I received a phone call from a man claiming to work for Microsoft. He told me my computer was being hacked from people
from another country. He brought me to a box that showed errors in red and warning symbols in yellow with yesterday's date. He then had me download supremo software which allowed him to access my computer. He then showed me my ip address and other ip addresses right next to it that said established. And he said that was the hackers getting into my computer. Then I lost connection with him and I signed out of everything. I thought he was going to try to sell me some kind of virus program but he said no on the phone. I was outside and couldn't get back to my computer and he must have called me 50 times. No joke. I didn't answer. I wasn't going to buy anything. Then he called again maybe an hour later and I told him to call me at night and shut my phone off. And became very worried. Especially when today I was trying to play my game called "Evony" using opera and it wasn't working. I uninstalled opera. And deleted the supremo. And now I have contaced the pros ;-) You guys. I am very nervous that my system has indeed been hacked by this man ;-( Please help. I have done the steps and attached the logs. Thanks I do not have a boot cd or Windows Install cd for this computer.
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18450
Run by User at 21:03:05 on 2016-09-17
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8053.5631 [GMT -4:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: IObit Malware Fighter *Disabled/Outdated* {4D381C57-3C7A-6F22-07EB-639F49E836D4}
SP: Kaspersky Anti-Virus *Enabled/Updated* {3D579475-6DDE-A186-1569-44B9F9DE8725}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: IObit Malware Fighter *Enabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avpui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\User\AppData\Local\Microsoft\BingSvc\BingSvc.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe
C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFTips.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mStart Page = Google
mWinlogon: Userinit = userinit.exe,
BHO: True Key Helper: {0F4B8786-5502-4803-8EBC-F652A1153BB6} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
BHO: Kaspersky Protection: {2E38825B-8815-42CF-9126-C58BC28D4591} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Advanced SystemCare Surfing Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll
TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
TB: True Key: {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRun: [IObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart
uPolicies-Explorer: NoSimpleNetIDList = dword:1
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - <orphaned>
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{485967DD-11D1-470A-8F30-03041C948D3F} : DHCPNameServer = 192.168.254.254
TCP: Interfaces\{65F7A15D-77CF-4E0A-A913-9CD717566798} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{8C1621D8-C15F-4397-9481-159674F36310} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{8C1621D8-C15F-4397-9481-159674F36310}\144545332393 : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{9C169257-4C15-4092-8A2E-22693D94B6D4} : DHCPNameServer = 192.168.1.254
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skypec2c - <Clsid value has no data>
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
LSA: Notification Packages = scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = Google
x64-BHO: ExplorerWnd Helper: {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
x64-BHO: Kaspersky Protection: {2E38825B-8815-42CF-9126-C58BC28D4591} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\IEExt\ie_plugin.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_102\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_102\bin\jp2ssv.dll
x64-TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\IEExt\ie_plugin.dll
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - <orphaned>
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Handler: skypec2c - <Clsid value has no data>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
Hosts: 127.0.0.1 spywareinfo.comÂ*-Â*This website is for sale!Â*-Â*spywareinfo Resources and Information.
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0kh0o9kx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - Google
FF - prefs.js: keyword.URL -
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrlui.dll
FF - plugin: C:\Users\User\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\User\AppData\Roaming\Mozilla\plugins\npoctoshape.dll
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_22_0_0_192.dll
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_23_0_0_162.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: content.notify.ontimer - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.switch.threshold - 750000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
============= SERVICES / DRIVERS ===============
.
