[ti]SOLVED[/ti]Unknown infection adding *32 to many processes

nhosier
New Helpee

Posts: 12

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 7, 2017 13:36:14 GMT -8 via mobile

Post by nhosier on Aug 7, 2017 13:36:14 GMT -8

Hello. I'm running a system with Win 7 64 bit and I've recently started experiencing issues. This past week, whenever I'd open a Firefox session, the page would stay at loading Firefox perpetually, and eat most of my system resources. When I'd use task manager to close Firefox, I'd notice that there were two sessions running, both with *32 suffixes. The one using lower memory could be closed and the Firefox window would close, but the other process would give me an access is denied message when I'd try to close. After reading some forums, I was led to believe that some Firefox update was the issue. Since then, however, I've noticed that there are multiple processes with the *32 suffix and about a dozen svchost.exe processes at any given time. My windows defender has been shut off, and my windows security center keeps telling me that it's service has stopped. I restarted my computer to try to start in safe mode, and my screen is currently stuck at a failure configuring Windows updates reverting changes. I appreciate any help I can get, please let me know if you need any further information.

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 8, 2017 0:09:25 GMT -8

Post by dbrisen on Aug 8, 2017 0:09:25 GMT -8

Hmm .... This does sound strange. It could be a corrupt user profile, bad service configuration or disk error problems. Let's check for the services first.

Please download Farbar Service Scanner to your desktop and double click on the file to run it.

[/b]
Windows Firewall
System Restore
Security Center
Windows Update
Windows Defender
Other Services
[/ul]

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.
[/ul]

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

nhosier New Helpee Posts: 12	[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 8, 2017 2:35:26 GMT -8 via mobile Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by nhosier on Aug 8, 2017 2:35:26 GMT -8 As of this morning when I left for work, my PC is still stuck at the "Windows update failure reverting changes" screen. Is there some way to get past that to my desktop?

dbrisen Malware Removalists Posts: 3,688	[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 8, 2017 6:14:02 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Aug 8, 2017 6:14:02 GMT -8 Do you have a Win7 install CD / DVD ? Do you have access to another computer to download files to transfer to your afflicted system?
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

nhosier New Helpee Posts: 12	[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 8, 2017 12:20:38 GMT -8 via mobile Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by nhosier on Aug 8, 2017 12:20:38 GMT -8 I don't have the install CD anymore, it was an OEM version when I built the system and I've since misplaced the OS CD. I do have access to another computer though.

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 8, 2017 21:36:52 GMT -8

Post by dbrisen on Aug 8, 2017 21:36:52 GMT -8

Download the following three programs to your desktop of a functioning system:

1. Rufus
2. Windows 7 64bit RC - link sent to you via PM on this forum
3. Farbar Recovery Scan Tool x64

Insert the USB stick Then run Rufus

Select the ISO file on the desktop via the ISO icon.

Press Start Burn

Then copy FRST to the same USB

Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

Windows 7 and Vista screenshots

When you reboot you will see these commands:
Click repair my computer

Select your operating system

Select Command prompt

At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe or e:\frst.exe dependant on system
and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

