Printable View
THis is an annoying program that I cant uninstall and get rid of it. It causes messages like (this content requires media player 12.7 update). Just got it yesterday and wont go away.ALso I have a red x on my network icon saying there is no internet connection even though I can get on the internet. It also stops my windows defender now and then and have to start it again.Tryed several program removers and it just comes back...Help pls
Follow the instructions at
http://discussions.virtualdr.com/sho...ed-4-1-2014%29
and post the logs in this thread, Attached files will not be opened.
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 11/28/2014
Scan Time: 1:59:42 AM
Logfile: malwarebytes log.txt
Administrator: Yes
Version: 2.00.3.1025
Malware Database: v2014.11.28.02
Rootkit Database: v2014.11.22.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows 8.1
CPU: x64
File System: NTFS
User: kspee_000
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 315983
Time Elapsed: 12 min, 11 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 8.1 Pro
Boot Device: \Device\HarddiskVolume1
Install Date: 12/28/2013 7:22:16 PM
System Uptime: 11/27/2014 10:40:29 PM (7 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | M68MT-S2P
Processor: AMD Phenom(tm) II X4 955 Processor | Socket M2 | 3200/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 466 GiB total, 336.57 GiB free.
D: is CDROM (UDF)
E: is Removable
F: is CDROM ()
G: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP67: 11/23/2014 10:16:30 AM - Installed DirectX
RP68: 11/26/2014 4:00:59 PM - Installed DirectX
RP69: 11/27/2014 4:23:31 PM - Restore Operation
.
==== Installed Programs ======================
.
µTorrent
7-Zip 9.20 (x64 edition)
AMD Wireless Display v3.0
Belarc Advisor 8.4
Cloud System Booster
D3DX10
DiskCheckup v3.2
Far Cry 4
Far Cry 4 Update V1.4
FileParade Bundle
Google Chrome
Google Earth
Google Update Helper
Itibiti RTC
Java 7 Update 71
Java Auto Updater
Junk Mail filter update
Lexmark 5600-6600 Series
Lexmark Printable Web
Lichdom Battlemage
Malwarebytes Anti-Malware version 2.0.3.1025
Microsoft Application Error Reporting
Microsoft ASP.NET MVC 4 Runtime
Microsoft Mouse and Keyboard Center
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 Redistributable - x64 10.0.40219
Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
MSVCRT
MSVCRT_amd64
MSVCRT110
MSVCRT110_amd64
MultiBit 0.5.16
NVIDIA 3D Vision Controller Driver 344.75
NVIDIA 3D Vision Driver 344.75
NVIDIA Control Panel 344.75
NVIDIA Drivers
NVIDIA GeForce Experience 2.1.2
NVIDIA GeForce Experience Service
NVIDIA Graphics Driver 344.75
NVIDIA HD Audio Driver 1.3.32.1
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA MediaShield
NVIDIA Network Service
NVIDIA PhysX
NVIDIA PhysX System Software 9.14.0702
NVIDIA ShadowPlay 16.13.42
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 16.13.42
NVIDIA Update Core
NVIDIA Virtual Audio 1.2.25
Origin
Photo Common
PunkBuster Services
RapidywebIE
Realtek High Definition Audio Driver
SHIELD Streaming
SHIELD Wireless Controller Driver
Steam
SUPERAntiSpyware
System Requirements Lab CYRI
System Requirements Lab Detection
WeatherBug®
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live MIME IFilter
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 5.01 (64-bit)
WinZip 15.0
.
==== Event Viewer Messages From Past Week ========
.
11/28/2014 1:05:11 AM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system.
11/27/2014 7:31:39 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
11/27/2014 4:34:31 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {7022A3B3-D004-4F52-AF11-E9E987FEE25F} and APPID {ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D} to the user Speelman\kspee_000 SID (S-1-5-21-3867094829-2339833201-1041792167-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
11/27/2014 4:34:06 PM, Error: Service Control Manager [7022] - The MBAMService service hung on starting.
11/27/2014 11:31:01 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer CINDY that believes that it is the master browser for the domain on transport NetBT_Tcpip_{3333BADF-4E4C-4FC5-A886-FD52853A3108}. The master browser is stopping or an election is being forced.
11/27/2014 10:41:18 PM, Error: Service Control Manager [7000] - The AODDriver4.2.0 service failed to start due to the following error: The system cannot find the path specified.
11/27/2014 10:41:17 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Optimizer Pro Crash Monitor service to connect.
11/27/2014 10:40:43 PM, Error: Service Control Manager [7000] - The UAC File Virtualization service failed to start due to the following error: This driver has been blocked from loading
11/27/2014 1:26:32 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 2 time(s).
11/27/2014 1:17:21 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 18 time(s).
11/27/2014 1:17:21 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 17 time(s).
11/27/2014 1:17:20 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 16 time(s).
11/27/2014 1:17:20 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 15 time(s).
11/27/2014 1:17:19 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 14 time(s).
11/27/2014 1:17:19 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 13 time(s).
11/27/2014 1:17:18 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 12 time(s).
11/27/2014 1:17:18 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 11 time(s).
11/27/2014 1:17:17 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 10 time(s).
11/27/2014 1:17:16 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 9 time(s).