R0 cm_km;AO Kaspersky Lab Cryptographic Module x64 (56 bit);C:\Windows\System32\drivers\cm_km.sys [2016-6-10 238936]
R0 klbackupdisk;Kaspersky Lab klbackupdisk;C:\Windows\System32\drivers\klbackupdisk.sys [2016-6-7 63920]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-5-22 53488]
R1 GUBootStartup;GUBootStartup;C:\Windows\System32\drivers\GUBootStartup.sys [2015-2-11 20160]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [2015-4-15 26528]
R1 klbackupflt;Kaspersky Lab klbackupflt;C:\Windows\System32\drivers\klbackupflt.sys [2016-6-15 86352]
R1 klhk;Kaspersky Lab service driver;C:\Windows\System32\drivers\klhk.sys [2016-6-20 305496]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2016-6-20 50008]
R1 klpd;Kaspersky Lab format recognizer driver;C:\Windows\System32\drivers\klpd.sys [2016-5-31 45488]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2016-5-17 75696]
R1 Klwtp;KLwtp - WFP callout traffic inspector;C:\Windows\System32\drivers\klwtp.sys [2016-6-2 126360]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2016-6-14 194480]
R2 AVP17.0.0;Kaspersky Anti-Virus Service 17.0.0;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe [2016-6-28 241544]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-13 27136]
R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2015-4-15 1600288]
R2 kldisk;kldisk;C:\Windows\System32\drivers\kldisk.sys [2016-5-31 78216]
R2 KSDE1.0.0;Kaspersky Secure Connection Service 1.0.0;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [2016-6-28 241544]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2016-8-6 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2016-8-6 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2016-8-6 171928]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2015-4-15 70168]
R3 klflt;Kaspersky Lab Kernel DLL;C:\Windows\System32\drivers\klflt.sys [2016-9-17 189264]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2016-5-19 52144]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2015-6-7 41648]
R3 kltap;Kaspersky Security Data Escort Adapter;C:\Windows\System32\drivers\kltap.sys [2016-6-7 52152]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2016-7-17 33960]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-4-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-4-11 124088]
S2 LiveUpdateSvc;LiveUpdate;C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2015-4-15 3046688]
S2 sgbupt;SuperBoost Software Updater;C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [2016-8-4 2600256]
S3 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe [2015-3-28 89840]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2016-9-16 114688]
S3 IntelBCAsvc;Intel(R) Biometric and Context Agent Service;C:\Program Files\Intel\BCA\pabeSvc64.exe [2015-11-25 3020440]
S3 klvssbrigde64;klvssbrigde64;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\vssbridge64.exe [2016-6-28 77328]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2015-3-4 133816]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-5-22 19456]
S3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2016-5-12 34848]
S3 rtl8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8192u.sys [2010-4-13 1631264]
S3 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-7-25 324224]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-5-22 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2014-5-22 30208]
S3 WatAdminSvc;WatAdminSvc;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-5-22 1255736]
S4 IMFFilter;IMFFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\IMFFilter.sys [2016-5-12 22208]
S4 SCMNdisP;General NDIS Protocol Driver;C:\Windows\System32\drivers\SCMNdisP.sys [2014-11-26 25056]
.
=============== Created Last 30 ================
.
2016-09-18 01:00:50 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\offreg.3852.dll
2016-09-17 14:22:42 -------- dc----w- C:\ProgramData\Kaspersky Lab Setup Files
2016-09-17 08:49:05 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\offreg.2608.dll
2016-09-17 08:48:02 12221144 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2016-09-17 08:47:52 11847048 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\mpengine.dll
2016-09-17 08:14:11 110176 -c--a-w- C:\Windows\System32\klfphc.dll
2016-09-17 08:13:52 -------- dc----w- C:\Windows\ELAMBKUP
2016-09-17 08:13:48 -------- dc----w- C:\ProgramData\Kaspersky Lab
2016-09-17 08:13:48 -------- dc----w- C:\Program Files (x86)\Kaspersky Lab
2016-09-17 08:13:33 189264 -c--a-w- C:\Windows\System32\drivers\klflt.sys
2016-09-16 23:09:16 -------- dc----w- C:\Program Files\CCleaner
2016-09-16 21:23:59 66560 ----a-w- C:\Windows\System32\iesetup.dll
2016-09-16 21:16:21 5548264 ----a-w- C:\Windows\System32\ntoskrnl.exe
2016-09-16 21:15:59 666112 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2016-09-16 21:10:48 877056 ----a-w- C:\Windows\System32\oleaut32.dll
2016-09-16 21:10:48 581632 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2016-09-16 18:27:30 -------- dc----w- C:\ProgramData\SupremoRemoteDesktop
2016-08-25 17:13:44 327112 -c--a-w- C:\Program Files (x86)\Mozilla Firefox\tobedeleted\rep630A.tmp
2016-08-19 20:44:54 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2016-08-19 20:44:54 2048 ----a-w- C:\Windows\System32\tzres.dll
.