nhosier
New Helpee

Posts: 12

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 9, 2017 15:32:06 GMT -8

Post by nhosier on Aug 9, 2017 15:32:06 GMT -8

The results of the scan are as follows:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09-08-2017
Ran by SYSTEM on MININT-FUU6935 (09-08-2017 19:23:35)
Running from f:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery
Default: ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4888264 2016-02-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\RunOnce: [CleanUp RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzInstallerDeletion.vbs [1446 2014-05-18] ()
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
BootExecute: autocheck autochk * SmartDefragBootTime.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] ()
S2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3705536 2017-07-03] (Microsoft Corporation)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [249104 2016-07-13] (EasyAntiCheat Ltd)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
S2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [69964448 2015-04-03] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441512 2015-04-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 rzdaendpt; C:\Windows\System32\DRIVERS\rzdaendpt.sys [43720 2015-08-13] (Razer Inc)
S3 rzp1endpt; C:\Windows\System32\DRIVERS\rzp1endpt.sys [50904 2015-08-13] (Razer Inc)
S3 rzvkeyboard; C:\Windows\System32\DRIVERS\rzvkeyboard.sys [31912 2014-09-04] (Razer Inc)
S3 rzvmouse; C:\Windows\System32\DRIVERS\rzvmouse.sys [31912 2014-09-04] (Razer Inc)
S3 S3XXx64; C:\Windows\System32\DRIVERS\S3XXx64.sys [70016 2012-07-31] (Identive)
S0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
S3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [141384 2010-11-10] (MCCI Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-09 19:23 - 2017-08-09 19:23 - 000000000 ____D C:\FRST
2017-08-06 08:15 - 2017-08-06 17:00 - 000013738 _____ C:\Users\Nate\Desktop\Eve Market Tool Basic.xlsx
2017-07-31 16:10 - 2017-07-31 16:11 - 000000000 ____D C:\Users\Nate\Desktop\Joy's Stuff
2017-07-31 14:46 - 2017-07-31 14:46 - 000001146 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-07-31 14:44 - 2017-07-31 14:44 - 000266192 _____ (Mozilla) C:\Users\Nate\Downloads\Firefox Setup Stub 54.0.1.exe
2017-07-31 14:41 - 2017-07-31 14:42 - 000000000 ____D C:\Windows\LastGood.Tmp
2017-07-31 13:07 - 2017-07-31 13:07 - 000000000 ____D C:\Windows\CheckSur
2017-07-23 15:20 - 2017-07-31 16:10 - 000001009 _____ C:\Users\Public\Desktop\CPUID HWMonitor.lnk
2017-07-23 15:20 - 2017-07-23 15:20 - 000000000 ____D C:\Program Files\CPUID
2017-07-23 15:07 - 2017-07-23 15:07 - 000116744 _____ C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT
2017-07-23 15:07 - 2017-07-23 15:07 - 000116744 _____ C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT
2017-07-21 02:42 - 2017-07-21 02:42 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2017-07-18 12:55 - 2017-07-18 12:55 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\Unity
2017-07-18 12:47 - 2017-07-18 12:47 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\SKS
2017-07-14 12:49 - 2017-07-14 12:49 - 000000950 _____ C:\Users\Public\Desktop\LOOT.lnk
2017-07-11 14:54 - 2017-05-03 07:34 - 000094952 _____ (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
2017-07-11 14:54 - 2017-05-03 07:29 - 001206272 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 001555968 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000620544 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000535552 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000325632 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000311296 _____ (Microsoft Corporation) C:\Windows\System32\centel.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000217088 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2017-07-11 14:54 - 2017-05-03 05:05 - 000127488 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll
2017-07-11 14:54 - 2017-03-22 18:06 - 001691136 _____ (Microsoft Corporation) C:\Windows\System32\aitstatic.exe