11/27/2014 1:17:16 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 8 time(s).
11/27/2014 1:17:15 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 7 time(s).
11/27/2014 1:16:06 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 6 time(s).
11/27/2014 1:16:03 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 5 time(s).
11/27/2014 1:15:19 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 4 time(s).
11/27/2014 1:15:18 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 3 time(s).
11/27/2014 1:02:59 PM, Error: Service Control Manager [7031] - The fEmUfBtwRxr service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
11/25/2014 7:42:51 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 252.
11/23/2014 6:19:12 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
11/23/2014 6:19:12 PM, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
=================================
DDS produces two logs. You posted only one.
well I went a head and ran este online scanner and if found this. Everything seems fine so I guess we can say this is resolved
:\Windows\SysWOW64\lsdprn.exe a variant of Win64/Toolbar.Perion.B potentially unwanted application
C:\Program Files\shopperz\brgb64.dll Win64/Toolbar.Perion.B potentially unwanted application deleted - quarantined
C:\Program Files\shopperz\bwbk.dll a variant of Win32/Toolbar.BitCocktail.C potentially unwanted application deleted - quarantined
C:\Program Files\shopperz\bwbk64.dll a variant of Win64/Toolbar.Perion.B potentially unwanted application deleted - quarantined
C:\Program Files (x86)\Rapidyweb\Rapidyweb.dll Win32/SmootherWeb.D potentially unwanted application deleted (after the next restart) - quarantined
C:\Program Files (x86)\Rapidyweb\uninstall.exe Win32/SmootherWeb.D potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\ICReinstall_nsz888F.tmp a variant of Win32/InstallCore.PL potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\nsf20ED.tmp a variant of Win32/InstallCore.PK potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\nsz6AB.tmp a variant of Win32/InstallCore.PK potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\nsz888F.tmp a variant of Win32/InstallCore.PL potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\optprosetup.exe a variant of Win32/OptimizerEliteMax.C potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\n5522\OptimizerProInstaller.exe a variant of Win32/AdWare.SpeedingUpMyPC.N application cleaned by deleting - quarantined
C:\Users\kspee_000\AppData\Local\Temp\n5522\rapidyweb_1011-8369b244.exe Win32/SmootherWeb.D potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\n5522\s5522.exe a variant of MSIL/Solimba.B potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Local\Temp\n5522\SuperOptimizerInstaller.exe a variant of Win32/Adware.SpeedingUpMyPC.T.gen application cleaned by deleting - quarantined
C:\Users\kspee_000\AppData\Local\Temp\n5522\VOPackage.exe Win32/VOPackage.AW potentially unwanted application deleted - quarantined
C:\Users\kspee_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RapidywebInstaller.exe Win32/SmootherWeb.D potentially unwanted application deleted - quarantined
C:\Windows\System32\lsdprn.exe a variant of Win64/Toolbar.Perion.B potentially unwanted application deleted (after the next restart) - quarantined
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17416 BrowserJavaVersion: 10.71.2
Run by kspee_000 at 5:48:38 on 2014-11-28
Microsoft Windows 8.1 Pro 6.3.9600.0.1252.1.1033.18.8190.6476 [GMT -5:00]
.
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\dwm.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\Explorer.EXE
C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe
C:\WINDOWS\system32\dashost.exe
C:\WINDOWS\SysWOW64\lsdprn.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
C:\WINDOWS\SysWOW64\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\skydrive.exe
C:\Program Files (x86)\Lexmark 5600-6600 Series\lxdumon.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\lxducoms.exe
C:\Windows\System32\SettingSyncHost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\System32\svchost.exe -k WerSvcGroup
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mWinlogon: Userinit = userinit.exe,
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Rapidyweb: {7f326367-2b70-40e3-a481-b494cbfd3629} - C:\Program Files (x86)\Rapidyweb\Rapidyweb.dll
BHO: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
uRun: [CloudSystemBooster] "C:\Program Files (x86)\Anvisoft\Cloud System Booster\CloudSystemBooster.exe" /hide /autorun
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [gmsd_us_4] <no file>
StartupFolder: C:\Users\kspee_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RapidywebInstaller.exe
mPolicies-System: EnableLUA = dword:0
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-001051-0002-0051-ABCDEFFEDCBC} - <orphaned>
TCP: NameServer = 10.0.0.1
TCP: Interfaces\{3333BADF-4E4C-4FC5-A886-FD52853A3108} : DHCPNameServer = 10.0.0.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.71\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-Run: [lxdumon.exe] "C:\Program Files (x86)\Lexmark 5600-6600 Series\lxdumon.exe"
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
x64-Run: [NVRaidService] C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [EzPrint] "C:\Program Files (x86)\Lexmark 5600-6600 Series\ezprint.exe"
x64-Run: [ShadowPlay] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-mPolicies-System: EnableLUA = dword:0
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - /UserInstall
x64-mASetup: {89820200-ECBD-11cf-8B85-00AA005B4340} - U
.
============= SERVICES / DRIVERS ===============
.