==================== Find3M ====================
.
2016-09-17 16:05:29 796352 -c--a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2016-09-17 16:05:29 142528 -c--a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2016-09-17 14:44:57 50008 -c--a-w- C:\Windows\System32\drivers\klim6.sys
2016-09-17 14:44:32 126360 -c--a-w- C:\Windows\System32\drivers\klwtp.sys
2016-09-17 14:40:10 305496 -c--a-w- C:\Windows\System32\drivers\klhk.sys
2016-09-17 01:28:28 192216 -c--a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2016-09-16 22:11:11 464896 ----a-w- C:\Windows\System32\drivers\srv.sys
2016-09-16 22:11:11 405504 ----a-w- C:\Windows\System32\drivers\srv2.sys
2016-09-16 22:11:11 168960 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2016-09-16 22:06:06 2055680 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2016-09-16 22:06:05 2921472 ----a-w- C:\Windows\System32\wininet.dll
2016-09-16 22:06:03 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2016-09-16 22:06:00 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2016-09-16 22:06:00 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2016-09-16 22:03:11 690688 ----a-w- C:\Windows\SysWow64\adtschema.dll
2016-09-16 22:02:58 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2016-09-16 22:02:58 706280 ----a-w- C:\Windows\System32\winload.efi
2016-09-16 22:02:58 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
2016-09-16 22:02:58 631176 ----a-w- C:\Windows\System32\winresume.efi
2016-09-16 22:02:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2016-09-16 22:02:58 159744 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2016-09-16 22:02:58 1314112 ----a-w- C:\Windows\SysWow64\ntdll.dll
2016-09-16 22:02:57 44032 ----a-w- C:\Windows\System32\csrsrv.dll
2016-09-16 22:02:57 291328 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2016-09-16 22:02:57 1732864 ----a-w- C:\Windows\System32\ntdll.dll
2016-09-16 22:02:57 129536 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2016-09-16 21:56:50 833024 ----a-w- C:\Windows\SysWow64\user32.dll
2016-09-16 21:56:50 3218432 ----a-w- C:\Windows\System32\win32k.sys
2016-09-16 21:56:50 1009152 ----a-w- C:\Windows\System32\user32.dll
2016-09-04 01:29:59 110144 -c--a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2016-08-03 02:36:19 2560 ----a-w- C:\Windows\apppatch\AcRes.dll
2016-08-03 02:35:49 970240 ----a-w- C:\Windows\System32\localspl.dll
2016-08-03 02:35:49 756736 ----a-w- C:\Windows\System32\win32spl.dll
2016-08-03 02:35:49 61952 ----a-w- C:\Windows\SysWow64\ntprint.exe
2016-08-03 02:35:49 61952 ----a-w- C:\Windows\System32\ntprint.exe
2016-08-03 02:35:49 497152 ----a-w- C:\Windows\SysWow64\win32spl.dll
2016-08-03 02:35:49 48640 ----a-w- C:\Windows\System32\wpnpinst.exe
2016-08-03 02:35:49 344576 ----a-w- C:\Windows\System32\ntprint.dll