2017-07-11 14:52 - 2017-06-29 20:15 - 000394448 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2017-07-11 14:52 - 2017-06-29 19:32 - 000346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 002319872 _____ (Microsoft Corporation) C:\Windows\System32\tquery.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 002222080 _____ (Microsoft Corporation) C:\Windows\System32\mssrch.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 002058240 _____ (Microsoft Corporation) C:\Windows\System32\Query.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000778240 _____ (Microsoft Corporation) C:\Windows\System32\mssvp.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000491520 _____ (Microsoft Corporation) C:\Windows\System32\mssph.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000288256 _____ (Microsoft Corporation) C:\Windows\System32\mssphtb.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000115200 _____ (Microsoft Corporation) C:\Windows\System32\mssitlb.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000099840 _____ (Microsoft Corporation) C:\Windows\System32\mssprxy.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000075264 _____ (Microsoft Corporation) C:\Windows\System32\msscntrs.dll
2017-07-11 14:52 - 2017-06-29 18:57 - 000014336 _____ (Microsoft Corporation) C:\Windows\System32\msshooks.dll
2017-07-11 14:52 - 2017-06-29 18:40 - 000591872 _____ (Microsoft Corporation) C:\Windows\System32\SearchIndexer.exe
2017-07-11 14:52 - 2017-06-29 18:40 - 000249856 _____ (Microsoft Corporation) C:\Windows\System32\SearchProtocolHost.exe
2017-07-11 14:52 - 2017-06-29 18:39 - 001549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-07-11 14:52 - 2017-06-29 18:39 - 000113664 _____ (Microsoft Corporation) C:\Windows\System32\SearchFilterHost.exe
2017-07-11 14:52 - 2017-06-29 18:38 - 001400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-07-11 14:52 - 2017-06-29 18:38 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-07-11 14:52 - 2017-06-29 18:27 - 000427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-07-11 14:52 - 2017-06-29 18:27 - 000164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-07-11 14:52 - 2017-06-29 18:26 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-07-11 14:52 - 2017-06-29 18:26 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-07-11 14:52 - 2017-06-28 22:27 - 025734656 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2017-07-11 14:52 - 2017-06-28 22:19 - 002724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2017-07-11 14:52 - 2017-06-28 22:18 - 000004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2017-07-11 14:52 - 2017-06-28 22:04 - 000066560 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2017-07-11 14:52 - 2017-06-28 22:03 - 000417792 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2017-07-11 14:52 - 2017-06-28 22:03 - 000048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2017-07-11 14:52 - 2017-06-28 22:02 - 002899456 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2017-07-11 14:52 - 2017-06-28 22:02 - 000576512 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2017-07-11 14:52 - 2017-06-28 22:02 - 000088064 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2017-07-11 14:52 - 2017-06-28 21:55 - 000054784 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2017-07-11 14:52 - 2017-06-28 21:54 - 000034304 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2017-07-11 14:52 - 2017-06-28 21:51 - 000615936 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2017-07-11 14:52 - 2017-06-28 21:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2017-07-11 14:52 - 2017-06-28 21:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2017-07-11 14:52 - 2017-06-28 21:50 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2017-07-11 14:52 - 2017-06-28 21:50 - 000116224 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2017-07-11 14:52 - 2017-06-28 21:44 - 005975552 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2017-07-11 14:52 - 2017-06-28 21:43 - 000968704 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2017-07-11 14:52 - 2017-06-28 21:39 - 000489984 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2017-07-11 14:52 - 2017-06-28 21:35 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-07-11 14:52 - 2017-06-28 21:31 - 000087552 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2017-07-11 14:52 - 2017-06-28 21:31 - 000077824 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2017-07-11 14:52 - 2017-06-28 21:30 - 000107520 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2017-07-11 14:52 - 2017-06-28 21:27 - 000199680 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2017-07-11 