View original (French)

Infected by malware

Solved
leechius -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,
Configuration: Windows 7 / Firefox 30.0

After installing software downloaded from 01.net, my computer got infected with several malware.
I have used Malwarebytes anti-Malware and Panda Cloud Cleaner.
They no longer find anything, but I am experiencing a significant ping loss on this computer.
Can you help me identify what this is?
Thank you in advance for your assistance.

9 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hi,

    You have installed adware and potentially unwanted programs on your PC.
    Here’s the procedure to remove them:

    Download https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= AdwCleaner (from Xplode) to your desktop.
    On the AdwCleaner page, on the right side, click on the gray floppy disk with the green arrow to start the download.
    Run AdwCleaner, click on [Scan].
    The scan may take several minutes, please wait.
    Once the scan is finished, click on [Clean]

    Once the cleaning is complete, a report will open. Copy/paste the content of the report in your next response using copy/paste.
    If that doesn’t work, use the site http://pjjoint.malekal.com to host the report, give the link to the report in a new message.

    Note: The report is also saved under C:\AdwCleaner[S1].txt

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
  2. leechius
     
    Thank you. Here is the report.
    # AdwCleaner v3.215 - Report created on 07/14/2014 at 18:31:57
    # Updated on 07/09/2014 by Xplode
    # Operating system: Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username: Fnac - FNAC-PC
    # Executed from: C:\Users\Fnac\Downloads\adwcleaner_3.215.exe
    # Option: Clean

    ***** [ Services ] *****

    ***** [ Files / Folders ] *****

    Folder Deleted: C:\Users\Fnac\AppData\Roaming\RocketUpdater
    Folder Deleted: C:\Users\Fnac\AppData\Roaming\Mozilla\Firefox\Profiles\nhdvfyxp.default\Extensions\{ecaa9181-d92a-47b9-8e14-bef9680f204b}
    File Deleted: C:\Users\Fnac\AppData\Roaming\Mozilla\Firefox\Profiles\nhdvfyxp.default\searchplugins\WSE Rocket.xml
    File Deleted: C:\Users\Fnac\AppData\Roaming\Mozilla\Firefox\Profiles\nhdvfyxp.default\user.js

    ***** [ Shortcuts ] *****

    ***** [ Registry ] *****

    Key Deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
    Key Deleted: HKCU\Software\InstallCore

    ***** [ Browsers ] *****

    -\\ Internet Explorer v11.0.9600.17207

    Restored Setting: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

    -\\ Mozilla Firefox v30.0 (fr)

    [ File: C:\Users\Fnac\AppData\Roaming\Mozilla\Firefox\Profiles\nhdvfyxp.default\prefs.js ]

    *************************

    AdwCleaner[R0].txt - [4580 bytes] - [07/13/2014 20:29:51]
    AdwCleaner[R1].txt - [930 bytes] - [07/13/2014 20:34:51]
    AdwCleaner[R2].txt - [1048 bytes] - [07/13/2014 20:56:13]
    AdwCleaner[R3].txt - [1034 bytes] - [07/13/2014 20:59:53]
    AdwCleaner[R4].txt - [2718 bytes] - [07/14/2014 18:13:50]
    AdwCleaner[S0].txt - [4642 bytes] - [07/13/2014 20:31:20]
    AdwCleaner[S1].txt - [990 bytes] - [07/13/2014 20:35:28]
    AdwCleaner[S2].txt - [1110 bytes] - [07/13/2014 20:56:40]
    AdwCleaner[S3].txt - [1096 bytes] - [07/13/2014 21:00:23]
    AdwCleaner[S4].txt - [1874 bytes] - [07/14/2014 18:31:57]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1934 bytes] ##########
    0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Perform an OTL Scan - Time: About 40min
    =====================
    OTL allows to diagnose running programs and detect infections - The program will generate two reports OTL.txt and Extras.txt
    Provide both reports:

    You can follow the instructions on this page to help you: https://www.malekal.com/tutorial-otl/

    * Download http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ to your desktop.
    (For Vista/Win7, right-click on OTL and choose Run as administrator)

    * Run OTL
    * In the top right of Quick Analysis, check "all users"
    * In OTL, under Customization, copy-paste the script below:

    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %ALLUSERSPROFILE%\Application Data\*.dll /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %temp%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\consrv.dll
    %systemroot%\system32\*.dll /lockedfiles
    %windir%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    /md5start
    explorer.exe
    winlogon.exe
    services.exe
    wininit.exe
    /md5stop
    HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
    HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
    HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
    HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
    CREATERESTOREPOINT
    nslookup www.google.fr /c
    ipconfig /all /c
    ping www.google.fr /c
    SAVEMBR:0
    hklm\software\clients\startmenuinternet|command /rs
    hklm\software\clients\startmenuinternet|command /64 /rs

    * Click on the Analyze button.