2016-08-03 02:35:49 297472 ----a-w- C:\Windows\SysWow64\ntprint.dll
2016-08-03 02:35:49 22528 ----a-w- C:\Windows\System32\inetppui.dll
2016-08-03 02:35:49 166400 ----a-w- C:\Windows\System32\inetpp.dll
2016-07-27 19:25:34 504488 -c----w- C:\Windows\System32\MpSigStub.exe
2016-07-17 13:02:56 33960 -c--a-w- C:\Windows\System32\drivers\Smb_driver_Intel.sys
2016-06-23 00:00:29 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
2016-06-23 00:00:29 46080 ----a-w- C:\Windows\System32\atmlib.dll
2016-06-23 00:00:29 41472 ----a-w- C:\Windows\System32\lpk.dll
2016-06-23 00:00:29 382184 ----a-w- C:\Windows\System32\atmfd.dll
2016-06-23 00:00:29 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2016-06-23 00:00:29 308456 ----a-w- C:\Windows\SysWow64\atmfd.dll
2016-06-23 00:00:29 25600 ----a-w- C:\Windows\SysWow64\lpk.dll
2016-06-23 00:00:29 14336 ----a-w- C:\Windows\System32\dciman32.dll
2016-06-23 00:00:29 10240 ----a-w- C:\Windows\SysWow64\dciman32.dll
2016-06-23 00:00:29 100864 ----a-w- C:\Windows\System32\fontsub.dll
2016-06-23 00:00:04 483840 ----a-w- C:\Windows\System32\StructuredQuery.dll
2016-06-23 00:00:04 363520 ----a-w- C:\Windows\SysWow64\StructuredQuery.dll
2016-06-22 23:59:37 444928 ----a-w- C:\Windows\System32\winhttp.dll
2016-06-22 23:59:37 351744 ----a-w- C:\Windows\SysWow64\winhttp.dll
2016-06-22 23:59:37 327168 ----a-w- C:\Windows\System32\mswsock.dll
2016-06-22 23:59:37 296448 ----a-w- C:\Windows\System32\ws2_32.dll
2016-06-22 23:59:37 26624 ----a-w- C:\Windows\SysWow64\netbtugc.exe
2016-06-22 23:59:37 262144 ----a-w- C:\Windows\System32\drivers\netbt.sys
2016-06-22 23:59:37 25088 ----a-w- C:\Windows\System32\netbtugc.exe
2016-06-22 23:59:37 231424 ----a-w- C:\Windows\SysWow64\mswsock.dll
2016-06-22 23:59:37 206336 ----a-w- C:\Windows\SysWow64\ws2_32.dll
2016-06-22 23:58:38 405504 ----a-w- C:\Windows\System32\gdi32.dll
2016-06-22 23:58:38 312832 ----a-w- C:\Windows\SysWow64\gdi32.dll
2016-06-22 23:58:10 96256 ----a-w- C:\Windows\System32\gpapi.dll
2016-06-22 23:58:10 794624 ----a-w- C:\Windows\System32\gpsvc.dll
2016-06-22 23:58:09 79360 ----a-w- C:\Windows\SysWow64\gpapi.dll
2016-06-22 23:58:09 75776 ----a-w- C:\Windows\System32\FwRemoteSvr.dll
2016-06-22 23:58:09 70144 ----a-w- C:\Windows\SysWow64\winipsec.dll
2016-06-22 23:58:09 502272 ----a-w- C:\Windows\System32\IPSECSVC.DLL
2016-06-22 23:58:09 44032 ----a-w- C:\Windows\SysWow64\FwRemoteSvr.dll
2016-06-22 23:58:09 373760 ----a-w- C:\Windows\System32\polstore.dll
2016-06-22 23:58:09 274944 ----a-w- C:\Windows\SysWow64\polstore.dll
2016-06-22 23:58:09 105472 ----a-w- C:\Windows\System32\winipsec.dll
2016-06-22 23:57:24 459640 ----a-w- C:\Windows\System32\drivers\cng.sys
2016-06-22 23:57:22 297984 ----a-w- C:\Windows\System32\bcryptprimitives.dll
2016-06-22 23:57:22 249352 ----a-w- C:\Windows\SysWow64\bcryptprimitives.dll
.