14:52 - 2017-06-28 21:26 - 000092160 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2017-07-11 14:52 - 2017-06-28 21:23 - 020270592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-07-11 14:52 - 2017-06-28 21:23 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-07-11 14:52 - 2017-06-28 21:23 - 000315392 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2017-07-11 14:52 - 2017-06-28 21:23 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-07-11 14:52 - 2017-06-28 21:23 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-07-11 14:52 - 2017-06-28 21:22 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-07-11 14:52 - 2017-06-28 21:22 - 000152064 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2017-07-11 14:52 - 2017-06-28 21:22 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-07-11 14:52 - 2017-06-28 21:19 - 002290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-07-11 14:52 - 2017-06-28 21:17 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-07-11 14:52 - 2017-06-28 21:16 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-07-11 14:52 - 2017-06-28 21:14 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-07-11 14:52 - 2017-06-28 21:13 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-07-11 14:52 - 2017-06-28 21:13 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-07-11 14:52 - 2017-06-28 21:13 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-07-11 14:52 - 2017-06-28 21:11 - 000262144 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2017-07-11 14:52 - 2017-06-28 21:09 - 000806912 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2017-07-11 14:52 - 2017-06-28 21:09 - 000725504 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2017-07-11 14:52 - 2017-06-28 21:08 - 001359360 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2017-07-11 14:52 - 2017-06-28 21:07 - 002132992 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2017-07-11 14:52 - 2017-06-28 21:05 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-07-11 14:52 - 2017-06-28 21:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-07-11 14:52 - 2017-06-28 21:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-07-11 14:52 - 2017-06-28 21:00 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-07-11 14:52 - 2017-06-28 20:58 - 015253504 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2017-07-11 14:52 - 2017-06-28 20:58 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-07-11 14:52 - 2017-06-28 20:56 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-07-11 14:52 - 2017-06-28 20:56 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-07-11 14:52 - 2017-06-28 20:54 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-07-11 14:52 - 2017-06-28 20:53 - 003240960 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2017-07-11 14:52 - 2017-06-28 20:52 - 004549632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-07-11 14:52 - 2017-06-28 20:48 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-07-11 14:52 - 2017-06-28 20:47 - 000693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-07-11 14:52 - 2017-06-28 20:46 - 002057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-07-11 14:52 - 2017-06-28 20:46 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-07-11 14:52 - 2017-06-28 20:43 - 013663744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-07-11 14:52 - 2017-06-28 20:41 - 001545728 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2017-07-11 14:52 - 2017-06-28 20:29 - 000800768 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2017-07-11 14:52 - 2017-06-28 20:28 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-07-11 14:52 - 2017-06-28 20:24 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-07-11 14:52 - 2017-06-28 20:23 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-07-11 14:52 - 2017-06-22 06:58 - 003223040 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2017-07-11 14:52 - 2017-06-15 12:23 - 000753664 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2017-07-11 14:52 - 2017-06-12 14:54 - 000370920 _____ (Microsoft Corporation) C:\Windows\System32\clfs.sys
