Quantcast
Channel: Tech Support Forum - Virus/Trojan/Spyware Help
Viewing all articles
Browse latest Browse all 2798

Need help on removing Virus.Win64.ZAccess.a (2)

$
0
0
Previously,my computer was infected by Virus.Win64.ZAccess.a located at the win32/services folder. It's causing my computer to become slower and slower as well as the web browsing speed,some pages are loading very slow.
DETAILS:
Window 7 home premium(Installed when I bought this laptop)
Windows\assemly\GAC_32 and Windows\assemly\GAC_64 were also detected as virus but they keep coming back after removal


DDS (Ver_2012-10-19.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.9.2
Run by User at 23:23:42 on 2012-10-26
Microsoft Windows 7 Home Premium 6.1.7601.1.936.86.1033.18.4007.1912 [GMT 8:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
SP: Kaspersky Anti-Virus *Enabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\FBAgent.exe
C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Intel\TurboBoost\TurboBoost.exe
C:\ExpressGateUtil\VAWinService.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\ExpressGateUtil\VAWinAgent.exe
C:\Program Files (x86)\Securemetric\SecureToken_ST3\ST3_certd.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Elantech\ETDCtrlHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\system32\wuauclt.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://isearch.claro-search.com/?affID=115131&tt=3212_3&babsrc=HP_iclro&mntrId=2676dff200000000000014dae95d16bc
mStart Page = hxxp://asus.msn.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office 2\Office14\GROOVEEX.DLL
BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office 2\Office14\URLREDIR.DLL
BHO: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
BHO: Freemake.YoutubeButton: {e9e8eb35-ff77-455d-b677-91e5e4fc06c2} -
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
uRun: [Facebook Update] "C:\Users\User\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
mRun: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe
mRun: [SecureToken_ST3] C:\Program Files (x86)\Securemetric\SecureToken_ST3\ST3_certd.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe"
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:28
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MI4ECA~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MI4ECA~1\Office14\ONBttnIE.dll/105
IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office 2\Office14\ONBttnIE.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office 2\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA} - hxxp://dl.asiaebroker.com/download/jre-6u2-windows-i586-p.exe
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{A2C5FCAE-E87C-4ACB-9934-730EEE670C92} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A} : NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\241485F52474 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\37B697F5C65627 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\459616D6F575966496 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\54C49647F577966696 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\B42534D223 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{E9FF9839-994C-4E17-B5BC-8885B814523A}\E6766616D696C697230457E6966696 : DHCPNameServer = 192.168.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\SysWOW64\KuGoo3DownXControl.ocx
Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\SysWOW64\KuGoo3DownXControl.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office 2\Office14\GROOVEEX.DLL
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp
x64-mStart Page = hxxp://asus.msn.com
x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3
x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
x64-Run: [ETDWare] C:\Program Files (x86)\Elantech\ETDCtrl.exe
x64-Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
x64-Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
x64-Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
x64-Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd
x64-Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - <orphaned>
x64-Handler: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - <orphaned>
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2012-10-12 30056]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-7-27 17024]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 28504]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2012-6-8 54104]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2012-8-13 178008]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-3 15416]
R2 BstHdDrv;BlueStacks Hypervisor;C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [2012-8-29 74616]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-4-17 13832]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\System32\drivers\btath_bus.sys [2011-3-14 28832]
R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2012-4-26 142632]
R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;C:\Windows\System32\drivers\FLxHCIc.sys [2011-4-9 177152]
R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;C:\Windows\System32\drivers\FLxHCIh.sys [2011-4-9 56320]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-5-24 317440]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2012-5-25 29016]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2012-7-25 29528]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-5-24 76912]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-10-17 25928]
R3 MEIx64;Intel(R) Management Engine Interface ;C:\Windows\System32\drivers\HECIx64.sys [2010-10-19 56344]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2010-5-3 44032]
S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\System32\drivers\btath_flt.sys [2011-3-14 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\System32\drivers\btath_a2dp.sys [2011-3-14 298656]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\drivers\btath_hcrp.sys [2011-3-14 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\System32\drivers\btath_lwflt.sys [2011-3-14 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\drivers\btath_rcp.sys [2011-3-14 154272]
S3 BtFilter;BtFilter;C:\Windows\System32\drivers\btfilter.sys [2011-3-14 280224]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-4-14 48488]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-11 56832]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-19 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-19 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
.
