AppData\Roaming\Malwarebytes
    2012-09-24 17:03:31 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-09-24 17:03:31 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-09-24 17:03:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-09-22 01:36:47 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{27B8EC83-CA3B-4D3C-8AB1-5571476DFFFC}\offreg.dll
    2012-09-21 07:44:00 388096 ----a-r- C:\Users\Mike\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2012-09-20 15:13:52 -------- d-----w- C:\Windows\6833245EDD86479A882A8360D62C8194.TMP
    2012-09-20 15:13:51 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard
    2012-09-14 10:56:19 -------- d-----w- C:\Windows\SysWow64\xlive
    2012-09-14 10:56:18 -------- d-----w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
    2012-09-14 10:38:08 -------- d-----w- C:\Program Files (x86)\AMD
    2012-09-14 10:38:06 -------- d-----w- C:\Users\Mike\AppData\Local\Downloaded Installations
    2012-09-13 19:36:35 -------- d-----w- C:\temp
    2012-09-13 18:09:43 -------- d-----w- C:\Users\Mike\AppData\Local\PokerStars
    2012-09-13 18:09:39 -------- d-----w- C:\Program Files (x86)\PokerStars
    2012-09-12 02:07:55 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys
    2012-09-12 02:07:55 41472 ----a-w- C:\Windows\System32\drivers\RNDISMP.sys
    2012-09-12 02:07:54 574464 ----a-w- C:\Windows\System32\d3d10level9.dll
    2012-09-12 02:07:54 490496 ----a-w- C:\Windows\SysWow64\d3d10level9.dll
    2012-09-12 02:07:53 376688 ----a-w- C:\Windows\System32\drivers\netio.sys
    2012-09-12 02:07:53 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2012-09-12 02:07:53 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2012-09-11 19:42:46 -------- d-----w- C:\Users\Mike\AppData\Roaming\Apowersoft
    2012-09-11 19:13:30 381440 ----a-w- C:\Windows\System32\mfds.dll.bak
    2012-09-11 19:12:50 -------- d-----w- C:\Users\Mike\AppData\Roaming\Shark007
    2012-09-11 19:12:50 -------- d-----w- C:\ProgramData\Shark007
    2012-09-11 19:12:49 580096 ----a-w- C:\Windows\System32\ac3filter.acm
    2012-09-11 19:12:49 4434432 ----a-w- C:\Windows\System32\x264vfw.dll
    2012-09-11 19:12:49 361472 ----a-w- C:\Windows\System32\aacacm.acm
    2012-09-11 19:12:49 206336 ----a-w- C:\Windows\System32\unrar.dll
    2012-09-11 19:12:49 180736 ----a-w- C:\Windows\System32\ac3acm.acm
    2012-09-11 19:12:49 148992 ----a-w- C:\Windows\System32\lagarith.dll
    2012-09-11 19:12:49 137216 ----a-w- C:\Windows\System32\mlc.dll
    2012-09-11 19:12:49 124909 ----a-w- C:\Windows\System32\pthreadGC2.dll
    2012-09-11 19:12:49 -------- d-----w- C:\Program Files\Shark007
    2012-09-11 19:12:19 296448 ----a-w- C:\Windows\SysWow64\mfds.dll.bak
    2012-09-11 19:11:37 -------- d-----w- C:\Users\Mike\AppData\Roaming\Win7codecs
    2012-09-11 19:11:36 -------- d-----w- C:\Program Files (x86)\Win7codecs
    2012-09-11 19:11:23 -------- d-----w- C:\ProgramData\Win7codecs
    2012-09-11 08:57:03 -------- d-----w- C:\Users\Mike\AppData\Roaming\Sony Creative Software
    2012-09-09 17:02:27 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
    2012-09-09 17:02:26 73696 ----a-w- C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll
    2012-09-01 12:32:55 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2012-08-30 09:40:14 429416 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
    2012-08-28 11:51:11 -------- d-----w- C:\Program Files\M-Audio
    2012-08-26 01:47:35 -------- d-----w- C:\Users\Mike\AppData\Local\Jaksta_Technologies_Pty_L
    2012-08-26 01:44:39 -------- d-----w- C:\Program Files\Applian Technologies
    .
    ==================== Find3M ====================
    .
    2012-09-14 16:16:57 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe
    2012-09-02 15:41:46 73416 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-09-02 15:41:46 696520 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2012-09-01 12:32:53 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
    2012-09-01 12:32:53 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2012-08-30 16:18:05 891240 ----a-w- C:\Windows\System32\nvvsvc.exe
    2012-08-30 16:18:05 63336 ----a-w- C:\Windows\System32\nvshext.dll
    2012-08-30 16:18:05 118120 ----a-w- C:\Windows\System32\nvmctray.dll
    2012-08-30 16:18:04 3487434 ----a-w- C:\Windows\System32\nvcoproc.bin
    2012-08-30 16:18:01 3266920 ----a-w- C:\Windows\System32\nvsvc64.dll
    2012-08-30 16:17:59 6198120 ----a-w- C:\Windows\System32\nvcpl.dll
