Solved Virus stopping access on all browsers

[skrillek]

i was an idiot and disabled avast for ten minutes and i downloaded a file an now i have a virus i cant find that when ever i open a browser it shoes a blank white screen and the single text saying 'Hi' in the top left hand corner. My avast and malwarebytes cant find it?

any ideas thanks!

 

[piattj]

Some things to try first:

1. Reset browser to default
2. Try a different browser
3. Any software sneakily installed (Control Panel/Programs...)
4. Check your HOSTS file (C/Windows/System32/Drivers/etc) is clean. Ideally no entries without the # start to the line.

 

[Layback Bear]

Just because I'm curious. Why did you disable your anti virus program?

 

[cottonball]

skrilleck,

What browsers do you use to which you have no access?

Are you able to boot your computer into Safe Mode with Command Prompt?

To do so, restart the computer, and when it starts to come back up, tap, tap, tap the F8 key on your keyboard.

When the Boot menu appears, does it allow you to select: Safe Mode with Command Prompt

Let us know.

 

[skrillek]

Some things to try first:

1. Reset browser to default
2. Try a different browser
3. Any software sneakily installed (Control Panel/Programs...)
4. Check your HOSTS file (C/Windows/System32/Drivers/etc) is clean. Ideally no entries without the # start to the line.

1 i have tried
2i have tried same result
3 i only found one i didnt know it was called 'free version 15' and it is uninstalled .
4 i think all look clean?

 

[skrillek]

Just because I'm curious. Why did you disable your anti virus program?

because avast was deleting exe files

 

[skrillek]

skrilleck,

What browsers do you use to which you have no access?

Are you able to boot your computer into Safe Mode with Command Prompt?

To do so, restart the computer, and when it starts to come back up, tap, tap, tap the F8 key on your keyboard.

When the Boot menu appears, does it allow you to select: Safe Mode with Command Prompt

Let us know.

firefox and internet explorer.

and i can i have no oterh problems apart form accessing the internet, i can get to youtube and other sites through some proxy sites

 

[cottonball]

If you can get to and select Safe Mode with Command Prompt,

At the command prompt, type in the following: rstrui.exe
Then press: Enter

See if you can select a restore point prior to when the issue first happened.

If not, we will go another route.

 

[skrillek]

i know if i cant fix it i will have to restore it but im hoping that will be my final option

 

[Jacee]

Let's take a quick look to see what may be hiding:

Download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[skrillek]