=============== Created Last 30 ================
.
2012-10-26 11:58:07 9291768 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{046924E3-E8A9-4A47-B64C-BC4F9D88895C}\mpengine.dll
2012-10-26 02:59:52 -------- d-----w- C:\Windows\SysWow64\Œãdwòàdw°v¶\videace
2012-10-25 17:47:15 -------- d-----w- C:\Windows\SysWow64\Œãêwòàêwt¿\videace
2012-10-25 17:35:14 -------- d-----w- C:\$RECYCLE.BIN
2012-10-25 17:34:58 -------- d-----w- C:\Windows\SysWow64\Œãiwòàiw°vÈ\videace
2012-10-25 17:11:32 98816 ----a-w- C:\Windows\sed.exe
2012-10-25 17:11:32 256000 ----a-w- C:\Windows\PEV.exe
2012-10-25 17:11:32 208896 ----a-w- C:\Windows\MBR.exe
2012-10-25 17:06:09 -------- d-----w- C:\Windows\SysWow64\Œãçwòàçw°v®\videace
2012-10-25 16:00:02 -------- d-----w- C:\Windows\SysWow64\ŒãÎwòàÎw°v©\videace
2012-10-25 15:24:39 -------- d-----w- C:\Windows\SysWow64\Œã•wòà•w°v«\videace
2012-10-25 14:29:14 -------- d-----w- C:\Windows\SysWow64\Œãàwòààw°v®\videace
2012-10-25 11:02:11 328704 ----a-w- C:\Windows\System32\services.exe
2012-10-25 11:02:11 328704 ----a-w- C:\Windows\System32\services(20).exe
2012-10-25 10:59:49 64856 ----a-w- C:\Windows\System32\klfphc.dll
2012-10-25 10:59:11 -------- d-----w- C:\Windows\ELAMBKUP
2012-10-25 10:59:06 -------- d-----w- C:\ProgramData\Kaspersky Lab
2012-10-25 10:59:06 -------- d-----w- C:\Program Files (x86)\Kaspersky Lab
2012-10-25 10:58:40 89432 ----a-w- C:\Windows\System32\drivers\klflt.sys
2012-10-25 10:32:40 -------- d-----w- C:\Program Files (x86)\ESET
2012-10-25 05:12:39 -------- d-----w- C:\Windows\SysWow64\Œãzwòàzw°v¦\videace
2012-10-24 15:24:15 -------- d-----w- C:\Windows\SysWow64\ŒãÍwòàÍw°v×\videace
2012-10-24 05:40:06 -------- d-----w- C:\Windows\SysWow64\ŒãÚwòàÚw°v’\videace
2012-10-23 05:43:23 -------- d-----w- C:\Windows\SysWow64\Œãûvòàûv°vŽ\videace
2012-10-23 01:20:23 -------- d-----w- C:\Windows\SysWow64\Œã»wòà»w°vä\videace
2012-10-22 14:31:48 -------- d-----w- C:\Windows\SysWow64\Œãïvòàïv°v»\videace
2012-10-22 07:21:02 -------- d-----w- C:\Windows\SysWow64\Œã‰wòà‰w°vÌ\videace
2012-10-20 16:54:06 -------- d-----w- C:\Windows\SysWow64\Œã-wòà-w°v³\videace
2012-10-20 08:40:28 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2012-10-19 02:12:07 -------- d-----w- C:\Windows\SysWow64\Œã¿wòà¿w°v˜\videace
2012-10-19 02:03:54 -------- d-----w- C:\Windows\SysWow64\Œã¢wòà¢w°vÐ\videace
2012-10-18 09:29:08 -------- d-----w- C:\Windows\SysWow64\Œãtwòàtw°v»\videace
2012-10-18 01:41:19 -------- d-----w- C:\Windows\SysWow64\ŒãYwòàYw°v¬\videace
2012-10-17 12:35:49 -------- d-----w- C:\Users\User\AppData\Roaming\Malwarebytes
2012-10-17 12:35:38 -------- d-----w- C:\ProgramData\Malwarebytes