    2012-08-30 13:53:45 48 ----a-w- C:\Windows\SysWow64\msvcsv60.dll
    2012-08-30 13:53:45 16 ----a-w- C:\Users\Mike\AppData\Roaming\msregsvv.dll
    2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll
    2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll
    2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
    2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
    2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll
    2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
    2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
    2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2012-08-17 13:48:47 338432 ----a-w- C:\Windows\SysWow64\REX Shared Library.dll
    2012-08-17 10:00:00 1416704 ----a-w- C:\Windows\System32\VSFilter.dll
    2012-08-17 00:30:34 282696 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
    2012-08-17 00:30:34 282696 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
    2012-08-12 04:59:30 1370624 ----a-w- C:\Windows\SysWow64\VSFilter.dll
    2012-08-12 01:43:02 282696 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
    2012-08-05 16:20:59 2892 ----a-w- C:\Windows\SysWow64\audcon.sys
    2012-08-05 15:31:53 720896 ----a-w- C:\Windows\iun6002.exe
    2012-08-05 15:16:34 833087 ----a-w- C:\Windows\PhaseTwo VST plug-in Uninstaller.exe
    2012-08-05 14:45:54 833106 ----a-w- C:\Windows\Replicant VST plug-in Uninstaller.exe
    2012-08-04 22:35:03 678746 ----a-w- C:\Windows\unins000.exe
    2012-08-04 18:51:08 30 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_C92E1371-3DF5-4322-9729-82CC0DD90ECA.dll
    2012-08-04 18:51:08 13 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_D9C6A609-15A1-4768-8E98-6FA00C2547CC.dll
    2012-08-04 18:51:08 13 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_72024697-2626-4a12-8347-7CAC1834AC3B.dll
    2012-08-04 18:51:06 31 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_FB9AECF7-F56E-7B2E-A862-9892AA545103.dll
    2012-08-04 18:51:06 31 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_FAB01109-C336-401f-BDE4-AB192674410E.dll
    2012-08-04 18:51:06 31 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_496F4C99-60AD-5b9e-AC1B-FA060E643C04.dll
    2012-08-04 18:51:05 31 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_F4F01109-C336-401f-BDE4-7C1926744104.dll
    2012-08-04 18:51:05 20 ----a-w- C:\Users\Mike\AppData\Roaming\iasna_82424970-0916-4145-974C-09EBC0BE67C0.dll
    2012-08-03 15:45:35 16896 ----a-w- C:\Windows\AsTaskSched.dll
    2012-08-03 15:26:24 1700352 ----a-w- C:\Windows\SysWow64\gdiplus.dll
    2012-08-03 15:26:24 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll
    2012-08-02 16:32:08 3006864 ----a-w- C:\Windows\System32\auto_reactivate.exe
    2012-08-02 16:26:55 146528 ----a-w- C:\Windows\System32\drivers\vsflt67.sys
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\SysWow64\dlumd9.dll
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\SysWow64\dlumd11.dll
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\SysWow64\dlumd10.dll
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\System32\dlumd9.dll
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\System32\dlumd11.dll
    2012-08-02 16:03:29 0 ----a-w- C:\Windows\System32\dlumd10.dll
    2012-08-02 15:23:38 142944 ----a-w- C:\Windows\System32\drivers\vsflt61.sys
    2012-07-23 11:31:38 4428800 ----a-w- C:\Windows\SysWow64\x264vfw.dll
    2012-07-21 14:54:12 122880 ----a-w- C:\Windows\SysWow64\ac3acm.acm
    2012-07-21 14:53:32 294912 ----a-w- C:\Windows\SysWow64\AACACM.acm
    2012-07-19 18:58:26 174229 ----a-w- C:\Windows\System32\avfilter-lav-3.dll
    2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys
    2012-07-05 17:24:50 1431552 ----a-w- C:\Windows\SysWow64\ReWire.dll
    2012-07-04 22:13:27 59392 ----a-w- C:\Windows\System32\browcli.dll
    2012-07-04 22:13:27 136704 ----a-w- C:\Windows\System32\browser.dll
    2012-07-04 21:14:34 41984 ----a-w- C:\Windows\SysWow64\browcli.dll
    2012-07-03 15:25:21 31080 ----a-w- C:\Windows\System32\nvhdap64.dll
    2012-07-03 15:25:16 189288 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys
    2012-07-03 07:37:57 1472360 ----a-w- C:\Windows\System32\nvhdagenco6420103.dll
    2012-07-02 22:28:06 112640 ----a-w- C:\Windows\SysWow64\ff_vfw.dll
    2012-07-02 19:31:18 127488 ----a-w- C:\Windows\System32\ff_vfw.dll
    .
    ============= FINISH: 18:26:30.96 ===============
     