2017-07-11 14:52 - 2017-06-12 14:54 - 000154856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2017-07-11 14:52 - 2017-06-12 14:54 - 000095464 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2017-07-11 14:52 - 2017-06-12 14:49 - 001460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 001363456 _____ (Microsoft Corporation) C:\Windows\System32\wdc.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 001212928 _____ (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000731648 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000690688 _____ (Microsoft Corporation) C:\Windows\System32\adtschema.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000594432 _____ (Microsoft Corporation) C:\Windows\System32\wvc.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000475136 _____ (Microsoft Corporation) C:\Windows\System32\sysmon.ocx
2017-07-11 14:52 - 2017-06-12 14:49 - 000463872 _____ (Microsoft Corporation) C:\Windows\System32\certcli.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000345600 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000316928 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000312320 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000210432 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000190464 _____ (Microsoft Corporation) C:\Windows\System32\rpchttp.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000146432 _____ (Microsoft Corporation) C:\Windows\System32\msaudite.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000123904 _____ (Microsoft Corporation) C:\Windows\System32\bcrypt.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000060416 _____ (Microsoft Corporation) C:\Windows\System32\msobjs.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000058880 _____ (Microsoft Corporation) C:\Windows\System32\pdhui.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000043520 _____ (Microsoft Corporation) C:\Windows\System32\cryptbase.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2017-07-11 14:52 - 2017-06-12 14:49 - 000022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 001227264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2017-07-11 14:52 - 2017-06-12 14:29 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-07-11 14:52 - 2017-06-12 14:29 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-07-11 14:52 - 2017-06-12 14:28 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-07-11 14:52 - 2017-06-12 14:19 - 000064000 _____ (Microsoft Corporation) C:\Windows\System32\auditpol.exe
2017-07-11 14:52 - 2017-06-12 14:14 - 000379392 _____ (Microsoft Corporation) C:\Windows\System32\msinfo32.exe
2017-07-11 14:52 - 2017-06-12 14:14 - 000172544 _____ (Microsoft Corporation) C:\Windows\System32\perfmon.exe
2017-07-11 14:52 - 2017-06-12 14:14 - 000103936 _____ (Microsoft Corporation) C:\Windows\System32\resmon.exe
2017-07-11 14:52 - 2017-06-12 14:12 - 000291328 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
2017-07-11 14:52 - 2017-06-12 14:12 - 000159744 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
2017-07-11 14:52 - 2017-06-12 14:12 - 000129536 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
2017-07-11 14:52 - 2017-06-12 14:11 - 000030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2017-07-11 14:52 - 2017-06-12 14:09 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-07-11 14:52 - 2017-06-12 14:06 - 000303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2017-07-11 14:52 - 2017-06-12 14:06 - 000157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2017-07-11 14:52 - 2017-06-12 14:06 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resmon.exe
2017-07-11 14:52 - 2017-06-12 14:05 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-07-11 14:52 - 2017-06-10 07:59 - 000313856 _____ (Microsoft Corporation) C:\Windows\System32\Wldap32.dll
2017-07-11 14:52 - 2017-06-10 07:39 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-07-11 14:52 - 2017-06-09 07:33 - 001680616 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2017-07-11 14:52 - 2017-06-06 07:30 - 001867264 _____ (Microsoft Corporation) C:\Windows\System32\ExplorerFrame.dll