============= FINISH: 21:03:42.38 ===============
from another country. He brought me to a box that showed errors in red and warning symbols in yellow with yesterday's date. He then had me download supremo software which allowed him to access my computer. He then showed me my ip address and other ip addresses right next to it that said established. And he said that was the hackers getting into my computer. Then I lost connection with him and I signed out of everything. I thought he was going to try to sell me some kind of virus program but he said no on the phone. I was outside and couldn't get back to my computer and he must have called me 50 times. No joke. I didn't answer. I wasn't going to buy anything. Then he called again maybe an hour later and I told him to call me at night and shut my phone off. And became very worried. Especially when today I was trying to play my game called "Evony" using opera and it wasn't working. I uninstalled opera. And deleted the supremo. And now I have contaced the pros ;-) You guys. I am very nervous that my system has indeed been hacked by this man ;-( Please help. I have done the steps and attached the logs. Thanks I do not have a boot cd or Windows Install cd for this computer.
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18450
Run by User at 21:03:05 on 2016-09-17
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8053.5631 [GMT -4:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {86367591-4BE4-AE08-2FD9-7FCB8259CD98}
AV: IObit Malware Fighter *Disabled/Outdated* {4D381C57-3C7A-6F22-07EB-639F49E836D4}
SP: Kaspersky Anti-Virus *Enabled/Updated* {3D579475-6DDE-A186-1569-44B9F9DE8725}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: IObit Malware Fighter *Enabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avpui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\IObit\Smart Defrag\SmartDefrag.exe
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\User\AppData\Local\Microsoft\BingSvc\BingSvc.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe
C:\Program Files (x86)\SuperBoost\Superb Game Boost\SuperbGameBoostMain.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFTips.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mStart Page = Google
mWinlogon: Userinit = userinit.exe,
BHO: True Key Helper: {0F4B8786-5502-4803-8EBC-F652A1153BB6} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
BHO: Kaspersky Protection: {2E38825B-8815-42CF-9126-C58BC28D4591} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Advanced SystemCare Surfing Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll
TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
TB: True Key: {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\IEExt\ie_plugin.dll
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRun: [IObit Malware Fighter] "C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe" /autostart
uPolicies-Explorer: NoSimpleNetIDList = dword:1
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - <orphaned>
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{485967DD-11D1-470A-8F30-03041C948D3F} : DHCPNameServer = 192.168.254.254
TCP: Interfaces\{65F7A15D-77CF-4E0A-A913-9CD717566798} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{8C1621D8-C15F-4397-9481-159674F36310} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{8C1621D8-C15F-4397-9481-159674F36310}\144545332393 : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{9C169257-4C15-4092-8A2E-22693D94B6D4} : DHCPNameServer = 192.168.1.254
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skypec2c - <Clsid value has no data>
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
LSA: Notification Packages = scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = Google
x64-BHO: ExplorerWnd Helper: {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
x64-BHO: Kaspersky Protection: {2E38825B-8815-42CF-9126-C58BC28D4591} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\IEExt\ie_plugin.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_102\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_102\bin\jp2ssv.dll
x64-TB: Kaspersky Protection Toolbar: {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\IEExt\ie_plugin.dll
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - <orphaned>
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Handler: skypec2c - <Clsid value has no data>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\53.0.2785.116\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
Hosts: 127.0.0.1 spywareinfo.comÂ*-Â*This website is for sale!Â*-Â*spywareinfo Resources and Information.
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0kh0o9kx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - Google
FF - prefs.js: keyword.URL -
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrlui.dll
FF - plugin: C:\Users\User\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\User\AppData\Roaming\Mozilla\plugins\npoctoshape.dll
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_22_0_0_192.dll
FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_23_0_0_162.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: content.notify.ontimer - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.switch.threshold - 750000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
============= SERVICES / DRIVERS ===============
.