  7. Broni

    Broni Malware Annihilator Posts: 47,172   +264

    Attach.txt?
     
  8. Jakal30

    Jakal30 TS Rookie Topic Starter

    Thread stated to paste so I did.
     
  9. Broni

    Broni Malware Annihilator Posts: 47,172   +264

    You pasted DDS.txt log.
    I still need Attach.txt log.
     
  10. Jakal30

    Jakal30 TS Rookie Topic Starter

    Ah yes I found it:

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 01/08/2012 16:05:29
    System Uptime: 22/09/2012 00:33:40 (68 hours ago)
    .
    Motherboard: ASUSTeK COMPUTER INC. | | P9X79
    Processor: Intel(R) Core(TM) i7-3930K CPU @ 3.20GHz | LGA2011 | 3201/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 223 GiB total, 151.856 GiB free.
    D: is FIXED (NTFS) - 902 GiB total, 481.188 GiB free.
    E: is CDROM ()
    F: is FIXED (NTFS) - 160 GiB total, 156.615 GiB free.
    G: is FIXED (NTFS) - 130 GiB total, 48.843 GiB free.
    H: is FIXED (NTFS) - 100 GiB total, 44.689 GiB free.
    I: is FIXED (NTFS) - 439 GiB total, 112.441 GiB free.
    J: is FIXED (NTFS) - 100 GiB total, 76.301 GiB free.
    K: is FIXED (NTFS) - 236 GiB total, 198.017 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {1860459d-4692-4825-b761-44a725991050}
    Description: Acronis Virtual Disk Bus
    Device ID: ROOT\ACRONISDEVICES\0000
    Manufacturer: Acronis, Inc.
    Name: Acronis Virtual Disk Bus
    PNP Device ID: ROOT\ACRONISDEVICES\0000
    Service: vididr
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    Ableton Live 8
    Acronis True Image Home 2012
    Adobe AIR
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Help Manager
    Adobe Widget Browser
    AdobeĀ® Content Viewer
    Analog Factory 2.5
    Apple Application Support
    Apple Software Update
    ARP2600 V2 2.0
    ASIO4ALL
    Asmedia ASM104x USB 3.0 Host Controller Driver
    Asmedia ASM106x SATA Host Controller Driver
    bl
    DivX Setup
    Dual-Core Optimizer
    Foxit Reader
    Futuremark SystemInfo
    HiJackThis
    Intel(R) Management Engine Components
    Intel(R) Rapid Storage Technology enterprise
    Java 7 Update 7
    Java Auto Updater
    JavaFX 2.1.1
    Malwarebytes Anti-Malware version 1.65.0.1400
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Games for Windows Marketplace
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft_VC80_CRT_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Microsoft_VC90_MFCLOC_x86
    Mozilla Firefox 15.0.1 (x86 en-US)
    Mozilla Maintenance Service
    Mozilla Thunderbird 15.0.1 (x86 en-US)
    MSVCRT Redists
    MSXML 4.0 SP2 (KB973688)
    nebula3 CM
    Noise Reduction Plug-in 2.0
    NVIDIA 3D Vision Controller Driver
    NVIDIA PhysX
    NVIDIA Stereoscopic 3D Driver
    OpenOffice.org 3.4.1
    PDF Settings CS6
    ph
    PowerISO
    PunkBuster Services
    QuickTime
    Razer Lycosa
    Realtek High Definition Audio Driver
    Renesas Electronics USB 3.0 Host Controller Driver
    Safari
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
    Sound Forge Pro 10.0
    Steam
    Tom Clancy's Ghost Recon Future Soldier
    Ubisoft Game Launcher
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft .NET Framework 4 Extended (KB2468871)
    Update for Microsoft .NET Framework 4 Extended (KB2533523)
    Update for Microsoft .NET Framework 4 Extended (KB2600217)
    VC80CRTRedist - 8.0.50727.6195
    VLC media player 2.0.3
    Vtune 7.21
    Vyzex MPK88-61
    Win7codecs
    Windows 7 Upgrade Advisor
    Windows Movie Maker 2.6
    xp-AntiSpy 3.98-2
    .
    ==== Event Viewer Messages From Past Week ========
    .
    22/09/2012 00:35:58, Error: Microsoft-Windows-WMPNSS-Service [14319] - Service 'WMPNetworkSvc' did not start because Group Policy is preventing Windows Media Player from sharing media with other devices.
    .
    ==== End Of File ===========================
     
  11. Broni

    Broni Malware Annihilator Posts: 47,172   +264

    I don't see anything malicious there.
     
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.