R0 intelpep;Intel(R) Power Engine Plug-in Driver;C:\WINDOWS\System32\drivers\intelpep.sys [2013-12-28 39768]
R0 Wof;Windows Overlay File System Filter Driver;C:\WINDOWS\System32\drivers\wof.sys [2014-5-7 157016]
R1 ahcache;Application Compatibility Cache;C:\WINDOWS\System32\drivers\ahcache.sys [2013-8-22 76800]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 AnviCsbSvc;Anvi Cloud System Booster Speed Service;C:\Program Files (x86)\Anvisoft\Cloud System Booster\CSBSvc.exe [2014-8-20 42680]
R2 lsdprn;lsdprn;C:\Windows\SysWOW64\lsdprn.exe [2014-11-27 268600]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-27 1871160]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-27 968504]
R3 lxdu_device;lxdu_device;C:\WINDOWS\System32\lxducoms.exe -service --> C:\WINDOWS\System32\lxducoms.exe -service [?]
R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\drivers\mbam.sys [2014-11-27 25816]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [2014-11-27 129752]
R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\WINDOWS\System32\drivers\mwac.sys [2014-11-27 64216]
R3 NcbService;Network Connection Broker;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]
R3 NdisVirtualBus;Microsoft Virtual Network Adapter Enumerator;C:\WINDOWS\System32\drivers\NdisVirtualBus.sys [2013-8-22 16384]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\drivers\nvvad64v.sys [2014-10-11 38048]
R3 WdNisDrv;Windows Defender Network Inspection System Driver;C:\WINDOWS\System32\drivers\WdNisDrv.sys [2014-11-12 114496]
R3 WdNisSvc;Windows Defender Network Inspection Service;C:\Program Files\Windows Defender\NisSrv.exe [2014-11-12 368632]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\WINDOWS\System32\drivers\WUDFRd.sys [2014-8-14 227840]
S2 51cdb72;Optimizer Pro Crash Monitor;C:\WINDOWS\System32\rundll32.exe [2013-8-22 52736]
S3 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2014-7-22 172344]
S3 ADP80XX;ADP80XX;C:\WINDOWS\System32\drivers\adp80xx.sys [2013-8-22 782176]
S3 amdkmafd;AMD Audio Bus Lower Filter;C:\WINDOWS\System32\drivers\amdkmafd.sys [2012-9-22 21160]
S3 AppReadiness;App Readiness;C:\WINDOWS\System32\svchost.exe -k AppReadiness [2013-8-22 37768]
S3 AppXSvc;AppX Deployment Service (AppXSVC);C:\WINDOWS\System32\svchost.exe -k wsappx [2013-8-22 37768]
S3 bcmfn2;bcmfn2 Service;C:\WINDOWS\System32\drivers\bcmfn2.sys [2013-8-22 17624]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudbus.sys [2014-1-22 108800]
S3 GfExperienceService;NVIDIA GeForce Experience Service;C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-10-11 1148744]
S3 iaLPSSi_GPIO;Intel(R) Serial IO GPIO Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_GPIO.sys [2013-8-22 24568]
S3 iaLPSSi_I2C;Intel(R) Serial IO I2C Controller Driver;C:\WINDOWS\System32\drivers\iaLPSSi_I2C.sys [2013-8-22 99320]
S3 iaStorAV;Intel(R) SATA RAID Controller Windows;C:\WINDOWS\System32\drivers\iaStorAV.sys [2013-8-22 651248]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\WINDOWS\System32\ieetwcollector.exe [2014-11-12 114688]
S3 kbldfltr;kbldfltr;C:\WINDOWS\System32\drivers\kbldfltr.sys [2013-11-14 22272]
S3 lfsvc;Windows Location Framework Service;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]
S3 LSI_SAS3;LSI_SAS3;C:\WINDOWS\System32\drivers\lsi_sas3.sys [2013-8-22 81760]
S3 netvsc;netvsc;C:\WINDOWS\System32\drivers\netvsc63.sys [2013-8-22 87040]
S3 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-7-1 1795912]
S3 NvStreamKms;NvStreamKms;C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-7-1 19272]
S3 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-7-1 19439944]
S3 Origin Client Service;Origin Client Service;C:\Program Files (x86)\Origin\OriginClientService.exe [2014-4-3 1900400]
S3 ReFS;ReFS;C:\WINDOWS\System32\drivers\refs.sys [2014-4-20 924504]
S3 ScDeviceEnum;Smart Card Device Enumeration Service;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]
S3 SerCx2;Serial UART Support Library;C:\WINDOWS\System32\drivers\SerCx2.sys [2013-12-28 146776]
S3 smphost;Microsoft Storage Spaces SMP;C:\WINDOWS\System32\svchost.exe -k smphost [2013-8-22 37768]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\WINDOWS\System32\drivers\ssudmdm.sys [2014-1-22 206080]
S3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-11-23 409800]
S3 stornvme;Microsoft Standard NVM Express Driver;C:\WINDOWS\System32\drivers\stornvme.sys [2013-11-14 57176]
S3 UEFI;Microsoft UEFI Driver;C:\WINDOWS\System32\drivers\uefi.sys [2013-8-22 26976]
S3 vmbusr;Virtual Machine Bus Provider;C:\WINDOWS\System32\drivers\vmbusr.sys [2013-11-14 129536]
S3 vmicguestinterface;Hyper-V Guest Service Interface;C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted [2013-8-22 37768]
S3 WEPHOSTSVC;Windows Encryption Provider Host Service;C:\WINDOWS\System32\svchost.exe -k WepHostSvcGroup [2013-8-22 37768]
S3 workfolderssvc;Work Folders;C:\WINDOWS\System32\svchost.exe -k LocalService [2013-8-22 37768]
S4 MsKeyboardFilter;Microsoft Keyboard Filter;C:\WINDOWS\System32\svchost.exe -k netsvcs [2013-8-22 37768]
.