2017-07-11 14:52 - 2017-06-06 07:12 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-07-11 14:52 - 2017-05-29 20:56 - 001895656 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2017-07-11 14:52 - 2017-05-29 20:56 - 000377576 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2017-07-11 14:52 - 2017-05-29 20:56 - 000287976 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2017-07-11 14:52 - 2017-05-20 20:24 - 000002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2017-07-11 14:52 - 2017-05-20 20:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-07-11 14:52 - 2017-05-16 07:35 - 000986856 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2017-07-11 14:52 - 2017-05-16 07:35 - 000265448 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2017-07-11 14:52 - 2017-05-16 07:30 - 000144384 _____ (Microsoft Corporation) C:\Windows\System32\cdd.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-09 13:05 - 2009-07-13 20:45 - 000029120 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-08-09 13:05 - 2009-07-13 20:45 - 000029120 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-08-09 13:02 - 2009-07-13 21:13 - 000006894 _____ C:\Windows\System32\PerfStringBackup.INI
2017-08-09 12:54 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-08-07 14:05 - 2016-07-13 15:23 - 000672648 _____ C:\Windows\ntbtlog.txt
2017-08-07 13:21 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf
2017-08-07 12:57 - 2012-04-13 11:33 - 000000000 ____D C:\Program Files (x86)\Steam
2017-08-07 12:50 - 2009-07-13 21:08 - 000032570 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-08-06 07:57 - 2016-11-19 07:21 - 000000000 ____D C:\Users\Nate\AppData\LocalLow\Mozilla
2017-08-03 18:11 - 2015-07-15 23:50 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-08-01 13:05 - 2017-04-24 08:03 - 000000000 ____D C:\Users\Nate\Documents\My Scans
2017-08-01 13:02 - 2013-09-14 09:48 - 000000000 ____D C:\Users\Nate\AppData\Local\CrashDumps
2017-07-31 16:10 - 2014-06-29 09:38 - 000000969 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2017-07-31 14:52 - 2017-05-13 08:31 - 000000000 ____D C:\ProgramData\VCE Exam Simulator
2017-07-31 14:52 - 2012-09-11 12:06 - 000000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-07-31 14:46 - 2016-11-19 00:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-07-31 14:46 - 2014-02-28 03:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-07-31 14:43 - 2012-04-12 17:40 - 000000000 ____D C:\Program Files (x86)\Razer
2017-07-31 14:43 - 2012-04-11 19:12 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-07-31 14:38 - 2014-06-28 18:05 - 000000000 ____D C:\Users\Nate\AppData\Local\Razer
2017-07-31 14:38 - 2014-06-28 17:40 - 000000000 ____D C:\ProgramData\Razer
2017-07-31 14:31 - 2013-05-31 10:55 - 000000000 ____D C:\Program Files (x86)\Mumble
2017-07-31 14:28 - 2016-09-05 08:55 - 000000000 ____D C:\Program Files (x86)\EVEMon
2017-07-31 14:15 - 2014-06-29 09:51 - 000000000 ____D C:\Games
2017-07-30 18:08 - 2015-09-26 06:42 - 000000000 ____D C:\Users\Nate\AppData\Roaming\uTorrent
2017-07-23 13:39 - 2016-02-14 17:38 - 000000000 ____D C:\ProgramData\Package Cache
2017-07-23 13:33 - 2015-03-14 06:49 - 000000404 _____ C:\Windows\Tasks\DriverEasy Scheduled Scan.job
2017-07-22 09:41 - 2016-03-08 14:08 - 000000000 ____D C:\Users\Nate\AppData\Roaming\.minecraft
2017-07-22 09:37 - 2016-03-08 14:07 - 000000000 ____D C:\Program Files (x86)\Minecraft
2017-07-22 09:09 - 2016-07-04 06:22 - 000000000 ____D C:\Users\Nate\AppData\Roaming\7DaysToDie
2017-07-21 02:44 - 2014-09-15 14:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-07-21 02:42 - 2009-07-13 19:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-07-21 02:39 - 2014-09-15 14:38 - 000000000 ____D C:\Program Files\Microsoft Office
2017-07-14 13:13 - 2012-11-18 08:04 - 000000000 ____D C:\Users\Nate\AppData\Local\Skyrim
2017-07-14 13:09 - 2015-07-10 14:09 - 000000000 ____D C:\Users\Nate\AppData\Local\LOOT
2017-07-14 12:49 - 2015-07-10 14:09 - 000000000 ____D C:\Program Files (x86)\LOOT
2017-07-12 12:23 - 2014-09-16 16:29 - 000000000 ____D C:\Users\Nate\AppData\Local\Adobe
2017-07-12 01:41 - 2012-04-12 18:27 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-07-12 01:41 - 2012-04-12 18:27 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-07-12 01:41 - 2012-04-12 18:27 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-07-12 01:41 - 2012-04-12 18:27 - 000000000 ____D C:\Windows\System32\Macromed
2017-07-12 00:51 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\rescache
2017-07-11 23:38 - 2015-11-23 13:39 - 000453272 _____ C:\Windows\System32\FNTCACHE.DAT
2017-07-11 23:28 - 2014-12-11 00:26 - 000000000 ____D C:\Windows\System32\appraiser
2017-07-11 23:11 - 2013-09-14 23:09 - 000000000 ____D C:\Windows\System32\MRT
2017-07-11 23:06 - 2012-04-14 19:48 - 135225752 ____C (Microsoft Corporation) C:\Windows\System32\MRT.exe

