another multiple dllhost.exe infection #?

golfdogjim New Helpee Posts: 19	another multiple dllhost.exe infection #? Oct 28, 2014 10:42:30 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by golfdogjim on Oct 28, 2014 10:42:30 GMT -8 Norton detects a Powerlik attempt but failed to block them. Running Windows Ultimate SP1 32-bit.
	Last Edit: Nov 1, 2014 21:44:45 GMT -8 by Quads

dbrisen
Malware Removalists

Posts: 3,688

another multiple dllhost.exe infection #? Oct 28, 2014 13:03:18 GMT -8

Post by dbrisen on Oct 28, 2014 13:03:18 GMT -8

Do Not use advanced tools or any tools used on this board without supervision.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than other tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems. Bottom line is, if you are not sure about something, STOP and ASK until you are sure.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

>>>>>> Reply stating you have read the post fully. <<<<<<<

Also, please tell us what your Operating system is (Win7 Ultimate, Vista Home Premium, Win XP Pro, etc.) and is it 32 bit or 64 bit. WE need this information to direct you to the proper tools to use.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

golfdogjim New Helpee Posts: 19	another multiple dllhost.exe infection #? Oct 28, 2014 16:44:52 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by golfdogjim on Oct 28, 2014 16:44:52 GMT -8 I have read fully and understand. Win 7 Ultimate SP1 32-bit. Thank you.

golfdogjim New Helpee Posts: 19	another multiple dllhost.exe infection #? Oct 28, 2014 21:51:08 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by golfdogjim on Oct 28, 2014 21:51:08 GMT -8 malicious attacks are now being detected from explorer.exe (in addition to dllhost.exe) by Malwarebytes Anti-Malware.

Quads
Malware Removalists

In New Zealand

Posts: 9,387

another multiple dllhost.exe infection #? Oct 28, 2014 22:08:23 GMT -8

Post by Quads on Oct 28, 2014 22:08:23 GMT -8

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 32 bit version.

Place FRST.exe onto your desktop from where ever it downloaded to.

Start FRST that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Press Scan button.

It will make a logs (FRST.txt and addition.txt) on your Desktop Please attach the log in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply.