=============== Created Last 30 ================
.
2014-11-28 03:23:47 -------- d-----w- C:\Users\kspee_000\AppData\Local\Anvisoft
2014-11-28 00:31:38 129752 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2014-11-28 00:31:13 93400 ----a-w- C:\WINDOWS\System32\drivers\mbamchameleon.sys
2014-11-28 00:31:13 64216 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2014-11-28 00:31:13 25816 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2014-11-28 00:31:12 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-28 00:28:15 11632448 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5AEC17EE-CC9C-41FE-9A7F-D1BF2A225562}\mpengine.dll
2014-11-27 17:52:27 -------- d-----w- C:\SUPERDelete
2014-11-27 17:49:16 268600 ----a-w- C:\WINDOWS\SysWow64\lsdprn.exe
2014-11-27 17:49:13 -------- d-----w- C:\Program Files\shopperz
2014-11-27 17:34:52 -------- d-----w- C:\Program Files (x86)\predm
2014-11-27 17:31:32 613057 ----a-w- C:\Users\kspee_000\AppData\Local\nsmBA96.tmp
2014-11-27 17:31:30 -------- d-sh--w- C:\Users\kspee_000\AppData\Roaming\AnyProtectEx
2014-11-27 17:30:35 1758 ----a-w- C:\WINDOWS\patsearch.bin
2014-11-27 17:11:31 -------- d-----w- C:\New Folder (3)
2014-11-27 17:09:45 -------- d-----w- C:\New Folder (2)
2014-11-27 16:59:26 -------- d-----w- C:\StormAlert
2014-11-27 16:56:54 1179648 ----a-w- C:\Users\kspee_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RapidywebInstaller.exe
2014-11-27 16:56:54 -------- d-----w- C:\Program Files (x86)\Rapidyweb
2014-11-27 00:07:12 -------- d-----w- C:\Program Files (x86)\Far Cry 4
2014-11-26 21:02:21 -------- d-----w- C:\Users\kspee_000\AppData\Roaming\Far Cry 4
2014-11-26 20:25:08 -------- d-----w- C:\Program Files (x86)\R.G. Mechanics
2014-11-23 18:10:33 615624 ----a-w- C:\WINDOWS\SysWow64\nvStreaming.exe
2014-11-21 01:08:45 1188440 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{79B2C59C-237A-4A67-8EEA-34E87B5BC137}\gapaengine.dll
2014-11-19 00:15:31 991232 ----a-w- C:\WINDOWS\System32\kerberos.dll
2014-11-19 00:15:30 806400 ----a-w- C:\WINDOWS\SysWow64\kerberos.dll
2014-11-19 00:15:25 208896 ----a-w- C:\WINDOWS\SysWow64\pku2u.dll
2014-11-19 00:15:22 259584 ----a-w- C:\WINDOWS\System32\pku2u.dll
2014-11-15 17:19:08 -------- d-sh--w- C:\Users\kspee_000\AppData\Local\EmieBrowserModeList
2014-11-12 07:24:58 154112 ----a-w- C:\WINDOWS\System32\msaudite.dll
2014-11-12 07:24:58 131584 ----a-w- C:\WINDOWS\System32\rdpudd.dll
2014-11-12 07:22:22 143520 ----a-w- C:\Program Files\Windows Defender\SymSrv.dll
2014-11-12 07:21:58 153760 ----a-w- C:\Program Files\Windows Defender\EppManifest.dll
2014-11-12 07:21:58 111264 ----a-w- C:\Program Files\Windows Defender\MpEvMsg.dll
2014-11-12 07:21:56 14336 ----a-w- C:\WINDOWS\System32\winshfhc.dll
2014-11-12 07:21:56 12800 ----a-w- C:\WINDOWS\SysWow64\winshfhc.dll
2014-11-12 07:20:27 28876456 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-11-12 07:20:24 28098072 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-11-12 07:19:04 6040064 ----a-w- C:\WINDOWS\System32\jscript9.dll
2014-11-12 07:19:01 4298240 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2014-11-12 07:17:42 2149376 ----a-w- C:\WINDOWS\System32\msxml3.dll
2014-11-01 18:14:53 -------- d-----w- C:\Users\kspee_000\AppData\Roaming\Lichdom Battlemage
2014-11-01 15:02:43 -------- d-----w- C:\Users\kspee_000\AppData\Local\KSafe
2014-11-01 15:00:49 -------- d-----w- C:\Users\kspee_000\AppData\Roaming\kingsoft
2014-11-01 15:00:47 -------- d-----w- C:\ProgramData\Kingsoft
2014-11-01 15:00:23 -------- d-----w- C:\Program Files (x86)\Kingsoft
.