like this?
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17496 BrowserJavaVersion: 11.25.2
Run by Ivan at 0:16:51 on 2015-01-27
Microsoft Windows 7 Professional 6.1.7601.1.1252.44.1033.18.16328.13596 [GMT 0:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\Tablet\Pen\WTabletServiceCon.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SmartTechnology\Software\ProfilerU.exe
C:\Program Files\SmartTechnology\Software\SaiMfd.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\CCleaner\CCleaner64.exe
C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Tablet\Pen\WacomHost.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SysWOW64\ASGT.exe
C:\Program Files (x86)\Xamarin\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Ivan\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\PowerISO\PowerISO.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = Google
mWinlogon: Userinit = userinit.exe,
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - <orphaned>
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>
uRun: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
uRun: [uTorrent] "C:\Users\Ivan\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
mRun: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: SoftwareSASGeneration = dword:1
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{DC7071EB-D71B-49D6-AF3A-C30A17223B4D} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{E5607FED-943F-4057-8313-06A9D22030BF} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
SSODL: WebCheck - <orphaned>
x64-mWinlogon: Userinit = userinit.exe,
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll
x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll
x64-Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe
x64-Run: [SaiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe
x64-Run: [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
Hosts: 199.59.62.24 MalwareTips - Your Security Advisor | MalwareTips.com
Hosts: 199.59.62.24 malwareremovalguides.info
Hosts: 199.59.62.24 onlinevirusrepair.com
Hosts: 199.59.62.24 enigmasoftware.com
Hosts: 199.59.62.24 pcrisk.com
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Ivan\AppData\Roaming\Mozilla\Firefox\Profiles\gydkvzm2.default\
FF - prefs.js: browser.startup.homepage - Google
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrlui.dll
FF - plugin: C:\Users\Ivan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2014-7-30 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2014-7-30 267632]
R0 fltsrv;Acronis Storage Filter Management;C:\Windows\System32\drivers\fltsrv.sys [2014-9-6 108832]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-5-20 19264]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-10-3 56208]
R0 SCMNdisP;General NDIS Protocol Driver;C:\Windows\System32\drivers\SCMNdisP.sys [2014-7-30 25056]
R0 tib;Acronis TIB Manager;C:\Windows\System32\drivers\tib.sys [2014-9-6 1120032]
R0 tib_mounter;Acronis TIB Mounter;C:\Windows\System32\drivers\tib_mounter.sys [2014-9-6 183224]
R0 vididr;Acronis Virtual Disk;C:\Windows\System32\drivers\vididr.sys [2014-9-6 161568]
R0 vidsflt;Acronis Disk Storage Filter;C:\Windows\System32\drivers\vidsflt.sys [2014-9-6 117024]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswsnx.sys [2014-7-30 1050432]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswsp.sys [2014-7-30 436624]
R2 afcdpsrv;Acronis Nonstop Backup Service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2014-9-6 3783672]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2014-11-21 244736]
R2 ASGT;ASGT;C:\Windows\SysWOW64\ASGT.exe [2012-1-17 55296]
R2 aswHwid;avast! HardwareID;C:\Windows\System32\drivers\aswHwid.sys [2014-7-30 29208]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2014-7-30 83280]
R2 aswStm;aswStm;C:\Windows\System32\drivers\aswStm.sys [2014-7-30 116728]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-12-29 50344]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-12-10 732160]
R2 LVPrcS64;Process Monitor;C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-5-7 197976]
R2 RadeonPro Support Service;RadeonPro Support Service;C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [2015-1-17 20608]
R2 syncagentsrv;Acronis Sync Agent Service;C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [2013-3-26 7084672]
R2 UMVPFSrv;UMVPFSrv;C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [2014-11-16 450848]