IF ADDITION.txt does not want to upload

go to Wikisend wikisend.com/ OR go to pastebin.com

and upload the addition.txt there, then post the download link back in a message

Quads

golfdogjim
New Helpee

Posts: 19

another multiple dllhost.exe infection #? Oct 28, 2014 22:50:46 GMT -8

Post by golfdogjim on Oct 28, 2014 22:50:46 GMT -8

FRST log

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-10-2014 01
Ran by Jim (administrator) on JIM-PC on 28-10-2014 23:44:19
Running from C:\Users\Jim\Desktop
Loaded Profile: Jim (Available profiles: Jim)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\21.6.0.32\n360.exe
() C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
(Sony Corporation) C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\21.6.0.32\n360.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Sony Corporation) C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(SOS Online Backup) C:\Program Files\SOS Online Backup\SMessaging.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\msosync.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1183744 2007-02-21] (Analog Devices, Inc.)
HKLM\...\Run: [SynTPStart] => C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-09-14] (Synaptics, Inc.)
HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM\...\Run: [PMBVolumeWatcher] => C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724536 2012-04-22] (Sony Corporation)
HKLM\...\Run: [SOSUAUI] => C:\Program Files\SOS Online Backup\sosuploadagent.exe [58888 2014-10-16] (SOS Online Backup)
HKLM\...\Run: [SMessaging] => C:\Program Files\SOS Online Backup\SMessaging.exe [67592 2014-10-16] (SOS Online Backup)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2586912 2013-09-05] ()
HKLM\...\Run: [AccountCreatorRunner] => C:\Program Files\SOS Online Backup\AccountCreatorRunner.exe [22024 2014-10-16] (SOS Online Backup)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...\Policies\Explorer: [ForceStartMenuLogOff] 1
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...\Policies\Explorer: [ForceRunOnStartMenu] 1
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...\MountPoints2: {5ccbb480-88c6-11df-8340-806e6f6e6963} - D:\setup.exe
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...\MountPoints2: {ad273dbe-9497-11e1-b8ed-001f297b8a10} - E:\TLBootstrap_WPP.exe
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security Suite\Engine\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security Suite\Engine\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security Suite\Engine\21.6.0.32\buShell.dll (Symantec Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.ighome.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = www.msn.com/defaulta.aspx
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1A8201B518B9C901
SearchScopes: HKCU - DefaultScope {2B40ADDA-1B5D-4649-83E2-3F4266A08CE3} URL = www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {2B40ADDA-1B5D-4649-83E2-3F4266A08CE3} URL = www.google.com/search?q={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security Suite\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Security Suite\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll No File
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-28]
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2013-11-27]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Security Suite\Engine\21.6.0.32\Exts\Chrome.crx [2014-09-30]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1669296 2014-09-25] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 N360; C:\Program Files\Norton Security Suite\Engine\21.6.0.32\N360.exe [265040 2014-09-22] (Symantec Corporation)
R2 NVIDIA Performance Driver Service; C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [5241448 2009-12-08] ()
R2 NVWMI; C:\Windows\system32\nvwmi.exe [1027872 2013-09-05] (NVIDIA Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474168 2012-04-22] (Sony Corporation)
S2 sagentservice; C:\Program Files\SOS Online Backup\SAgent.Service.exe [43528 2014-10-16] (SOS Online Backup)
S2 XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R1 BHDrvx86; C:\Program Files\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20141024.001\BHDrvx86.sys [1138392 2014-10-03] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2013-09-25] (Symantec Corporation)
R3 CYUSB; C:\Windows\System32\Drivers\CYUSB.sys [39936 2009-01-16] (Cypress Semiconductor)
R2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [41984 2006-09-05] (Samsung Electronics Co., Ltd.) [File not signed]
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [221400 2010-03-26] (Intel Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-08] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-08] (Symantec Corporation)
R1 IDSVix86; C:\Program Files\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20141028.001\IDSvix86.sys [476888 2014-08-29] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-10-28] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20141028.001\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20141028.001\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation)
S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [25808 2014-03-19] (Microsoft Corporation)
R3 rismc32; C:\Windows\System32\DRIVERS\rismc32.sys [47616 2006-12-20] (RICOH Company, Ltd.)
R1 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-25] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-25] (Symantec Corporation)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2006-11-22] (Samsung Electronics) [File not signed]
R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-09-09] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-08-25] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-26] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-08-25] (Symantec Corporation)
S3 Lavasoft Kernexplorer; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-28 23:44 - 2014-10-28 23:44 - 00015933 _____ () C:\Users\Jim\Desktop\FRST.txt
2014-10-28 23:43 - 2014-10-28 23:44 - 00000000 ____D () C:\FRST
2014-10-28 23:42 - 2014-10-28 23:42 - 01104896 _____ (Farbar) C:\Users\Jim\Desktop\frst.exe
2014-10-28 22:46 - 2014-10-28 22:46 - 00006378 _____ () C:\Windows\system32\PerfStringBackup.TMP
2014-10-28 17:47 - 2014-10-28 17:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-10-28 17:46 - 2014-10-28 17:47 - 00000000 ____D () C:\Program Files\QuickTime