==================== Find3M ====================
.
2014-11-20 20:51:37 714208 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2014-11-20 20:51:37 106976 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2014-11-12 21:56:45 6897352 ----a-w- C:\WINDOWS\System32\nvcpl.dll
2014-11-12 21:56:45 3534152 ----a-w- C:\WINDOWS\System32\nvsvc64.dll
2014-11-12 21:56:42 934032 ----a-w- C:\WINDOWS\System32\nvvsvc.exe
2014-11-12 21:56:42 62608 ----a-w- C:\WINDOWS\System32\nvshext.dll
2014-11-12 21:56:42 386368 ----a-w- C:\WINDOWS\System32\nvmctray.dll
2014-11-12 21:56:42 2559808 ----a-w- C:\WINDOWS\System32\nvsvcr.dll
2014-11-11 10:29:54 4100776 ----a-w- C:\WINDOWS\System32\nvcoproc.bin
2014-11-04 23:38:37 228864 ----a-w- C:\WINDOWS\System32\aepdu.dll
2014-11-04 00:10:18 304128 ----a-w- C:\WINDOWS\System32\generaltel.dll
2014-10-31 05:12:41 143872 ----a-w- C:\WINDOWS\System32\wextract.exe
2014-10-31 05:12:05 13824 ----a-w- C:\WINDOWS\System32\mshta.exe
2014-10-31 05:10:13 167424 ----a-w- C:\WINDOWS\System32\iexpress.exe
2014-10-31 05:06:45 66560 ----a-w- C:\WINDOWS\System32\iesetup.dll
2014-10-31 05:06:09 580096 ----a-w- C:\WINDOWS\System32\vbscript.dll
2014-10-31 05:06:00 48640 ----a-w- C:\WINDOWS\System32\ieetwproxystub.dll
2014-10-31 05:05:50 417280 ----a-w- C:\WINDOWS\System32\html.iec
2014-10-31 05:04:28 88064 ----a-w- C:\WINDOWS\System32\MshtmlDac.dll
2014-10-31 04:54:13 132096 ----a-w- C:\WINDOWS\System32\IEAdvpack.dll
2014-10-31 04:53:32 98816 ----a-w- C:\WINDOWS\System32\aepic.dll
2014-10-31 04:52:22 108544 ----a-w- C:\WINDOWS\System32\hlink.dll
2014-10-31 04:51:37 144384 ----a-w- C:\WINDOWS\System32\ieUnatt.exe
2014-10-31 04:51:25 114688 ----a-w- C:\WINDOWS\System32\ieetwcollector.exe
2014-10-31 04:50:44 814080 ----a-w- C:\WINDOWS\System32\jscript9diag.dll
2014-10-31 04:49:39 537088 ----a-w- C:\WINDOWS\System32\aeinv.dll
2014-10-31 04:40:07 33280 ----a-w- C:\WINDOWS\System32\licmgr10.dll
2014-10-31 04:30:28 77824 ----a-w- C:\WINDOWS\System32\JavaScriptCollectionAgent.dll
2014-10-31 04:29:50 111616 ----a-w- C:\WINDOWS\System32\iesysprep.dll
2014-10-31 04:29:17 87552 ----a-w- C:\WINDOWS\System32\tdc.ocx
2014-10-31 04:24:48 391168 ----a-w- C:\WINDOWS\System32\devinv.dll
2014-10-31 04:15:11 1032704 ----a-w- C:\WINDOWS\System32\inetcomm.dll
2014-10-31 04:03:02 2124288 ----a-w- C:\WINDOWS\System32\inetcpl.cpl
2014-10-31 03:45:17 2365440 ----a-w- C:\WINDOWS\System32\wininet.dll
2014-10-31 03:44:32 2865152 ----a-w- C:\WINDOWS\System32\actxprxy.dll
2014-10-31 03:42:04 51200 ----a-w- C:\WINDOWS\System32\imgutil.dll
2014-10-31 03:28:47 137728 ----a-w- C:\WINDOWS\SysWow64\wextract.exe
2014-10-31 03:28:43 12800 ----a-w- C:\WINDOWS\SysWow64\mshta.exe
2014-10-31 03:27:26 152064 ----a-w- C:\WINDOWS\SysWow64\iexpress.exe
2014-10-31 03:24:47 501248 ----a-w- C:\WINDOWS\SysWow64\vbscript.dll
2014-10-31 03:24:23 62464 ----a-w- C:\WINDOWS\SysWow64\iesetup.dll
2014-10-31 03:23:37 47616 ----a-w- C:\WINDOWS\SysWow64\ieetwproxystub.dll
2014-10-31 03:23:21 340992 ----a-w- C:\WINDOWS\SysWow64\html.iec
2014-10-31 03:22:08 64000 ----a-w- C:\WINDOWS\SysWow64\MshtmlDac.dll
2014-10-31 03:14:25 112128 ----a-w- C:\WINDOWS\SysWow64\IEAdvpack.dll
2014-10-31 03:13:05 99328 ----a-w- C:\WINDOWS\SysWow64\hlink.dll
2014-10-31 03:12:17 115712 ----a-w- C:\WINDOWS\SysWow64\ieUnatt.exe
2014-10-31 03:11:30 620032 ----a-w- C:\WINDOWS\SysWow64\jscript9diag.dll
2014-10-31 03:03:33 27136 ----a-w- C:\WINDOWS\SysWow64\licmgr10.dll
2014-10-31 02:57:20 60416 ----a-w- C:\WINDOWS\SysWow64\JavaScriptCollectionAgent.dll