R2 VBoxAswDrv;VBoxAsw Support Driver;C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2014-12-29 271752]
R2 WSWNA3100;WSWNA3100;C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [2014-10-28 307928]
R2 WTabletServiceCon;Wacom Consumer Service;C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [2014-12-13 656664]
R3 afcdp;afcdp;C:\Windows\System32\drivers\afcdp.sys [2014-9-6 367200]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2014-6-21 94720]
R3 AvastVBoxSvc;AvastVBox COM Service;C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2014-12-29 4012248]
R3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;C:\Windows\System32\drivers\bcmwlhigh664.sys [2014-7-30 1256192]
R3 Blackberry Device Manager;Blackberry Device Manager;C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-1-18 577536]
R3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);C:\Windows\System32\drivers\ICCWDT.sys [2010-8-18 26136]
R3 ISCT;Intel(R) Smart Connect Technology Device Driver;C:\Windows\System32\drivers\ISCTD.sys [2014-2-3 44744]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-5-20 357184]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-5-20 789824]
R3 LVPr2M64;Logitech LVPr2M64 Driver;C:\Windows\System32\drivers\LVPr2M64.sys [2010-5-7 30304]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2014-7-30 769168]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2014-11-16 31472]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);C:\Windows\System32\drivers\vcsvad.sys [2014-8-10 21504]
R3 xhcdrv;VIA USB eXtensible Host Controller Service;C:\Windows\System32\drivers\xhcdrv.sys [2014-1-21 297472]
S1 A2DDA;A2 Direct Disk Access Support Driver;H:\bin\a2ddax64.sys [2015-1-25 26176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-4-3 154584]
S3 cleanhlp;cleanhlp;E:\eek\bin\cleanhlp64.sys [2015-1-25 57024]
S3 cmshusbser;Mobile Connector USB Device for Legacy Serial Communication IN ANDROID DEVICE;C:\Windows\System32\drivers\cmshusbser.sys [2014-8-12 127232]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2014-12-28 79360]
S3 DIRECTIO;DIRECTIO;C:\Program Files\PerformanceTest\DirectIo64.sys [2014-12-17 31160]
S3 EasyAntiCheat;EasyAntiCheat;C:\Windows\System32\EasyAntiCheat.exe --> C:\Windows\System32\EasyAntiCheat.exe [?]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2014-9-6 17480]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2014-9-6 9800]
S3 GPCIDrv;GPCIDrv;C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [2010-2-4 14376]
S3 hidkmdf;KMDF Driver;C:\Windows\System32\drivers\hidkmdf.sys [2014-12-13 14136]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-12-10 114688]
S3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-6-19 342528]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2012-12-10 803872]
S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2010-11-10 341856]
S3 LVUVC64;Logitech HD Webcam C270(UVC);C:\Windows\System32\drivers\lvuvc64.sys [2014-11-16 4865568]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-7-30 129752]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-8-2 19456]
S3 SaiK1703;SaiK1703;C:\Windows\System32\drivers\SaiK1703.sys [2012-9-20 180544]
S3 SaiK2237;SaiK2237;C:\Windows\System32\drivers\SaiK2237.sys [2013-1-19 181024]
S3 SaiU1703;SaiU1703;C:\Windows\System32\drivers\SaiU1703.sys [2012-9-20 47168]
S3 Sony PC Companion;Sony PC Companion;C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2014-10-13 155824]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-8-2 56832]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2014-8-15 54784]
S3 VMUVC;Vimicro Camera Service VMUVC;C:\Windows\System32\drivers\vmuvc.sys [2009-3-11 198400]
S3 vvftUVC;Vimicro Camera Filter Service VMUVC;C:\Windows\System32\drivers\vvftUVC.sys [2008-7-1 303616]
S3 WacHidRouter;Wacom Hid Router;C:\Windows\System32\drivers\wachidrouter.sys [2014-12-13 102200]
S3 wacomrouterfilter;Wacom Router Filter Driver;C:\Windows\System32\drivers\wacomrouterfilter.sys [2014-12-13 15160]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-8-1 1255736]
.
=============== File Associations ===============
.
FileExt: .reg: Applications\notepad.exe=C:\Windows\System32\NOTEPAD.EXE %1 [UserChoice]
FileExt: .js: jsfile="C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\Dreamweaver.exe","%1"
ShellExec: dreamweaver.exe: Open="C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\dreamweaver.exe", "%1"
.