2014-10-28 03:43 - 2014-10-28 22:51 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-28 03:43 - 2014-10-28 03:45 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-28 03:43 - 2014-10-28 03:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-27 23:09 - 2014-10-28 23:31 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-27 23:09 - 2014-10-28 16:00 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-10-27 23:09 - 2014-10-27 23:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-10-27 23:09 - 2014-10-27 23:09 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-27 23:09 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-27 23:09 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-27 23:09 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-24 04:52 - 2014-10-28 03:23 - 00000000 ____D () C:\NPE
2014-10-23 11:35 - 2014-10-28 03:29 - 00000000 ____D () C:\Users\Jim\AppData\Local\NPE
2014-10-22 12:06 - 2014-10-28 11:37 - 00000000 ___HD () C:\ProgramData\{D9E629DC-CB1C-4A97-9900-81922B4EFFD4}
2014-10-21 21:04 - 2014-10-21 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-10-21 21:03 - 2014-10-21 21:04 - 00000000 ____D () C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
2014-10-21 21:03 - 2014-10-21 21:04 - 00000000 ____D () C:\Program Files\iTunes
2014-10-21 21:03 - 2014-10-21 21:03 - 00000000 ____D () C:\Program Files\iPod
2014-10-16 11:46 - 2014-08-18 19:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-16 11:46 - 2014-08-18 19:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-16 11:46 - 2014-08-18 19:41 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-16 11:46 - 2014-08-18 19:40 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-16 11:46 - 2014-08-18 19:40 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-16 11:46 - 2014-08-18 18:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-16 11:46 - 2014-07-06 18:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-16 11:46 - 2014-07-06 18:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-16 11:46 - 2014-07-06 18:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-16 11:46 - 2014-07-06 18:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-16 11:46 - 2014-07-06 18:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-10-16 11:46 - 2014-07-06 18:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-16 11:46 - 2014-07-06 18:39 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-16 11:46 - 2014-07-06 18:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-16 11:46 - 2014-07-06 18:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-16 11:46 - 2014-07-06 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-16 11:46 - 2014-07-06 18:28 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-16 11:46 - 2014-06-27 17:21 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-16 11:46 - 2014-06-27 17:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-16 11:46 - 2014-06-27 17:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-15 20:49 - 2014-10-09 18:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 20:49 - 2014-10-09 18:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 20:49 - 2014-10-09 18:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 20:49 - 2014-09-28 17:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 20:49 - 2014-09-25 15:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 20:49 - 2014-09-25 15:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 20:49 - 2014-09-18 18:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 20:49 - 2014-09-18 18:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 20:49 - 2014-09-18 18:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 20:49 - 2014-09-18 17:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 20:49 - 2014-09-18 17:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 20:49 - 2014-09-18 17:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 20:49 - 2014-09-18 17:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 20:49 - 2014-09-18 17:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 20:49 - 2014-09-18 16:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 20:49 - 2014-09-03 22:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 20:48 - 2014-10-06 19:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 20:48 - 2014-09-25 15:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 20:48 - 2014-09-25 15:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 20:48 - 2014-09-25 15:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 20:48 - 2014-09-18 18:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 20:48 - 2014-09-18 18:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 20:48 - 2014-09-18 18:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 20:48 - 2014-09-18 18:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 20:48 - 2014-09-18 17:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 20:48 - 2014-09-18 17:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 20:48 - 2014-09-18 17:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 20:48 - 2014-09-18 17:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 20:48 - 2014-09-18 17:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 20:48 - 2014-09-18 17:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 20:48 - 2014-09-18 17:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 20:48 - 2014-09-18 17:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 20:48 - 2014-09-18 17:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 20:48 - 2014-09-18 16:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 20:48 - 2014-09-18 16:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 20:48 - 2014-09-17 18:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 20:48 - 2014-09-04 18:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 20:48 - 2014-08-28 18:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-15 20:48 - 2014-06-18 15:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 20:48 - 2014-06-18 15:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 20:48 - 2014-06-18 15:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 20:47 - 2014-09-12 18:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 20:47 - 2014-07-16 18:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 20:47 - 2014-07-16 18:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 20:47 - 2014-07-16 18:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 20:47 - 2014-07-16 18:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 20:47 - 2014-07-16 18:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 20:47 - 2014-07-16 18:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 20:47 - 2014-07-16 18:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 20:47 - 2014-07-16 18:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-12 01:41 - 2014-10-12 01:41 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-07 05:29 - 2012-08-21 13:01 - 00026840 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-10-07 05:28 - 2014-10-21 21:03 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-10-07 05:26 - 2014-10-07 05:26 - 00000000 ____D () C:\Program Files\Bonjour