2014-10-31 02:56:44 90624 ----a-w- C:\WINDOWS\SysWow64\iesysprep.dll
2014-10-31 02:56:18 73216 ----a-w- C:\WINDOWS\SysWow64\tdc.ocx
2014-10-31 02:46:38 880128 ----a-w- C:\WINDOWS\SysWow64\inetcomm.dll
2014-10-31 02:39:28 2051072 ----a-w- C:\WINDOWS\SysWow64\inetcpl.cpl
2014-10-31 02:26:38 1042944 ----a-w- C:\WINDOWS\SysWow64\actxprxy.dll
2014-10-31 02:24:42 40448 ----a-w- C:\WINDOWS\SysWow64\imgutil.dll
2014-10-31 02:17:17 1892864 ----a-w- C:\WINDOWS\SysWow64\wininet.dll
2014-10-30 11:25:26 275080 ------w- C:\WINDOWS\System32\MpSigStub.exe
2014-10-23 05:48:37 81408 ----a-w- C:\WINDOWS\System32\packager.dll
2014-10-23 05:05:08 72192 ----a-w- C:\WINDOWS\SysWow64\packager.dll
2014-10-18 06:50:21 17408 ----a-w- C:\WINDOWS\System32\wuaext.dll
2014-10-18 06:27:15 35840 ----a-w- C:\WINDOWS\System32\wuapp.exe
2014-10-18 06:26:48 140288 ----a-w- C:\WINDOWS\System32\wuwebv.dll
2014-10-18 06:23:51 407552 ----a-w- C:\WINDOWS\System32\WUSettingsProvider.dll
2014-10-18 06:23:11 95744 ----a-w- C:\WINDOWS\System32\wudriver.dll
2014-10-18 06:20:43 1714176 ----a-w- C:\WINDOWS\System32\wucltux.dll
2014-10-18 06:14:54 29696 ----a-w- C:\WINDOWS\SysWow64\wuapp.exe
2014-10-18 06:14:32 124928 ----a-w- C:\WINDOWS\SysWow64\wuwebv.dll
2014-10-18 06:12:10 81920 ----a-w- C:\WINDOWS\SysWow64\wudriver.dll
2014-10-17 07:01:28 789184 ----a-w- C:\WINDOWS\System32\oleaut32.dll
2014-10-17 06:58:44 602768 ----a-w- C:\WINDOWS\SysWow64\oleaut32.dll
2014-10-16 16:54:03 1876296 ----a-w- C:\WINDOWS\System32\nvdispco6434448.dll
2014-10-16 16:54:03 1539272 ----a-w- C:\WINDOWS\System32\nvdispgenco6434448.dll
2014-10-16 11:52:00 98216 ----a-w- C:\WINDOWS\SysWow64\WindowsAccessBridge-32.dll
2014-10-13 02:33:24 116032 ----a-w- C:\WINDOWS\System32\consent.exe
2014-10-11 00:58:13 3320320 ----a-w- C:\WINDOWS\System32\msi.dll
2014-10-11 00:53:53 3607040 ----a-w- C:\WINDOWS\SysWow64\msi.dll
2014-10-10 01:58:57 27456 ----a-w- C:\WINDOWS\System32\drivers\rdpvideominiport.sys
2014-10-10 01:58:57 177472 ----a-w- C:\WINDOWS\System32\drivers\ksecpkg.sys
2014-10-10 01:44:01 563976 ----a-w- C:\WINDOWS\System32\drivers\cng.sys
2014-10-08 07:37:27 736768 ----a-w- C:\WINDOWS\System32\adtschema.dll
2014-10-08 07:30:59 110080 ----a-w- C:\WINDOWS\System32\appinfo.dll
2014-10-08 07:24:03 40448 ----a-w- C:\WINDOWS\System32\rfxvmt.dll
2014-10-08 07:09:31 428032 ----a-w- C:\WINDOWS\System32\msihnd.dll
2014-10-08 06:56:48 445440 ----a-w- C:\WINDOWS\System32\certcli.dll
2014-10-08 06:51:16 154112 ----a-w- C:\WINDOWS\SysWow64\msaudite.dll
2014-10-08 06:51:03 736768 ----a-w- C:\WINDOWS\SysWow64\adtschema.dll
2014-10-08 06:27:17 325120 ----a-w- C:\WINDOWS\SysWow64\msihnd.dll
2014-10-08 06:18:10 324096 ----a-w- C:\WINDOWS\SysWow64\certcli.dll
2014-10-08 06:17:58 1441792 ----a-w- C:\WINDOWS\System32\lsasrv.dll
2014-10-08 05:32:48 2773504 ----a-w- C:\WINDOWS\System32\authui.dll
2014-10-08 05:23:52 3547648 ----a-w- C:\WINDOWS\System32\rdpcorets.dll
2014-10-08 05:19:04 2459136 ----a-w- C:\WINDOWS\SysWow64\authui.dll
2014-10-07 06:28:00 500016 ----a-w- C:\WINDOWS\System32\AudioSes.dll
2014-10-07 06:27:59 394120 ----a-w- C:\WINDOWS\System32\AUDIOKSE.dll
2014-10-07 06:27:56 482872 ----a-w- C:\WINDOWS\System32\AudioEng.dll
2014-10-07 06:27:56 272248 ----a-w- C:\WINDOWS\System32\audiodg.exe
2014-10-07 06:27:55 108432 ----a-w- C:\WINDOWS\System32\EncDump.dll
2014-10-07 03:34:02 370424 ----a-w- C:\WINDOWS\SysWow64\AudioSes.dll
2014-10-07 03:34:01 344536 ----a-w- C:\WINDOWS\SysWow64\AUDIOKSE.dll
.
