MrMurdstone
Thread Starter
- Joined
- Mar 7, 2012
- Messages
- 55
So, I randomly got a full-screen popup that said I was caught watching child porn and needed to pay money to the FBI to get my computer unlocked. I managed to exit it, but I want to get rid of this before it gets worse. I've also been getting rerouted to different websites from google and other stuff like that before this.
I would greatly appreciate any help I can get.
hijackthis log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:28:21 PM, on 1/7/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Kyle\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Createand] rundll32.exe "C:\Users\Kyle\AppData\Local\Create and edit Wired policies\createandedit.dll",wjbePhEQNQ
O4 - HKCU\..\Run: [AMD] RUNDLL32.EXE C:\Users\Kyle\AppData\Local\AMD\kwjorpbj.dll,ompd_get_fork_routine
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISCT Always Updated Agent (ISCTAgent) - Unknown owner - C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 9593 bytes
DDS:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.6.2
Run by Kyle at 16:28:42 on 2013-01-07
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8102.5990 [GMT -8:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [ASRockXTU] <no file>
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\Users\Kyle\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\Users\Kyle\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{B52C507F-1602-4220-BF53-EBE4DE6DFA59} : DHCPNameServer = 192.168.1.1
SSODL: WebCheck - <orphaned>
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
x64-Notify: igfxcui - igfxdev.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\mqc4bwx7.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 asahci64;asahci64;C:\Windows\System32\drivers\asahci64.sys [2011-9-21 49760]
R0 AsrRamDisk;AsrRamDisk;C:\Windows\System32\drivers\AsrRamDisk.sys [2012-8-20 31016]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-8-20 16152]
R1 AsrAppCharger;AsrAppCharger;C:\Windows\System32\drivers\AsrAppCharger.sys [2012-8-20 17192]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-8-20 239616]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-8-20 13592]
R2 ISCTAgent;ISCT Always Updated Agent;C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2012-2-9 133632]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-10-30 398184]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-8-20 682344]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-3-4 126952]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-3-4 390632]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-8-20 95760]
R3 ikbevent;Intel Upper keyboard Class Filter Driver;C:\Windows\System32\drivers\ikbevent.sys [2012-2-9 25536]
R3 imsevent;Intel Upper Mouse Class Filter Driver;C:\Windows\System32\drivers\imsevent.sys [2012-2-9 25536]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-8-20 331264]
R3 ISCT;Intel(R) Smart Connect Technology Device Driver;C:\Windows\System32\drivers\ISCTD64.sys [2012-2-9 44992]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-8-20 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-8-20 787736]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2011-5-9 425000]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2009-6-17 74256]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2009-6-17 13328]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-8-20 24176]
R3 MBfilt;MBfilt;C:\Windows\System32\drivers\MBfilt64.sys [2012-8-20 32344]
R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);C:\Windows\System32\drivers\WPRO_41_2001.sys [2012-8-20 34752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
S3 VaneFltr;Lachesis Mouse Driver;C:\Windows\System32\drivers\Lachesis.sys [2007-8-17 30336]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-8-20 1255736]
.
=============== Created Last 30 ================
.
2013-01-08 00:04:30 710504 ----a-w- C:\Windows\isRS-000.tmp
2013-01-08 00:04:17 -------- d-----w- C:\Users\Kyle\AppData\Local\Programs
2012-12-21 19:36:18 94656 ----a-w- C:\Windows\System32\WPRO_41_2001woem.tmp
2012-12-21 07:29:50 46080 ----a-w- C:\Windows\System32\atmlib.dll
2012-12-21 07:29:50 367616 ----a-w- C:\Windows\System32\atmfd.dll
2012-12-21 07:29:50 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-21 07:29:50 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-12 22:24:59 3149824 ----a-w- C:\Windows\System32\win32k.sys
2012-12-11 04:58:52 -------- d-----w- C:\Program Files (x86)\Ventrilo
2012-12-11 04:58:28 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2012-12-10 00:44:27 -------- d-----w- C:\Users\Kyle\AppData\Roaming\Mumble
2012-12-10 00:43:44 -------- d-----w- C:\Program Files (x86)\Mumble
.
==================== Find3M ====================
.
2013-01-08 00:05:40 34752 ----a-w- C:\Windows\System32\drivers\WPRO_41_2001.sys
2012-12-15 00:49:28 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-11-22 07:30:34 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2012-11-22 07:30:33 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2012-11-22 07:30:33 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2012-11-22 07:30:33 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-11-09 05:45:09 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-11-09 04:42:49 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll
.
============= FINISH: 16:28:53.67 ===============
DDS attach:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 8/20/2012 1:22:06 AM
System Uptime: 1/7/2013 4:05:22 PM (0 hours ago)
.