R0 cm_km;AO Kaspersky Lab Cryptographic Module x64 (56 bit);C:\Windows\System32\drivers\cm_km.sys [2016-6-10 238936]
R0 klbackupdisk;Kaspersky Lab klbackupdisk;C:\Windows\System32\drivers\klbackupdisk.sys [2016-6-7 63920]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-5-22 53488]
R1 GUBootStartup;GUBootStartup;C:\Windows\System32\drivers\GUBootStartup.sys [2015-2-11 20160]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [2015-4-15 26528]
R1 klbackupflt;Kaspersky Lab klbackupflt;C:\Windows\System32\drivers\klbackupflt.sys [2016-6-15 86352]
R1 klhk;Kaspersky Lab service driver;C:\Windows\System32\drivers\klhk.sys [2016-6-20 305496]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2016-6-20 50008]
R1 klpd;Kaspersky Lab format recognizer driver;C:\Windows\System32\drivers\klpd.sys [2016-5-31 45488]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2016-5-17 75696]
R1 Klwtp;KLwtp - WFP callout traffic inspector;C:\Windows\System32\drivers\klwtp.sys [2016-6-2 126360]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2016-6-14 194480]
R2 AVP17.0.0;Kaspersky Anti-Virus Service 17.0.0;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe [2016-6-28 241544]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-13 27136]
R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2015-4-15 1600288]
R2 kldisk;kldisk;C:\Windows\System32\drivers\kldisk.sys [2016-5-31 78216]
R2 KSDE1.0.0;Kaspersky Secure Connection Service 1.0.0;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [2016-6-28 241544]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2016-8-6 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2016-8-6 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2016-8-6 171928]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2015-4-15 70168]
R3 klflt;Kaspersky Lab Kernel DLL;C:\Windows\System32\drivers\klflt.sys [2016-9-17 189264]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2016-5-19 52144]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2015-6-7 41648]
R3 kltap;Kaspersky Security Data Escort Adapter;C:\Windows\System32\drivers\kltap.sys [2016-6-7 52152]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2016-7-17 33960]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-4-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-4-11 124088]
S2 LiveUpdateSvc;LiveUpdate;C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2015-4-15 3046688]
S2 sgbupt;SuperBoost Software Updater;C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [2016-8-4 2600256]
S3 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe [2015-3-28 89840]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2016-9-16 114688]
S3 IntelBCAsvc;Intel(R) Biometric and Context Agent Service;C:\Program Files\Intel\BCA\pabeSvc64.exe [2015-11-25 3020440]
S3 klvssbrigde64;klvssbrigde64;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\vssbridge64.exe [2016-6-28 77328]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2015-3-4 133816]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-5-22 19456]
S3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2016-5-12 34848]
S3 rtl8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8192u.sys [2010-4-13 1631264]
S3 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-7-25 324224]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-5-22 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2014-5-22 30208]
S3 WatAdminSvc;WatAdminSvc;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-5-22 1255736]
S4 IMFFilter;IMFFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\IMFFilter.sys [2016-5-12 22208]
S4 SCMNdisP;General NDIS Protocol Driver;C:\Windows\System32\drivers\SCMNdisP.sys [2014-11-26 25056]
.
=============== Created Last 30 ================
.
2016-09-18 01:00:50 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\offreg.3852.dll
2016-09-17 14:22:42 -------- dc----w- C:\ProgramData\Kaspersky Lab Setup Files
2016-09-17 08:49:05 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\offreg.2608.dll
2016-09-17 08:48:02 12221144 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2016-09-17 08:47:52 11847048 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{874E10C1-4094-4D86-9986-B3C2614F0FD3}\mpengine.dll
2016-09-17 08:14:11 110176 -c--a-w- C:\Windows\System32\klfphc.dll
2016-09-17 08:13:52 -------- dc----w- C:\Windows\ELAMBKUP
2016-09-17 08:13:48 -------- dc----w- C:\ProgramData\Kaspersky Lab
2016-09-17 08:13:48 -------- dc----w- C:\Program Files (x86)\Kaspersky Lab
2016-09-17 08:13:33 189264 -c--a-w- C:\Windows\System32\drivers\klflt.sys
2016-09-16 23:09:16 -------- dc----w- C:\Program Files\CCleaner
2016-09-16 21:23:59 66560 ----a-w- C:\Windows\System32\iesetup.dll
2016-09-16 21:16:21 5548264 ----a-w- C:\Windows\System32\ntoskrnl.exe
2016-09-16 21:15:59 666112 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2016-09-16 21:10:48 877056 ----a-w- C:\Windows\System32\oleaut32.dll
2016-09-16 21:10:48 581632 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2016-09-16 18:27:30 -------- dc----w- C:\ProgramData\SupremoRemoteDesktop
2016-08-25 17:13:44 327112 -c--a-w- C:\Program Files (x86)\Mozilla Firefox\tobedeleted\rep630A.tmp
2016-08-19 20:44:54 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2016-08-19 20:44:54 2048 ----a-w- C:\Windows\System32\tzres.dll
.