============= FINISH: 5:49:52.88 ===============
Not done by a long shot.
Rapidyweb is no longer on programs list and popups are gone..everything seems fine but if think there is more to do I am willing to do what ever you want
http://dev.discussions.virtualdr.forums.relay.cool/ Download RogueKiller from one of the following links and save it to your Desktop:
Link 1
Link 2
- Close all the running programs
- Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- Wait until the Status box shows Scan Finished
- Click on Delete.
- Wait until the Status box shows Deleting Finished.
- Click on Report and copy/paste the content of the Notepad into your next reply.
- RKreport.txt could also be found on your desktop.
- If more than one log is produced post all logs.
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
http://dev.discussions.virtualdr.forums.relay.cool/ Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/...t-all-windows/
Download https://discussions.virtualdr.com/im.../2015/03/5.png Malwarebytes Anti-Rootkit to your desktop.
- Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
- Double click on downloaded file. OK self extracting prompt.
- MBAR will start. Click "Next" to continue.
- Click in the following screen "Update" to obtain the latest malware definitions.
- Once the update is complete select "Next" and click "Scan".
- When the scan is finished and no malware has been found select "Exit".
- If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
- Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
- "mbar-log-{date} (xx-xx-xx).txt"
- "system-log.txt"
NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.
RogueKiller V10.0.8.0 [Nov 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : kspee_000 [Administrator]
Mode : Delete -- Date : 11/29/2014 19:00:05
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 8 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 [(Private Address) (XX)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.1 [(Private Address) (XX)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3333BADF-4E4C-4FC5-A886-FD52853A3108} | DhcpNameServer : 10.0.0.1 [(Private Address) (XX)] -> Not selected
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3333BADF-4E4C-4FC5-A886-FD52853A3108} | DhcpNameServer : 10.0.0.1 [(Private Address) (XX)] -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD50 00AADS-00S9B SCSI Disk Device +++++
--- User ---
[MBR] b5213563912fd67ea62a7efb696ca6c2
[BSP] 51753904b73350dc7668d3a5d31bd3f0 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476937 MB
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )
+++++ PhysicalDrive1: Lexmark USB Mass Storage USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
+++++ PhysicalDrive2: SanDisk Cruzer USB Device +++++
--- User ---
[MBR] 5e62dd72cde7daddaf219492c2ff60c1
[BSP] 79fdcb6f5787863c0e9a758566d1ae79 : Legit.Unknown MBR Code
Partition table:
0 - [ACTIVE] FAT32 (0xb) [VISIBLE] Offset (sectors): 44 | Size: 7655 MB
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )
============================================
RKreport_SCN_11292014_185953.log
Malwarebytes Anti-Rootkit BETA 1.08.2.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 6.3.9200 Windows 8.1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.17416
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.215000 GHz
Memory total: 8588320768, free: 6180216832
Downloaded database version: v2014.11.29.09
Downloaded database version: v2014.11.29.01
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.08.2.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 6.3.9200 Windows 8.1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.17416
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.215000 GHz
Memory total: 8588320768, free: 6201790464
Downloaded database version: v2014.11.29.09
Downloaded database version: v2014.11.29.01
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
Initializing...
This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
=======================================
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.08.2.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 6.3.9200 Windows 8.1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.17416
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.215000 GHz
Memory total: 8588320768, free: 6529007616
Downloaded database version: v2014.11.29.09
Downloaded database version: v2014.11.29.01
=======================================
Initializing...