2014-10-04 20:58 - 2014-10-04 20:58 - 00014200 _____ () C:\Users\Jim\Documents\MyContacts2.csv
2014-10-04 20:30 - 2014-10-04 20:30 - 00002058 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-10-04 20:30 - 2014-10-04 20:30 - 00002058 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-10-04 20:30 - 2014-10-04 20:30 - 00000000 ____D () C:\Program Files\Microsoft OneDrive
2014-10-04 20:29 - 2014-10-07 22:48 - 00000000 ___RD () C:\Users\Jim\OneDrive
2014-10-04 20:29 - 2014-10-05 22:25 - 00002130 _____ () C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-10-04 20:29 - 2014-10-04 20:29 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-10-04 20:17 - 2014-10-04 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-10-04 20:13 - 2014-10-27 21:30 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-10-04 20:09 - 2014-10-04 20:33 - 00000000 ____D () C:\Users\Public\Documents\Verizon_WPP
2014-10-04 20:09 - 2014-10-04 20:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Verizon
2014-10-04 20:08 - 2014-10-04 20:09 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\Verizon
2014-10-04 02:13 - 2014-10-04 02:13 - 00028160 _____ () C:\Users\Jim\Documents\MyContacts.xls
2014-10-04 02:10 - 2014-10-04 02:10 - 00008179 _____ () C:\Users\Jim\Documents\MyContacts.vcf
2014-10-04 02:09 - 2014-10-04 02:09 - 00014866 _____ () C:\Users\Jim\Documents\MyContacts.csv
2014-10-02 14:23 - 2014-10-02 14:23 - 00094208 _____ (Apple Inc.) C:\Windows\system32\QuickTimeVR.qtx
2014-10-02 14:23 - 2014-10-02 14:23 - 00069632 _____ (Apple Inc.) C:\Windows\system32\QuickTime.qts
2014-10-01 02:21 - 2014-09-24 18:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-28 22:45 - 2009-07-13 21:39 - 03744656 _____ () C:\Windows\setupact.log
2014-10-28 21:34 - 2010-07-05 23:50 - 01321495 _____ () C:\Windows\WindowsUpdate.log
2014-10-28 11:48 - 2012-06-13 09:50 - 00000430 _____ () C:\Windows\Tasks\Online Backup Update Notifier.job
2014-10-28 11:47 - 2010-07-05 23:22 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-28 11:47 - 2010-07-05 23:22 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-28 11:37 - 2009-07-13 21:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-28 11:36 - 2012-06-06 01:15 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-28 07:09 - 2011-05-11 17:40 - 00000000 ____D () C:\Program Files\SOS Online Backup
2014-10-28 03:45 - 2014-08-21 15:39 - 00000000 ____D () C:\Users\Jim\AppData\Local\Adobe
2014-10-28 03:22 - 2010-07-05 23:40 - 00694646 _____ () C:\Windows\PFRO.log
2014-10-27 23:05 - 2011-05-11 18:06 - 00000454 _____ () C:\Windows\Tasks\SOS Online Backup - jamese@live.com.job
2014-10-27 23:05 - 2011-05-11 17:41 - 00000000 ____D () C:\ProgramData\SOS Online Backup
2014-10-27 22:56 - 2010-03-11 14:08 - 00000000 ____D () C:\Users\Jim\AppData\Temp
2014-10-27 22:08 - 2008-08-31 17:52 - 00000000 ____D () C:\Program Files\Adobe
2014-10-27 21:41 - 2009-07-13 19:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-27 21:32 - 2008-08-24 10:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-24 04:43 - 2010-02-22 00:24 - 00000000 ____D () C:\ProgramData\Norton
2014-10-21 21:03 - 2010-07-10 07:37 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-10-16 14:57 - 2009-07-13 19:37 - 00000000 ____D () C:\Windows\rescache
2014-10-16 12:47 - 2008-08-24 13:02 - 00000000 ____D () C:\Users\Jim\Documents\Fantasy Football
2014-10-16 12:43 - 2014-04-11 17:52 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center
2014-10-16 11:50 - 2011-05-11 17:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SOS Online Backup
2014-10-16 11:49 - 2011-05-11 17:40 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-10-16 11:12 - 2009-07-13 21:33 - 00446440 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 11:08 - 2014-05-05 18:37 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 08:20 - 2013-07-13 14:43 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 08:16 - 2010-07-13 16:42 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-13 12:16 - 2010-07-06 00:02 - 00812584 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-12 01:41 - 2011-06-15 22:46 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-12 01:40 - 2008-08-31 17:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-10-07 05:38 - 2010-05-25 22:30 - 00000000 ____D () C:\Users\Jim\AppData\Roaming\Apple Computer
2014-10-07 05:29 - 2008-08-24 13:47 - 00000000 ____D () C:\Users\Jim\AppData\Local\Apple Computer
2014-10-07 05:28 - 2014-03-04 15:17 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-10-07 05:28 - 2008-08-29 10:08 - 00000000 ____D () C:\ProgramData\Apple
2014-10-04 21:02 - 2009-12-18 10:35 - 00043926 _____ () C:\Users\Jim\AppData\Roaming\Comma Separated Values (Windows).ADR
2014-10-04 20:29 - 2010-07-05 23:25 - 00000000 ____D () C:\Users\Jim
2014-10-04 20:28 - 2014-05-15 00:16 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-10-04 20:28 - 2009-07-13 19:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-10-04 20:25 - 2010-07-06 01:23 - 00113504 _____ () C:\Users\Jim\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-04 20:18 - 2008-08-24 10:55 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-10-04 15:15 - 2008-08-24 13:02 - 00000000 ____D () C:\Legal
2014-10-04 01:24 - 2009-12-18 11:25 - 00013403 _____ () C:\Users\Jim\Documents\christmas card list.xlsx
2014-10-02 10:29 - 2013-11-27 22:50 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite
2014-10-02 10:29 - 2011-05-13 06:50 - 00000000 ____D () C:\Windows\system32\Drivers\N360