 

[skrillek]

=============== Created Last 30 ================
.
2015-01-24 02:01:49 11870360 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AD2D9230-937D-439E-8EF7-28EC0C6BDDE6}\mpengine.dll
2015-01-18 21:39:42 -------- d-----w- C:\ProgramData\Call of Duty - Modern Warfare 3 (TeknoMW3) (Rip by X-NET)
2015-01-17 13:37:27 -------- d-----w- C:\Users\Ivan\AppData\Roaming\RadeonPro
2015-01-17 13:37:11 -------- d-----w- C:\Program Files (x86)\RadeonPro
2015-01-16 08:19:29 -------- d-----w- C:\Users\Ivan\AppData\Local\PACE Anti-Piracy
2015-01-16 07:47:50 -------- d-----w- C:\Program Files\x264vfw64
2015-01-16 07:47:39 -------- d-----w- C:\Program Files (x86)\x264vfw
2015-01-15 15:37:31 141312 ----a-w- C:\Windows\System32\drivers\mrxdav.sys
2015-01-14 23:55:51 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2015-01-14 23:55:51 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2015-01-14 23:55:51 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2015-01-14 23:55:51 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2015-01-14 23:55:51 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2015-01-14 23:06:09 -------- d-----w- C:\Users\Ivan\AppData\Roaming\Origin
2015-01-14 23:06:08 -------- d-----w- C:\Users\Ivan\AppData\Local\Origin
2015-01-14 23:05:38 -------- d-----w- C:\ProgramData\Electronic Arts
2015-01-14 17:24:59 210432 ----a-w- C:\Windows\System32\profsvc.dll
2015-01-14 17:24:57 52224 ----a-w- C:\Windows\SysWow64\nlaapi.dll
2015-01-14 17:24:57 303616 ----a-w- C:\Windows\System32\nlasvc.dll
2015-01-14 17:24:57 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll
2015-01-14 17:24:55 87040 ----a-w- C:\Windows\System32\TSWbPrxy.exe
2015-01-14 17:24:52 5553592 ----a-w- C:\Windows\System32\ntoskrnl.exe
2015-01-14 17:24:49 3971512 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2015-01-14 17:24:49 3916728 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2015-01-14 17:24:48 503808 ----a-w- C:\Windows\System32\srcore.dll
2015-01-14 17:24:48 50176 ----a-w- C:\Windows\System32\srclient.dll
2015-01-14 17:24:48 43008 ----a-w- C:\Windows\SysWow64\srclient.dll
2015-01-14 17:24:48 296960 ----a-w- C:\Windows\System32\rstrui.exe
2015-01-13 23:43:53 -------- d-----w- C:\Users\Ivan\temp
2015-01-12 19:25:07 -------- d-----w- C:\Users\Ivan\AppData\Roaming\NCH Software
2015-01-11 23:07:27 -------- d-----w- C:\Program Files\Realtek
2015-01-11 23:07:26 -------- d-----w- C:\Windows\SysWow64\RTCOM
2015-01-11 22:40:27 -------- d-----w- C:\Program Files (x86)\Realtek AC97
2015-01-11 22:39:46 65024 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2015-01-08 14:29:17 -------- d-----w- C:\Users\Ivan\AppData\Local\FLT
2015-01-08 14:28:39 -------- d-----w- C:\Users\Ivan\AppData\Roaming\MKKE
2015-01-08 13:49:57 -------- d-----w- C:\Program Files (x86)\AMD AVT
2015-01-08 13:49:01 -------- d-----w- C:\Program Files (x86)\AMD
2015-01-07 15:34:13 -------- d-sh--w- C:\ProgramData\DSS
2015-01-07 15:34:12 -------- d-----w- C:\ProgramData\Codemasters
2015-01-07 15:33:35 19087360 ----a-w- C:\Windows\SysWow64\mkl_blueripple.dll
2015-01-07 15:33:35 1417216 ----a-w- C:\Windows\SysWow64\rapture3d_oal.dll
2015-01-07 15:33:34 -------- d-----w- C:\Program Files (x86)\BRS
2014-12-31 18:18:39 -------- d-----w- C:\Users\Ivan\AppData\Roaming\AMD
2014-12-30 17:26:32 -------- d-----w- C:\Users\Ivan\AppData\Local\ATI
2014-12-30 17:26:02 0 ----a-w- C:\Windows\ativpsrm.bin
2014-12-30 17:18:51 -------- d-----w- C:\Users\Ivan\AppData\Roaming\library_dir
2014-12-30 17:09:49 -------- d-----w- C:\Users\Ivan\AppData\Roaming\Raptr
2014-12-30 17:09:49 -------- d-----w- C:\Program Files (x86)\Raptr
2014-12-30 17:09:46 -------- d-----w- C:\ProgramData\AMD
2014-12-30 17:09:43 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies
2014-12-30 17:08:31 -------- d-----w- C:\Program Files (x86)\ATI Technologies
2014-12-30 17:07:12 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2014-12-30 13:48:17 -------- d-----w- C:\Program Files\AMD
2014-12-29 16:17:26 -------- d-----w- C:\Windows\SysWow64\vbox
2014-12-29 16:17:26 -------- d-----w- C:\Windows\System32\vbox
2014-12-29 15:35:05 43152 ----a-w- C:\Windows\avastSS.scr
2014-12-28 15:47:12 -------- d-----w- C:\Program Files (x86)\Common Files\Creative Labs Shared