    **** If during the scan - OTL is unresponsive, do not touch anything and let the scan continue ****

    * When the scan is finished, use the site http://pjjoint.malekal.com/ to upload the OTL.txt report (and Extra.txt if present).
    Provide the pjjoint links pointing to these reports here in a response.
    I repeat: give the link of the pjjoint report here in response.

    DO NOT COPY/PASTE THE REPORT HERE - PROVIDE THE PJJOINT LINK IN A NEW MESSAGE

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0
  4. leechius
     
    Thank you again, here is the link for the 2 reports below
    http://pjjoint.malekal.com/files.php?id=OTL_Extras_20140714_j9o5i8m6d5
    0
  6. leechius
     
    For better readability, I am publishing the results in 2 separate links:
    otl:
    http://pjjoint.malekal.com/files.php?id=OTL_20140715_o8i9r10l714

    Extra:
    http://pjjoint.malekal.com/files.php?id=OTL_Extras_20140715_n14k11m14b15l9

    Thank you again for your help. Have a nice day.
    0
  7. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    The OTL report is correct.
    I advise you to uninstall Spybot.

    What other problem is left?

    --
    Comme l'ange que tu es, tu ris en créant une légèreté dans ma poitrine,
    Tes yeux me percent,
    (Ta réponse est toujours 'peut-être')
    C'est alors que je me suis levé et suis parti.
    0
    1. leechius
       
      I have severe ping latency. Only on this computer. I only notice it when playing online games. My ping goes from 30 ms to 2600 or even connection loss since I installed those pesky software.
      0
    2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      It must be all the anti-whatever installed since then.
      Uninstall ZoneAlarm, Malwarebytes, Spybot, Panda, etc.

      See what that does.
      0
    3. leechius
       
      I have high ping latency only on this PC. It ranges from 30 ms to 2500 ms, sometimes even disconnecting. I mostly notice it during online games.
      0
    4. leechis
       
      Okay, I'll do that tonight. Thank you.
      0
  8. leechius
     
    I uninstalled all of that and I'm still having major ping issues that jump from 30 ms to 500 ms every 3 seconds.
    0
  9. leechius
     
    Good evening,
    I used ComboFix, I can post the report if you want.
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      If you want.
      But I doubt it's a virus problem.

      Either it's your connection, or there's a program that's slowing down the PC.
      0
    2. leechius
       
      Here is the report since it has returned to normal.