Some files in TEMP:
====================
2017-07-31 14:27 - 2017-07-31 14:27 - 000363208 _____ (BitRaider, LLC) C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe

==================== Known DLLs (Whitelisted) =========================

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll
[2017-05-09 09:54] - [2017-04-17 07:37] - 000512000 _____ (Microsoft Corporation) 5E9F8D029D9B03110D835CBFC058068B

C:\Windows\System32\dnsapi.dll => MD5 is legit
C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Association (Whitelisted) =============

==================== Restore Points =========================

Restore point date: 2017-08-04 13:10
Restore point date: 2017-08-09 03:37

==================== Memory info ===========================

Percentage of memory in use: 7%
Total physical RAM: 16329.37 MB
Available physical RAM: 15095.1 MB
Total Virtual: 16327.57 MB
Available Virtual: 15105.87 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1397.17 GB) (Free:573.46 GB) NTFS
Drive f: (Repair disc Windows 7 64-bit) (Removable) (Total:29.25 GB) (Free:29.02 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: 92F90226)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1397.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 29.3 GB) (Disk ID: F6F28325)
Partition 1: (Active) - (Size=29.2 GB) - (Type=07 NTFS)

LastRegBack: 2017-07-31 20:37

==================== End of FRST.txt ============================

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 9, 2017 21:38:06 GMT -8

Post by dbrisen on Aug 9, 2017 21:38:06 GMT -8

You may want to read carefully all of this message first before starting the steps.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the script file that is attached by right clicking on it and selecting "Save Target As..." or "Save Link As ...." (depends on the browser you are using). Please make sure that the file type is set as Text File (or All Files but NOT as a HTML file) and the files name is Fixlist.txt. Save this file to the USB stick that has FRST on it so that fixlist.txt is next to FRST64.exe,

Start the FRST tool on the disabled system the same way you did for the scan EXCEPT do not press the SCAN button. This time press the FIX button just once and wait for the tool to finish its run.

Remove the USB drive from the system (once the log file has been written to the drive) and reboot the system.

The tool will make a log on the USB drive named (Fixlog.txt) please post it to your reply (attach or paste).

Does the system boot any better now?

Attachments:

Fixlist.txt (434 B)

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

nhosier
New Helpee

Posts: 12

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 10, 2017 2:38:47 GMT -8 via mobile

Post by nhosier on Aug 10, 2017 2:38:47 GMT -8

I didn't try to boot following the scan, I shut down in anticipation of further instructions. I'll run the fix when I get home from work, and try to boot following that. Thanks for the help, looking forward to getting my system back!

nhosier
New Helpee

Posts: 12

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes Aug 10, 2017 12:50:05 GMT -8

Post by nhosier on Aug 10, 2017 12:50:05 GMT -8

The contents of fixlog.txt are as follows:

Fix result of Farbar Recovery Scan Tool (x64) Version: 09-08-2017
Ran by SYSTEM (10-08-2017 16:45:18) Run:1
Running from f:\
Boot Mode: Recovery
==============================================

fixlist content:
*****************
HKLM-x32\...\RunOnce: [CleanUp RzWizard] => C:\Program Files (x86)\Razer\RzWizard\RzInstallerDeletion.vbs [1446 2014-05-18] ()
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
2017-07-31 14:27 - 2017-07-31 14:27 - 000363208 _____ (BitRaider, LLC) C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe
S0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
LastRegBack: 2017-07-31 20:37

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\CleanUp RzWizard => value removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp => key removed successfully
C:\Users\Nate\AppData\Local\Temp\BRSVC_5381082_hlp.exe => moved successfully
HKLM\System\ControlSet001\Services\SmartDefragDriver => key removed successfully
SmartDefragDriver => service removed successfully
DEFAULT => copied successfully to System32\config\HiveBackup
DEFAULT => restored successfully from registry back up
SAM => copied successfully to System32\config\HiveBackup
SAM => restored successfully from registry back up
SECURITY => copied successfully to System32\config\HiveBackup
SECURITY => restored successfully from registry back up
SOFTWARE => Could not copy
SOFTWARE => Could not restore from registry back up
SYSTEM => Could not copy
SYSTEM => Could not restore from registry back up

==== End of Fixlog 16:45:20 ====

[ti]SOLVED[/ti]Unknown infection adding *32 to many processes

Post by nhosier on Aug 7, 2017 13:36:14 GMT -8

Post by dbrisen on Aug 8, 2017 0:09:25 GMT -8

Post by nhosier on Aug 8, 2017 2:35:26 GMT -8

Post by dbrisen on Aug 8, 2017 6:14:02 GMT -8

Post by nhosier on Aug 8, 2017 12:20:38 GMT -8

Post by dbrisen on Aug 8, 2017 21:36:52 GMT -8

Post by nhosier on Aug 9, 2017 15:32:06 GMT -8

Post by dbrisen on Aug 9, 2017 21:38:06 GMT -8

Post by nhosier on Aug 10, 2017 2:38:47 GMT -8

Post by nhosier on Aug 10, 2017 12:50:05 GMT -8