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-28 04:37

==================== End Of Log ============================

golfdogjim New Helpee Posts: 19	another multiple dllhost.exe infection #? Oct 28, 2014 22:52:25 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by golfdogjim on Oct 28, 2014 22:52:25 GMT -8 Addition txt wikisend.com/download/159518/Addition.txt

Quads
Malware Removalists

In New Zealand

Posts: 9,387

another multiple dllhost.exe infection #? Oct 28, 2014 23:50:55 GMT -8

Post by Quads on Oct 28, 2014 23:50:55 GMT -8

You may want to read carefully all of this message first before starting the steps.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the script attached, needs to be the same file name as well (fixlist.txt), have it on the Desktop, so that fixlist.txt is next to FRST64.exe,

DO NOT DRAG AND DROP to download the script, it won't work for FRST (Right click on the attachment link (not the normal left click) and from the menu choose Save As or Save Link as.)

The script tells FRST what to do.

Start FRST that is on the desktop
When the tool opens click Yes to disclaimer. (if it still does)

Press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) please post it to your reply (attach or paste)

Quads

golfdogjim
New Helpee

Posts: 19

another multiple dllhost.exe infection #? Oct 29, 2014 0:38:14 GMT -8

Post by golfdogjim on Oct 29, 2014 0:38:14 GMT -8

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-10-2014 01
Ran by Jim at 2014-10-29 01:36:30 Run:1
Running from C:\Users\Jim\Desktop
Loaded Profile: Jim (Available profiles: Jim)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...\MountPoints2: {5ccbb480-88c6-11df-8340-806e6f6e6963} - D:\setup.exe
HKU\S-1-5-21-336624592-330430215-1129946338-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
S2 XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [X]
CustomCLSID: HKU\S-1-5-21-336624592-330430215-1129946338-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
end
*****************

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp" => Key deleted successfully.
"HKU\S-1-5-21-336624592-330430215-1129946338-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ccbb480-88c6-11df-8340-806e6f6e6963}" => Key deleted successfully.
"HKCR\CLSID\{5ccbb480-88c6-11df-8340-806e6f6e6963}" => Key not found.
"HKU\S-1-5-21-336624592-330430215-1129946338-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key Deleted Successfully.
"HKU\S-1-5-21-336624592-330430215-1129946338-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.
XAudioService => Service deleted successfully.
"HKU\S-1-5-21-336624592-330430215-1129946338-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found.

==== End of Fixlog ====

golfdogjim New Helpee Posts: 19	another multiple dllhost.exe infection #? Oct 29, 2014 0:40:18 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by golfdogjim on Oct 29, 2014 0:40:18 GMT -8 BTW, I'm 99% sure that this started happening when I installed the latest Flash update late last week...

another multiple dllhost.exe infection #?

Post by golfdogjim on Oct 28, 2014 10:42:30 GMT -8

Post by dbrisen on Oct 28, 2014 13:03:18 GMT -8

Post by golfdogjim on Oct 28, 2014 16:44:52 GMT -8

Post by golfdogjim on Oct 28, 2014 21:51:08 GMT -8

Post by Quads on Oct 28, 2014 22:08:23 GMT -8

Post by golfdogjim on Oct 28, 2014 22:50:46 GMT -8

Post by golfdogjim on Oct 28, 2014 22:52:25 GMT -8

Post by Quads on Oct 28, 2014 23:50:55 GMT -8

Post by golfdogjim on Oct 29, 2014 0:38:14 GMT -8

Post by golfdogjim on Oct 29, 2014 0:40:18 GMT -8