      ComboFix 14-07-15.04 - Fnac 15/07/2014 20:54:49.1.4 - x64
      Microsoft Windows 7 Home Premium Edition 6.1.7601.1.1252.33.1036.18.6125.4593 [GMT 2:00]
      Launched from: c:\users\Fnac\Downloads\ComboFix.exe
      AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
      SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
      SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
      .
      .
      (((((((((((((((((((((((((((((((((((( Other deletions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      c:\users\Fnac\AppData\Roaming\app
      c:\users\Fnac\AppData\Roaming\app\Jerakine_lang.dat
      c:\users\Fnac\AppData\Roaming\app\Jerakine_lang_vesrion.dat
      .
      .
      ((((((((((((((((((((((((((((( Files created from 2014-06-15 to 2014-07-15 ))))))))))))))))))))))))))))))))))))
      .
      .
      2014-07-15 18:59 . 2014-07-15 18:59 -------- d-----w- c:\users\Default\AppData\Local\temp
      2014-07-15 18:25 . 2014-07-15 18:25 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
      2014-07-15 18:25 . 2014-07-15 18:25 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
      2014-07-15 18:25 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
      2014-07-15 18:25 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
      2014-07-15 18:25 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
      2014-07-14 18:20 . 2014-07-15 18:06 512 ----a-w- C:\PhysicalMBR.bin
      2014-07-14 06:58 . 2014-01-09 02:22 5694464 ----a-w- c:\windows\SysWow64\mstscax.dll
      2014-07-14 06:58 . 2014-01-03 22:44 6574592 ----a-w- c:\windows\system32\mstscax.dll
      2014-07-13 18:29 . 2014-07-15 17:52 -------- d-----w- C:\AdwCleaner
      2014-07-13 08:53 . 2013-04-29 07:17 47632 ----a-w- c:\windows\system32\drivers\PSKMAD.sys
      2014-07-13 08:53 . 2014-07-13 08:53 -------- d-----w- c:\windows\SysWow64\DASBOOT
      2014-07-13 08:13 . 2014-07-13 08:13 -------- d-----w- c:\users\Fnac\AppData\Local\Razer
      2014-07-13 08:09 . 2014-07-13 08:09 -------- d-----w- c:\users\Fnac\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
      2014-07-13 08:08 . 2014-07-13 08:09 -------- d-----w- c:\users\Fnac\AppData\Local\Adobe
      2014-07-13 07:52 . 2014-07-13 07:52 -------- d-----w- c:\programdata\Razer
      2014-07-13 07:52 . 2014-07-14 14:51 -------- d-----w- c:\program files (x86)\Razer
      2014-07-13 07:51 . 2013-09-25 02:23 1030144 ----a-w- c:\windows\system32\TSWorkspace.dll
      2014-07-13 07:51 . 2013-09-25 01:57 792576 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
      2014-07-12 17:38 . 2014-07-13 18:54 -------- d-----w- c:\users\Fnac\AppData\Roaming\DVDVideoSoft
      2014-07-12 16:36 . 2014-07-12 17:40 -------- d-----w- c:\users\Fnac\AppData\Roaming\Audacity
      2014-07-12 15:58 . 2014-07-12 15:58 -------- d-----w- c:\users\Fnac\AppData\Local\DownloadManager
      2014-07-09 16:07 . 2014-06-03 10:02 1719296 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
      2014-07-09 16:07 . 2014-06-03 10:02 1389568 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
      2014-07-09 16:07 . 2014-06-03 10:02 1380864 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
      2014-07-09 16:07 . 2014-06-03 10:02 1354240 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
      2014-07-09 16:07 . 2014-06-03 09:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
      2014-07-09 16:07 . 2014-06-30 02:09 519168 ----a-w- c:\windows\system32\aepdu.dll
      2014-07-09 16:07 . 2014-06-30 02:04 424448 ----a-w- c:\windows\system32\aeinv.dll
      2014-07-09 15:59 . 2014-05-30 08:08 210944 ----a-w- c:\windows\system32\wdigest.dll
      2014-07-09 15:56 . 2014-06-19 00:31 33792 ----a-w- c:\windows\system32\iernonce.dll
      2014-06-23 21:59 . 2014-06-23 21:59 -------- d-sh--w- c:\users\Fnac\AppData\Local\EmieUserList
      2014-06-23 21:59 . 2014-06-23 21:59 -------- d-sh--w- c:\users\Fnac\AppData\Local\EmieSiteList
      2014-06-23 21:59 . 2014-07-12 16:21 -------- d-----w- c:\users\Fnac\AppData\Local\DoNotTrackPlus
      .
      .
      .
      (((((((((((((((((((((((((((((((((( Find3M report ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2014-07-12 15:54 . 2012-04-08 06:15 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
      2014-07-12 15:54 . 2011-10-18 21:15 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
      2014-07-09 21:59 . 2011-10-18 20:22 96441528 ----a-w- c:\windows\system32\MRT.exe
      2014-07-01 11:54 . 2013-07-24 19:18 117712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
      2014-06-06 14:06 . 2013-07-24 19:18 130584 ----a-w- c:\windows\system32\drivers\avipbb.sys
      2014-05-29 05:32 . 2014-05-29 05:32 80384 ----a-w- c:\windows\system32\RazerCoinstaller.dll
      2014-05-24 02:33 . 2014-05-24 02:33 864256 ----a-w- c:\windows\SysWow64\rzdevicedll.dll
      2014-05-24 02:33 . 2014-05-24 02:33 325120 ----a-w- c:\windows\SysWow64\rzaudiodll.dll
      2014-05-19 06:47 . 2014-05-19 06:47 155816 ----a-w- c:\windows\system32\drivers\rzudd.sys
      2014-05-19 06:26 . 2014-05-19 06:26 89088 ----a-w- c:\windows\SysWow64\rzdevinfo.dll
      2014-05-19 06:26 . 2014-05-19 06:26 155136 ----a-w- c:\windows\SysWow64\rztouchdll.dll
      2014-05-19 06:26 . 2014-05-19 06:26 117248 ----a-w- c:\windows\SysWow64\rzdisplaydll.dll
      2014-05-08 09:32 . 2014-06-11 15:56 3178496 ----a-w- c:\windows\system32\rdpcorets.dll
      2014-05-08 09:32 . 2014-06-11 15:56 16384 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
      2014-04-25 02:34 . 2014-06-11 15:56 801280 ----a-w- c:\windows\system32\usp10.dll
      2014-04-25 02:06 . 2014-06-11 15:56 626688 ----a-w- c:\windows\SysWow64\usp10.dll
      2006-05-03 10:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
      2007-02-21 11:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
      2008-03-16 13:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
      2010-01-06 22:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
      2012-10-05 18:54 188416 --sha-r- c:\windows\SysWOW64\winDCE32.dll
      .
      .
      ((((((((((((((((((((((((((((((((( Registry Load Points ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty items & initial legitimate items are not listed
      REGEDIT4
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
      "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
      "RunAIShell"="c:\program files (x86)\ASUS\AI Manager\AsShellApplication.exe" [2009-12-23 232064]
      "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
      "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-07-01 750160]
      "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
      .
      c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
      AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-4-30 548528]
      .
      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "ConsentPromptBehaviorAdmin"= 5 (0x5)
      "ConsentPromptBehaviorUser"= 3 (0x3)
      "EnableUIADesktopToggle"= 0 (0x0)
      .
      [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
      "mixer4"=wdmaud.drv
      .
      R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