2012-10-17 12:35:35 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-10-17 12:35:35 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-10-17 11:54:14 -------- d-----w- C:\Windows\SysWow64\Œãiwòàiw°vÎ\videace
2012-10-17 11:12:52 -------- d-----w- C:\Program Files\HitmanPro
2012-10-17 11:07:40 -------- d-----w- C:\Windows\SysWow64\ŒãÜwòàÜw°v¨\videace
2012-10-17 10:49:34 -------- d-----w- C:\Windows\SysWow64\Œã¯wòà¯w°v»\videace
2012-10-16 05:37:09 -------- d-----w- C:\Windows\SysWow64\Œãywòàyw°v¡\videace
2012-10-15 07:29:28 -------- d-----w- C:\Windows\SysWow64\Œãºwòàºw°v¤\videace
2012-10-13 15:19:24 -------- d-----w- C:\Windows\SysWow64\Œãkwòàkw°vÎ\videace
2012-10-13 15:03:09 -------- d-----w- C:\Windows\SysWow64\Œã3wòà3w°v¨\videace
2012-10-13 13:56:08 -------- d-----w- C:\Windows\ehome
2012-10-13 13:05:37 -------- d-----w- C:\ProgramData\HitmanPro
2012-10-13 12:50:18 -------- d-----w- C:\Windows\SysWow64\Œãgwòàgw°v“\videace
2012-10-13 12:37:50 -------- d-----w- C:\Windows\SysWow64\Œã%wòà%w°v§\videace
2012-10-13 11:54:20 -------- d-----w- C:\Users\User\AppData\Roaming\FLEXnet
2012-10-13 06:34:37 -------- d-----w- C:\Windows\SysWow64\Œãëvòàëv°v§\videace
2012-10-13 04:26:27 -------- d-----w- C:\Windows\SysWow64\Œã.wòà.w°vº\videace
2012-10-12 19:58:38 -------- d-----w- C:\Users\User\AppData\Roaming\PC Antivirus
2012-10-12 19:58:38 -------- d-----w- C:\Users\User\AppData\Roaming\AVPro
2012-10-12 19:58:35 72280 ----a-w- C:\Windows\System32\drivers\sbapifs.sys
2012-10-12 19:58:35 6393144 ----a-w- C:\Windows\uninstac.exe
2012-10-12 19:58:35 582992 ----a-w- C:\Windows\SysWow64\sbap.dll
2012-10-12 19:58:35 415056 ----a-w- C:\Windows\SysWow64\SpursDownload.dll
2012-10-12 19:58:35 308560 ----a-w- C:\Windows\SysWow64\vipre.dll
2012-10-12 19:58:35 1332560 ----a-w- C:\Windows\SysWow64\sbte.dll
2012-10-12 19:58:33 -------- d-----w- C:\ProgramData\AVC1Data
2012-10-12 19:50:48 -------- d-----w- C:\Users\User\AppData\Local\{99A1B28B-064C-4F84-9D70-A679CF0FDA48}
2012-10-12 18:40:59 -------- d-----w- C:\Users\User\AppData\Local\{F8A60789-13A1-4095-A782-9DFFCED5AEE6}
2012-10-12 11:19:35 -------- d-----w- C:\NVIDIA
2012-10-12 05:34:36 -------- d-----w- C:\Users\User\AppData\Local\{625EEBA6-534B-4082-AF3B-8B3E7DEC77EB}
2012-10-11 10:22:46 -------- d-----w- C:\ProgramData\PPLive
2012-10-11 08:47:48 235032 ----a-w- C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.0.53\pplugin2.dll
2012-10-11 08:47:48 128536 ----a-w- C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.0.53\npplugin2.dll
2012-10-11 08:47:48 128488 ----a-w- C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.0.53\PluginInstaller.exe