.
==================== Find3M ====================
.
2015-01-26 02:36:22 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-01-18 21:32:43 114688 ----a-w- C:\Windows\System32\d3dx10_43.dll
2015-01-14 00:12:09 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-14 00:12:09 701616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2015-01-06 04:36:02 298120 ------w- C:\Windows\System32\MpSigStub.exe
2014-12-29 15:35:24 1050432 ----a-w- C:\Windows\System32\drivers\aswsnx.sys
2014-12-29 15:35:05 93568 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2014-12-29 15:35:05 83280 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2014-12-29 15:35:05 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2014-12-29 15:35:05 29208 ----a-w- C:\Windows\System32\drivers\aswHwid.sys
2014-12-29 15:35:05 267632 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2014-12-29 15:35:05 116728 ----a-w- C:\Windows\System32\drivers\aswStm.sys
2014-12-21 13:58:28 3570688 ----a-w- C:\Windows\System32\x264vfw64.dll
2014-12-13 05:09:01 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-12-13 03:33:44 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-12-10 21:42:55 111016 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2014-11-26 18:50:08 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2014-11-26 18:50:08 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2014-11-26 09:38:56 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2014-11-22 03:06:23 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-11-22 03:06:11 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-11-22 02:50:39 66560 ----a-w- C:\Windows\System32\iesetup.dll
2014-11-22 02:50:10 580096 ----a-w- C:\Windows\System32\vbscript.dll
2014-11-22 02:49:54 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-11-22 02:48:20 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2014-11-22 02:35:29 114688 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-11-22 02:34:51 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-11-22 02:34:07 6039552 ----a-w- C:\Windows\System32\jscript9.dll
2014-11-22 02:26:31 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-11-22 02:20:44 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-11-22 02:14:16 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-11-22 02:07:43 501248 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-11-22 02:07:17 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-11-22 02:06:32 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05:02 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2014-11-22 01:54:30 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-11-22 01:47:10 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2014-11-22 01:46:58 2125312 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-11-22 01:40:04 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29:26 4299264 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-11-22 01:28:21 2358272 ----a-w- C:\Windows\System32\wininet.dll
2014-11-22 01:22:49 2052096 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-11-22 01:21:57 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:00:20 1888256 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-11-21 06:14:22 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-11-21 06:14:12 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-11-21 06:14:08 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-11-21 02:43:56 7558816 ----a-w- C:\Windows\SysWow64\atiumdva.dll
2014-11-21 02:43:50 7077776 ----a-w- C:\Windows\SysWow64\atiumdag.dll
2014-11-21 02:43:42 8379720 ----a-w- C:\Windows\System32\atiumd6a.dll
2014-11-21 02:43:38 8369408 ----a-w- C:\Windows\System32\atiumd64.dll
2014-11-21 02:41:36 294600 ----a-w- C:\Windows\System32\drivers\amdacpksd.sys
2014-11-21 02:40:00 18959360 ----a-w- C:\Windows\System32\drivers\atikmdag.sys
2014-11-21 02:33:12 235008 ----a-w- C:\Windows\System32\clinfo.exe
2014-11-21 02:33:06 98816 ----a-w- C:\Windows\System32\OpenVideo64.dll
2014-11-21 02:33:06 83456 ----a-w- C:\Windows\SysWow64\OpenVideo.dll
2014-11-21 02:33:04 86528 ----a-w- C:\Windows\System32\OVDecode64.dll
2014-11-21 02:33:02 73216 ----a-w- C:\Windows\SysWow64\OVDecode.dll