------------ Kernel report ------------
11/29/2014 19:10:44
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\nvstor64.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\system32\drivers\WdFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\amdppm.sys
\SystemRoot\System32\drivers\serial.sys
\SystemRoot\System32\drivers\serenum.sys
\SystemRoot\System32\drivers\parport.sys
\SystemRoot\System32\drivers\usbohci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvmf6264.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\System32\drivers\usbprint.sys
\SystemRoot\System32\drivers\USBSTOR.SYS
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\dc3d.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\point64.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_nvstor64.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\Drivers\WdNisDrv.sys
\SystemRoot\system32\DRIVERS\mslldp.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\System32\drivers\WpdUpFltr.sys
\SystemRoot\System32\drivers\umpass.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xffffe00007f00060
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000004a\
Lower Device Object: 0xffffe00007f12b10
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffe000070a3770
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000043\
Lower Device Object: 0xffffe00007212470
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffe00006bbf770
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000024\
Lower Device Object: 0xffffe00005bf4060
Lower Device Driver Name: \Driver\nvstor64\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffe00006bbf770, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00006bbf230, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe00006bbf770, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00005592c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe00005bf4060, DeviceName: \Device\00000024\, DriverName: \Driver\nvstor64\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
File "C:\Windows\System32\drivers\1394ohci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\1394ohci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpipagr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpipagr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpipmi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpipmi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\acpitime.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\acpitime.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\AGP440.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\AGP440.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\amdk8.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\amdk8.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\amdppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\amdppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\atapi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\atapi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\ataport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\ataport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\intelpep.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\intelpep.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\intelppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\intelppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\isapnp.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\isapnp.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\kbdclass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\kbdclass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\kbdhid.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\kbdhid.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\kdnic.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\kdnic.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BasicRender.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BasicRender.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\battc.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\battc.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BtaMPM.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BtaMPM.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\bthhfenum.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\bthhfenum.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BthhfHid.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BthhfHid.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\bthmodem.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\bthmodem.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\cdrom.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\cdrom.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\circlass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\circlass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\errdev.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\errdev.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\fdc.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\fdc.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\flpydisk.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\flpydisk.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\fxppm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\fxppm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\parport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\parport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pciide.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pciide.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pciidex.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pciidex.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\pcmcia.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\pcmcia.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\portcls.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\portcls.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\processr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\processr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\monitor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\monitor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\mouclass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\mouclass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\mouhid.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\mouhid.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msgpiowin32.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msgpiowin32.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msisadrv.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msisadrv.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\msiscsi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\msiscsi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\BasicDisplay.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\BasicDisplay.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\CmBatt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\CmBatt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sdbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sdbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sdstor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sdstor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\serenum.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\serenum.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\serial.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\serial.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sermouse.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sermouse.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sfloppy.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sfloppy.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\spaceport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\spaceport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\stornvme.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\stornvme.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\swenum.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\swenum.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\terminpt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\terminpt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\tpm.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\tpm.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\TsUsbGD.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\TsUsbGD.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\uaspstor.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\uaspstor.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\UCX01000.SYS" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\UCX01000.SYS" is compressed (flags = 1)
File "C:\Windows\System32\drivers\uefi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\uefi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\umbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\umbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\umpass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\umpass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\USBAUDIO.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\USBAUDIO.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbccgp.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbccgp.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbcir.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbcir.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbd.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbd.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbehci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbehci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbhub.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbhub.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\USBHUB3.SYS" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\USBHUB3.SYS" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbohci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbohci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbport.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbport.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbprint.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbprint.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\usbuhci.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\usbuhci.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\USBXHCI.SYS" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\USBXHCI.SYS" is compressed (flags = 1)
File "C:\Windows\System32\drivers\vdrvroot.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\vdrvroot.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\vhdmp.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\vhdmp.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\volmgr.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\volmgr.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\volsnap.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\volsnap.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\mssmbios.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\mssmbios.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\MTConfig.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\MTConfig.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\npsvctrig.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\npsvctrig.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\vwifibus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\wacompen.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\wacompen.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\winusb.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\winusb.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\wmiacpi.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\wmiacpi.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hdaudbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hdaudbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\HdAudio.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\HdAudio.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidbatt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidbatt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidbth.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidbth.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidclass.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidclass.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidi2c.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidi2c.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidparse.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidparse.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\hidusb.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\hidusb.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\i8042prt.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\i8042prt.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\CompositeBus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\CompositeBus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\disk.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\disk.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\drmk.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\drmk.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\drmkaud.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\drmkaud.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\dumpsd.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\dumpsd.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\rdpbus.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\rdpbus.sys" is compressed (flags = 1)
File "C:\Windows\System32\drivers\sbp2port.sys" is compressed (flags = 1)
File "C:\WINDOWS\SYSTEM32\drivers\sbp2port.sys" is compressed (flags = 1)
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: BFEF6FC2
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 976768002
Partition file system is NTFS
Partition is bootable
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 500107862016 bytes
Sector size: 512 bytes
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffe000070a3770, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00007127040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe000070a3770, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00007212470, DeviceName: \Device\00000043\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xffffe00007f00060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00007f00b20, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe00007f00060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00007f12b10, DeviceName: \Device\0000004a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 0
Partition information:
Partition 0 type is Other (0xb)
Partition is ACTIVE.
Partition starts at LBA: 44 Numsec = 15679396
Partition file system is FAT32
Partition is not bootable
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 8029470208 bytes
Sector size: 512 bytes
Done!
Scan finished
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-44-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
opps lost the 2nd log
Malwarebytes Anti-Rootkit BETA 1.08.2.1001
www.malwarebytes.org
Database version: v2014.11.29.09
Windows 8.1 x64 NTFS
Internet Explorer 11.0.9600.17416
kspee_000 :: SPEELMAN [administrator]
11/29/2014 7:10:54 PM
mbar-log-2014-11-29 (19-10-54).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 317116
Time elapsed: 11 minute(s), 22 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
system seems clean but something keep turning off windows defender and the network icon has an red x even though I can connect