2012-10-11 08:47:48 -------- d-----w- C:\Program Files (x86)\Common Files\PPLiveNetwork
2012-10-11 05:50:45 -------- d-----w- C:\Users\User\AppData\Local\{36996D6C-A439-43F9-86F8-D0CB819EC04D}
2012-10-10 17:10:03 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
2012-10-10 16:30:40 -------- d--h--w- C:\Program Files (x86)\Common Files\EAInstaller
2012-10-10 16:30:21 2605920 ----a-w- C:\Windows\System32\D3DCompiler_40.dll
2012-10-10 16:30:19 5631312 ----a-w- C:\Windows\System32\D3DX9_40.dll
2012-10-10 16:29:59 409960 ----a-w- C:\Windows\System32\xactengine2_8.dll
2012-10-10 16:29:59 266088 ----a-w- C:\Windows\SysWow64\xactengine2_8.dll
2012-10-10 15:11:54 126944 ----a-w- C:\Windows\System32\drivers\scdemu.sys
2012-10-10 15:11:54 -------- d-----w- C:\Program Files (x86)\PowerISO
2012-10-10 06:48:35 -------- d-----w- C:\Users\User\AppData\Local\{4EFCBADF-E497-4B51-94CD-244986359EE8}
2012-10-09 05:26:07 -------- d-----w- C:\Users\User\AppData\Local\{8BB4C8E8-9BE5-4CC2-ACE0-996E4C5CDB6E}
2012-10-08 06:07:43 -------- d-----w- C:\Users\User\AppData\Local\{EC227BDE-8E84-45DF-BD52-B799E9CAB2B0}
2012-10-07 01:50:48 -------- d-----w- C:\Users\User\AppData\Local\{E07B05C4-5395-4AB0-9CCB-A63678006761}
2012-10-06 07:51:39 -------- d-----w- C:\Users\User\AppData\Local\{4F920C6E-F3B2-433D-83B0-CA353C132786}
2012-10-05 16:29:21 -------- d-----w- C:\Users\User\AppData\Local\{2EA9F676-F688-407E-ACB1-A6EA6FE6C409}
2012-10-05 03:17:10 -------- d-----w- C:\Users\User\AppData\Local\{F1490D6B-3307-4E36-A8FC-5735F497A481}
2012-10-04 06:24:34 -------- d-----w- C:\Users\User\AppData\Local\Facebook
2012-10-03 05:45:08 -------- d-----w- C:\Users\User\AppData\Local\{27051141-3CF8-4BF4-BACD-3087AD9392F5}
2012-10-02 15:16:11 -------- d-----w- C:\Users\User\AppData\Local\{8D13B602-08DB-4FC0-AD7F-DB75055CA9CA}
2012-10-02 12:29:08 -------- d-----w- C:\Users\User\AppData\Local\{B2BB14F0-917B-4160-AF72-5947A7404513}
2012-10-01 16:03:22 -------- d-----w- C:\Users\User\AppData\Local\{884F5864-E1E4-431F-9412-136492B3BF2E}
2012-10-01 00:41:18 -------- d-----w- C:\Users\User\AppData\Local\{D5CB2844-7867-426E-B14E-FE5BCB598F13}
2012-09-30 14:18:22 -------- d-----w- C:\Program Files\WinPcap
2012-09-30 14:17:34 -------- d-----w- C:\ProgramData\Freemake
2012-09-30 14:17:33 8013664 ----a-w- C:\Program Files (x86)\Internet Explorer\Microsoft.mshtml.dll
2012-09-30 14:17:20 -------- d-----w- C:\Program Files (x86)\Freemake
2012-09-30 06:56:25 -------- d-----w- C:\Users\User\AppData\Local\Seagate_Technology_LLC
2012-09-30 06:54:56 -------- d-----w- C:\Users\User\My Online Documents