Motherboard: ASRock | | Z77 Extreme4
Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz | CPUSocket | 2482/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 931 GiB total, 729.12 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP43: 12/21/2012 5:00:24 PM - Installed DirectX
RP44: 12/29/2012 9:08:42 PM - Scheduled Checkpoint
RP45: 1/5/2013 10:21:22 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
AMD Accelerated Video Transcoding
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD Drag and Drop Transcoding
AMD Media Foundation Decoders
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Asmedia ASM104x USB 3.0 Host Controller Driver
Asmedia ASM106x SATA Host Controller Driver
ASRock App Charger v1.0.5
ASRock eXtreme Tuner v0.1.181
ASRock InstantBoot v1.29
ASRock XFast RAM v2.0.9
Bonjour
Broadcom NetLink Controller
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CDDRV_Installer
Dead Island
Diablo III
DiRT Showdown
Dota 2
erLT
Heroes of Newerth
Intel(R) OpenCL CPU Runtime
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Intel(R) Smart Connect Technology 2.0 x64
Intel(R) USB 3.0 eXtensible Host Controller Driver
iTunes
Java 7 Update 6
Java 7 Update 6 (64-bit)
Java Auto Updater
KhalInstallWrapper
Logitech SetPoint
Magic Online
Malwarebytes Anti-Malware version 1.70.0.1100
Microsoft .NET Framework 4 Client Profile
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Maintenance Service
Mumble 1.2.3
OpenAL
OpenOffice.org 3.4.1
PlanetSide 2
Rapture3D 2.4.11 Game
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Steam
SwiftKit
Team Fortress 2
TeamSpeak 3 Client
Trillian
Ventrilo Client
WinRAR 4.20 (64-bit)
World of Warcraft
.
==== Event Viewer Messages From Past Week ========
.
1/7/2013 4:06:40 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/4/2013 5:11:24 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
.
==== End Of File ===========================
GMER:
GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-07 18:49:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000DM rev.1AJ1 931.51GB
Running: gmer.exe; Driver: C:\Users\Kyle\AppData\Local\Temp\kxldqpow.sys
---- User code sections - GMER 2.0 ----
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000076d1548e 5 bytes JMP 0000000100080800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
---- Threads - GMER 2.0 ----
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2464] 00000000731862ee
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2664] 0000000077662e25
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2700] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2708] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2900] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2772] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2816] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2904] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2720] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3036] 000000006e2d28ad
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3040] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2968] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2964] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2856] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:1064] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:1280] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2040] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3464] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2868] 00000000380b5530
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4232] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4236] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4256] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4264] 000000007516d864
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4328] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4332] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4336] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4340] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4344] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4348] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4352] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4356] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4360] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4364] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4368] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4416] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4420] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4460] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4464] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4468] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4472] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4500] 000000006f54b420
Thread [3016:2808] 000000007383345e
Thread [3016:2764] 000000007383345e
Thread [3016:2768] 000000007383345e
Thread [3016:2740] 000000007383345e
Thread [3016:2736] 000000007383345e
Thread [3016:2748] 000000007383345e
Thread [3016:3024] 0000000077663e45
Thread [3016:3028] 0000000077662e25
Thread [3016:2776] 0000000034068190
Thread [3016:2792] 0000000077663e45
Thread [3016:3356] 000000006d68786a
Thread [3016:3364] 00000000731862ee
Thread [3016:3436] 0000000031014e30
Thread [3016:3444] 000000001601f3c0
Thread [3016:3448] 000000001601fc10
Thread [3016:3452] 0000000016035790
Thread [3016:3456] 00000000160338a0
Thread [3016:3460] 0000000016033bf0
Thread [3016:4012] 00000000735127c1
Thread [3016:4080] 0000000077663e45
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3248] 000007fef5afcc10
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3292] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3576] 000007fefefd0168
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3608] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3616] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3652] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3712] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3716] 000007fef5acf718
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3724] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3728] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3732] 000007fef59b143c
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3836] 000007fef5ff6050
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4572] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4804] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4832] 000007fef59bb564
---- Processes - GMER 2.0 ----
Library ? (*** suspicious ***) @ [3016] 0000000000400000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752] 000007feff320000
---- EOF - GMER 2.0 ----
I would greatly appreciate any help I can get.