==================== Find3M ====================
.
2016-09-17 16:05:29 796352 -c--a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2016-09-17 16:05:29 142528 -c--a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2016-09-17 14:44:57 50008 -c--a-w- C:\Windows\System32\drivers\klim6.sys
2016-09-17 14:44:32 126360 -c--a-w- C:\Windows\System32\drivers\klwtp.sys
2016-09-17 14:40:10 305496 -c--a-w- C:\Windows\System32\drivers\klhk.sys
2016-09-17 01:28:28 192216 -c--a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2016-09-16 22:11:11 464896 ----a-w- C:\Windows\System32\drivers\srv.sys
2016-09-16 22:11:11 405504 ----a-w- C:\Windows\System32\drivers\srv2.sys
2016-09-16 22:11:11 168960 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2016-09-16 22:06:06 2055680 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2016-09-16 22:06:05 2921472 ----a-w- C:\Windows\System32\wininet.dll
2016-09-16 22:06:03 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2016-09-16 22:06:00 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2016-09-16 22:06:00 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2016-09-16 22:03:11 690688 ----a-w- C:\Windows\SysWow64\adtschema.dll
2016-09-16 22:02:58 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2016-09-16 22:02:58 706280 ----a-w- C:\Windows\System32\winload.efi
2016-09-16 22:02:58 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
2016-09-16 22:02:58 631176 ----a-w- C:\Windows\System32\winresume.efi
2016-09-16 22:02:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2016-09-16 22:02:58 159744 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2016-09-16 22:02:58 1314112 ----a-w- C:\Windows\SysWow64\ntdll.dll
2016-09-16 22:02:57 44032 ----a-w- C:\Windows\System32\csrsrv.dll
2016-09-16 22:02:57 291328 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2016-09-16 22:02:57 1732864 ----a-w- C:\Windows\System32\ntdll.dll
2016-09-16 22:02:57 129536 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2016-09-16 21:56:50 833024 ----a-w- C:\Windows\SysWow64\user32.dll
2016-09-16 21:56:50 3218432 ----a-w- C:\Windows\System32\win32k.sys
2016-09-16 21:56:50 1009152 ----a-w- C:\Windows\System32\user32.dll
2016-09-04 01:29:59 110144 -c--a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2016-08-03 02:36:19 2560 ----a-w- C:\Windows\apppatch\AcRes.dll
2016-08-03 02:35:49 970240 ----a-w- C:\Windows\System32\localspl.dll
2016-08-03 02:35:49 756736 ----a-w- C:\Windows\System32\win32spl.dll
2016-08-03 02:35:49 61952 ----a-w- C:\Windows\SysWow64\ntprint.exe
2016-08-03 02:35:49 61952 ----a-w- C:\Windows\System32\ntprint.exe
2016-08-03 02:35:49 497152 ----a-w- C:\Windows\SysWow64\win32spl.dll
2016-08-03 02:35:49 48640 ----a-w- C:\Windows\System32\wpnpinst.exe
2016-08-03 02:35:49 344576 ----a-w- C:\Windows\System32\ntprint.dll
2016-08-03 02:35:49 297472 ----a-w- C:\Windows\SysWow64\ntprint.dll