2012-09-30 06:53:23 -------- d-----w- C:\Program Files (x86)\Seagate
2012-09-30 06:49:44 -------- d-----w- C:\ProgramData\Seagate
2012-09-30 06:49:43 -------- d-----w- C:\Users\User\AppData\Roaming\Seagate
2012-09-30 03:21:57 -------- d-----w- C:\Users\User\AppData\Local\{7B397140-F39C-484B-8F18-1C8EF78E618C}
2012-09-30 02:54:42 -------- d-----w- C:\Users\User\AppData\Local\{7C5E54A8-6739-4DAF-8EDF-A744B0F294E0}
2012-09-29 07:03:22 -------- d-----w- C:\Users\User\AppData\Local\{CC030929-65DF-4310-B70C-E26455A2A7C5}
2012-09-27 22:38:16 -------- d-----w- C:\Users\User\AppData\Local\{7B07080C-04F2-4A97-B05B-32A2513BA0D6}
2012-09-27 06:10:28 -------- d-----w- C:\Users\User\AppData\Local\{8177E4CD-B293-4D2B-97A6-BD0206F459FB}
.
==================== Find3M ====================
.
2012-10-26 06:58:00 45056 ----a-w- C:\Windows\System32\acovcnt.exe
2012-10-25 11:25:51 29528 ----a-w- C:\Windows\System32\drivers\klmouflt.sys
2012-10-25 11:25:51 29016 ----a-w- C:\Windows\System32\drivers\klkbdflt.sys
2012-10-12 19:58:35 160768 ----a-w- C:\Windows\SysWow64\unrar.dll
2012-10-09 13:24:40 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-09 13:24:40 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-10-02 19:51:15 3536817 ----a-w- C:\Windows\System32\nvcoproc.bin
2012-10-02 19:51:11 3293544 ----a-w- C:\Windows\System32\nvsvc64.dll
2012-10-02 19:51:04 6200680 ----a-w- C:\Windows\System32\nvcpl.dll
2012-10-02 19:50:57 891240 ----a-w- C:\Windows\System32\nvvsvc.exe
2012-10-02 19:50:57 866664 ----a-w- C:\Windows\System32\nv3dappshext.dll
2012-10-02 19:50:57 63336 ----a-w- C:\Windows\System32\nvshext.dll
2012-10-02 19:50:57 55144 ----a-w- C:\Windows\System32\nv3dappshextr.dll
2012-10-02 19:50:57 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll
2012-10-02 19:50:57 118120 ----a-w- C:\Windows\System32\nvmctray.dll
2012-09-04 16:35:34 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-09-04 16:35:34 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-08-21 05:01:20 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2012-08-21 05:01:20 125872 ----a-w- C:\Windows\System32\GEARAspi64.dll
2012-08-21 05:01:20 106928 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
2012-08-13 08:49:40 178008 ----a-w- C:\Windows\System32\drivers\kneps.sys
2012-08-07 12:19:11 249856 ------w- C:\Windows\Setup1.exe
2012-08-07 12:19:10 73216 ----a-w- C:\Windows\ST6UNST.EXE
2012-08-02 07:09:34 28504 ----a-w- C:\Windows\System32\drivers\klim6.sys
.
============= FINISH: 23:27:19.82 ===============

Attached Files
File Type: zip attach.zip (13.1 KB)

Viewing all articles
Browse latest Browse all 2798

Trending Articles