2014-11-21 02:33:00 47899136 ----a-w- C:\Windows\System32\amdocl64.dll
2014-11-21 02:32:08 40987136 ----a-w- C:\Windows\SysWow64\amdocl.dll
2014-11-21 02:31:18 65024 ----a-w- C:\Windows\System32\OpenCL.dll
2014-11-21 02:31:16 58880 ----a-w- C:\Windows\SysWow64\OpenCL.dll
2014-11-21 02:24:50 28354560 ----a-w- C:\Windows\System32\atio6axx.dll
2014-11-21 02:19:36 23621632 ----a-w- C:\Windows\SysWow64\atioglxx.dll
2014-11-21 02:19:26 49664 ----a-w- C:\Windows\System32\amdmmcl6.dll
2014-11-21 02:19:22 38912 ----a-w- C:\Windows\SysWow64\amdmmcl.dll
2014-11-21 02:18:46 127488 ----a-w- C:\Windows\System32\mantle64.dll
2014-11-21 02:18:42 113664 ----a-w- C:\Windows\SysWow64\mantle32.dll
2014-11-21 02:18:36 5837312 ----a-w- C:\Windows\System32\amdmantle64.dll
2014-11-21 02:17:04 367104 ----a-w- C:\Windows\System32\atiapfxx.exe
2014-11-21 02:17:02 62464 ----a-w- C:\Windows\System32\aticalrt64.dll
2014-11-21 02:17:02 52224 ----a-w- C:\Windows\SysWow64\aticalrt.dll
2014-11-21 02:16:58 55808 ----a-w- C:\Windows\System32\aticalcl64.dll
2014-11-21 02:16:58 49152 ----a-w- C:\Windows\SysWow64\aticalcl.dll
2014-11-21 02:16:52 15716352 ----a-w- C:\Windows\System32\aticaldd64.dll
2014-11-21 02:16:04 14302208 ----a-w- C:\Windows\SysWow64\aticaldd.dll
2014-11-21 02:15:42 4590592 ----a-w- C:\Windows\SysWow64\amdmantle32.dll
2014-11-21 02:13:12 91648 ----a-w- C:\Windows\System32\mantleaxl64.dll
2014-11-21 02:13:10 85504 ----a-w- C:\Windows\SysWow64\mantleaxl32.dll
2014-11-21 02:12:50 442368 ----a-w- C:\Windows\System32\atidemgy.dll
2014-11-21 02:12:50 31232 ----a-w- C:\Windows\System32\atimuixx.dll
2014-11-21 02:12:48 774656 ----a-w- C:\Windows\System32\atieclxx.exe
2014-11-21 02:12:40 244736 ----a-w- C:\Windows\System32\atiesrxx.exe
2014-11-21 02:12:26 190976 ----a-w- C:\Windows\System32\atitmm64.dll
2014-11-21 02:10:02 843776 ----a-w- C:\Windows\System32\coinst_14.50.dll
2014-11-21 02:09:58 95744 ----a-w- C:\Windows\System32\amdave64.dll
2014-11-21 02:09:56 90112 ----a-w- C:\Windows\SysWow64\amdave32.dll
2014-11-21 02:09:46 89088 ----a-w- C:\Windows\System32\atisamu64.dll
2014-11-21 02:09:44 80896 ----a-w- C:\Windows\SysWow64\atisamu32.dll
2014-11-21 02:09:06 1214976 ----a-w- C:\Windows\System32\atiadlxx.dll
2014-11-21 02:09:04 903168 ----a-w- C:\Windows\SysWow64\atiadlxy.dll
2014-11-21 02:09:00 75264 ----a-w- C:\Windows\System32\atig6pxx.dll
2014-11-21 02:09:00 69632 ----a-w- C:\Windows\SysWow64\atiglpxx.dll
2014-11-21 02:09:00 69632 ----a-w- C:\Windows\System32\atiglpxx.dll
2014-11-21 02:08:58 146944 ----a-w- C:\Windows\System32\atig6txx.dll
2014-11-21 02:08:56 133632 ----a-w- C:\Windows\SysWow64\atigktxx.dll
2014-11-21 02:08:54 589312 ----a-w- C:\Windows\System32\drivers\atikmpag.sys
2014-11-21 02:08:54 43520 ----a-w- C:\Windows\System32\drivers\ati2erec.dll
2014-11-20 21:36:32 51200 ----a-w- C:\Windows\System32\kdbsdk64.dll
2014-11-20 21:35:00 38912 ----a-w- C:\Windows\SysWow64\kdbsdk32.dll
.
============= FINISH: 0:17:20.83 ===============

 

[Jacee]

Is this what you downloaded? 2015-01-18 21:39:42 -------- d-----w- C:\ProgramData\Call of Duty - Modern Warfare 3 (TeknoMW3) (Rip by X-NET)

Uninstall uTorrent ....

Next, I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[skrillek]

yeah but its not that its more likely assassins creed cos when i got the virus is was immediately after that
but yeah running test

 

[skrillek]

didnt find anything virus like

 

[Jacee]

If you don't show me the .txt logs I've asked for, then I can't help you. If you remove what the .text logs show... then you will be on your own. I'm sorry

Looks like you may have a real mess on your hands using pirate bay
Hosts: 199.59.62.24 thepiratebay.se

We don't support computers with 'prirated' software.

 

[skrillek]

Thats understandable ill just restore to a few weeks ago cheers for your help though!

 

[Jacee]

Just because I'm curious. Why did you disable your anti virus program?

because avast was deleting exe files

Most likely because the executable file contained malware/virus/Trojan...

 

[skrillek]

in most cases they don't depends who you go to but this one obviously did. what ya gonna do? haha

 

[skrillek]

Comodo boot time scan got it!