      R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
      R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
      R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
      R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
      R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
      R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
      R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
      R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
      R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys;c:\windows\SYSNATIVE\DRIVERS\PSKMAD.sys [x]
      R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
      R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
      R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan60.sys [x]
      R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
      R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
      R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
      R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
      R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
      R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
      S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
      S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
      S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
      S2 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
      S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [x]
      S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.11\aaHMSvc.exe;c:\program files (x86)\ASUS\AAHM\1.00.11\aaHMSvc.exe [x]
      S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.10\AsSysCtrlService.exe;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.10\AsSysCtrlService.exe [x]
      S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
      S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
      S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
      S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe;c:\windows\SysWOW64\AsHookDevice.exe [x]
      S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
      S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
      S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
      S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
      S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
      S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
      S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
      S3 rzudd;Razer Keyboard Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
      S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
      S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
      S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
      S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
      S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
      .
      .
      [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
      Hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
      .
      Contents of the 'Scheduled Tasks' folder
      .
      2014-07-15 c:\windows\Tasks\Adobe Flash Player Updater.job
      - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 15:54]
      .
      2014-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-27 09:10]
      .
      2014-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-27 09:10]
      .
      .
      --------- X64 Entries -----------
      .
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-06 166936]
      "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-06 391704]
      "Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-06 416792]
      "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-02 11545192]
      .
      ------- Additional Examination -------
      .
      uLocal Page = c:\windows\system32\blank.htm
      uStart Page = hxxp://www.google.com
      mLocal Page = c:\windows\SysWOW64\blank.htm
      TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
      FF - ProfilePath - c:\users\Fnac\AppData\Roaming\Mozilla\Firefox\Profiles\a8qtqdbl.default\
      .
      - - - - ORPHANS REMOVED - - - -
      .
      URLSearchHooks-{d7f26d0e-9801-45c3-a091-8a65e4ed73b5} - (no file)
      Toolbar-Locked - (no file)
      Wow6432Node-HKLM-Run-<NO NAME> - (no file)
      HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
      Toolbar-Locked - (no file)
      .
      .
      .
      --------------------- BLOCKED REGISTRY KEYS ---------------------
      .
      [HKEY_USERS\S-1-5-21-3288292302-2356716767-2959269681-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
      "??"=hex:bc,e5,4f,3a,db,83,8c,a3,fc,2b,35,94,10,a0,f3,a0,db,0b,ef,f3,22,13,32,
      ca,c2,93,08,10,b1,5d,1a,5c,3e,33,83,69,f2,6a,41,54,e3,c6,3c,8c,0b,4d,4d,35,\
      "??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
      "Enabled"=dword:00000001
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
      @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker5"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="FlashBroker"
      "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
      "Enabled"=dword:00000001
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Shockwave Flash Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
      @="0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
      @="ShockwaveFlash.ShockwaveFlash.14"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
      @Denied: (A 2) (Everyone)
      @="Macromedia Flash Factory Object"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
      "ThreadingModel"="Apartment"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
      @="FlashFactory.FlashFactory.1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
      @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
      @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
      @="1.0"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
      @="FlashFactory.FlashFactory"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
      @Denied: (A 2) (Everyone)
      @="IFlashBroker5"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
      @="{00020424-0000-0000-C000-000000000046}"
      .
      [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
      @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
      "Version"="1.0"
      .
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
      @Denied: (Full) (Everyone)
      .
      End time: 2014-07-15 21:01:03
      ComboFix-quarantined-files.txt 2014-07-15 19:01
      .
      Before-CF: 99 605 164 032 bytes free
      After-CF: 99 171 377 152 bytes free
      .
      - - End Of File - - 8CCFE461D2D1A1B84AC76C4B738E4CDD
      4976D4A7A40B83FC7F06EE4BDD84EB9B
      0
    4. leechius
       
      Thank you, everything is working again. Thank you for your help.
      0
  10. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    :)

    To avoid being taken in by unwanted software/adware, etc.
    Read - Unwanted Programs / PUPs: https://www.malekal.com/adwares-pup-protection/

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left
    0