2016-08-03 02:35:49 22528 ----a-w- C:\Windows\System32\inetppui.dll
2016-08-03 02:35:49 166400 ----a-w- C:\Windows\System32\inetpp.dll
2016-07-27 19:25:34 504488 -c----w- C:\Windows\System32\MpSigStub.exe
2016-07-17 13:02:56 33960 -c--a-w- C:\Windows\System32\drivers\Smb_driver_Intel.sys
2016-06-23 00:00:29 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
2016-06-23 00:00:29 46080 ----a-w- C:\Windows\System32\atmlib.dll
2016-06-23 00:00:29 41472 ----a-w- C:\Windows\System32\lpk.dll
2016-06-23 00:00:29 382184 ----a-w- C:\Windows\System32\atmfd.dll
2016-06-23 00:00:29 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2016-06-23 00:00:29 308456 ----a-w- C:\Windows\SysWow64\atmfd.dll
2016-06-23 00:00:29 25600 ----a-w- C:\Windows\SysWow64\lpk.dll
2016-06-23 00:00:29 14336 ----a-w- C:\Windows\System32\dciman32.dll
2016-06-23 00:00:29 10240 ----a-w- C:\Windows\SysWow64\dciman32.dll
2016-06-23 00:00:29 100864 ----a-w- C:\Windows\System32\fontsub.dll
2016-06-23 00:00:04 483840 ----a-w- C:\Windows\System32\StructuredQuery.dll
2016-06-23 00:00:04 363520 ----a-w- C:\Windows\SysWow64\StructuredQuery.dll
2016-06-22 23:59:37 444928 ----a-w- C:\Windows\System32\winhttp.dll
2016-06-22 23:59:37 351744 ----a-w- C:\Windows\SysWow64\winhttp.dll
2016-06-22 23:59:37 327168 ----a-w- C:\Windows\System32\mswsock.dll
2016-06-22 23:59:37 296448 ----a-w- C:\Windows\System32\ws2_32.dll
2016-06-22 23:59:37 26624 ----a-w- C:\Windows\SysWow64\netbtugc.exe
2016-06-22 23:59:37 262144 ----a-w- C:\Windows\System32\drivers\netbt.sys
2016-06-22 23:59:37 25088 ----a-w- C:\Windows\System32\netbtugc.exe
2016-06-22 23:59:37 231424 ----a-w- C:\Windows\SysWow64\mswsock.dll
2016-06-22 23:59:37 206336 ----a-w- C:\Windows\SysWow64\ws2_32.dll
2016-06-22 23:58:38 405504 ----a-w- C:\Windows\System32\gdi32.dll
2016-06-22 23:58:38 312832 ----a-w- C:\Windows\SysWow64\gdi32.dll
2016-06-22 23:58:10 96256 ----a-w- C:\Windows\System32\gpapi.dll
2016-06-22 23:58:10 794624 ----a-w- C:\Windows\System32\gpsvc.dll
2016-06-22 23:58:09 79360 ----a-w- C:\Windows\SysWow64\gpapi.dll
2016-06-22 23:58:09 75776 ----a-w- C:\Windows\System32\FwRemoteSvr.dll
2016-06-22 23:58:09 70144 ----a-w- C:\Windows\SysWow64\winipsec.dll
2016-06-22 23:58:09 502272 ----a-w- C:\Windows\System32\IPSECSVC.DLL
2016-06-22 23:58:09 44032 ----a-w- C:\Windows\SysWow64\FwRemoteSvr.dll
2016-06-22 23:58:09 373760 ----a-w- C:\Windows\System32\polstore.dll
2016-06-22 23:58:09 274944 ----a-w- C:\Windows\SysWow64\polstore.dll
2016-06-22 23:58:09 105472 ----a-w- C:\Windows\System32\winipsec.dll
2016-06-22 23:57:24 459640 ----a-w- C:\Windows\System32\drivers\cng.sys
2016-06-22 23:57:22 297984 ----a-w- C:\Windows\System32\bcryptprimitives.dll
2016-06-22 23:57:22 249352 ----a-w- C:\Windows\SysWow64\bcryptprimitives.dll
.
============= FINISH: 21:03:42.38 ===============