hijackthis log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:28:21 PM, on 1/7/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16457)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Kyle\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Createand] rundll32.exe "C:\Users\Kyle\AppData\Local\Create and edit Wired policies\createandedit.dll",wjbePhEQNQ
O4 - HKCU\..\Run: [AMD] RUNDLL32.EXE C:\Users\Kyle\AppData\Local\AMD\kwjorpbj.dll,ompd_get_fork_routine
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISCT Always Updated Agent (ISCTAgent) - Unknown owner - C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 9593 bytes
DDS:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.6.2
Run by Kyle at 16:28:42 on 2013-01-07
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8102.5990 [GMT -8:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Windows\System32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Common Files\Steam\SteamService.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [ASRockXTU] <no file>
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\Users\Kyle\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
StartupFolder: C:\Users\Kyle\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{B52C507F-1602-4220-BF53-EBE4DE6DFA59} : DHCPNameServer = 192.168.1.1
SSODL: WebCheck - <orphaned>
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
x64-Notify: igfxcui - igfxdev.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kyle\AppData\Roaming\Mozilla\Firefox\Profiles\mqc4bwx7.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 asahci64;asahci64;C:\Windows\System32\drivers\asahci64.sys [2011-9-21 49760]
R0 AsrRamDisk;AsrRamDisk;C:\Windows\System32\drivers\AsrRamDisk.sys [2012-8-20 31016]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-8-20 16152]
R1 AsrAppCharger;AsrAppCharger;C:\Windows\System32\drivers\AsrAppCharger.sys [2012-8-20 17192]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-8-20 239616]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-8-20 13592]
R2 ISCTAgent;ISCT Always Updated Agent;C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2012-2-9 133632]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-10-30 398184]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-8-20 682344]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-3-4 126952]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-3-4 390632]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-8-20 95760]
R3 ikbevent;Intel Upper keyboard Class Filter Driver;C:\Windows\System32\drivers\ikbevent.sys [2012-2-9 25536]
R3 imsevent;Intel Upper Mouse Class Filter Driver;C:\Windows\System32\drivers\imsevent.sys [2012-2-9 25536]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-8-20 331264]
R3 ISCT;Intel(R) Smart Connect Technology Device Driver;C:\Windows\System32\drivers\ISCTD64.sys [2012-2-9 44992]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-8-20 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-8-20 787736]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2011-5-9 425000]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2009-6-17 74256]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2009-6-17 13328]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-8-20 24176]
R3 MBfilt;MBfilt;C:\Windows\System32\drivers\MBfilt64.sys [2012-8-20 32344]
R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);C:\Windows\System32\drivers\WPRO_41_2001.sys [2012-8-20 34752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
S3 VaneFltr;Lachesis Mouse Driver;C:\Windows\System32\drivers\Lachesis.sys [2007-8-17 30336]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-8-20 1255736]
.
=============== Created Last 30 ================
.
2013-01-08 00:04:30 710504 ----a-w- C:\Windows\isRS-000.tmp
2013-01-08 00:04:17 -------- d-----w- C:\Users\Kyle\AppData\Local\Programs
2012-12-21 19:36:18 94656 ----a-w- C:\Windows\System32\WPRO_41_2001woem.tmp
2012-12-21 07:29:50 46080 ----a-w- C:\Windows\System32\atmlib.dll
2012-12-21 07:29:50 367616 ----a-w- C:\Windows\System32\atmfd.dll
2012-12-21 07:29:50 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-21 07:29:50 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-12 22:24:59 3149824 ----a-w- C:\Windows\System32\win32k.sys
2012-12-11 04:58:52 -------- d-----w- C:\Program Files (x86)\Ventrilo
2012-12-11 04:58:28 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2012-12-10 00:44:27 -------- d-----w- C:\Users\Kyle\AppData\Roaming\Mumble
2012-12-10 00:43:44 -------- d-----w- C:\Program Files (x86)\Mumble
.
==================== Find3M ====================
.
2013-01-08 00:05:40 34752 ----a-w- C:\Windows\System32\drivers\WPRO_41_2001.sys
2012-12-15 00:49:28 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-11-22 07:30:34 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2012-11-22 07:30:33 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2012-11-22 07:30:33 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2012-11-22 07:30:33 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-11-09 05:45:09 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-11-09 04:42:49 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll
.
============= FINISH: 16:28:53.67 ===============
DDS attach:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 8/20/2012 1:22:06 AM
System Uptime: 1/7/2013 4:05:22 PM (0 hours ago)
.
Motherboard: ASRock | | Z77 Extreme4
Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz | CPUSocket | 2482/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 931 GiB total, 729.12 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP43: 12/21/2012 5:00:24 PM - Installed DirectX
RP44: 12/29/2012 9:08:42 PM - Scheduled Checkpoint
RP45: 1/5/2013 10:21:22 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
µTorrent
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
AMD Accelerated Video Transcoding
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD Drag and Drop Transcoding
AMD Media Foundation Decoders
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Asmedia ASM104x USB 3.0 Host Controller Driver
Asmedia ASM106x SATA Host Controller Driver
ASRock App Charger v1.0.5
ASRock eXtreme Tuner v0.1.181
ASRock InstantBoot v1.29
ASRock XFast RAM v2.0.9
Bonjour
Broadcom NetLink Controller
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CDDRV_Installer
Dead Island
Diablo III
DiRT Showdown
Dota 2
erLT
Heroes of Newerth
Intel(R) OpenCL CPU Runtime
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Intel(R) Smart Connect Technology 2.0 x64
Intel(R) USB 3.0 eXtensible Host Controller Driver
iTunes
Java 7 Update 6
Java 7 Update 6 (64-bit)
Java Auto Updater
KhalInstallWrapper
Logitech SetPoint
Magic Online
Malwarebytes Anti-Malware version 1.70.0.1100
Microsoft .NET Framework 4 Client Profile
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Maintenance Service
Mumble 1.2.3
OpenAL
OpenOffice.org 3.4.1
PlanetSide 2
Rapture3D 2.4.11 Game
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Steam
SwiftKit
Team Fortress 2
TeamSpeak 3 Client
Trillian
Ventrilo Client
WinRAR 4.20 (64-bit)
World of Warcraft
.
==== Event Viewer Messages From Past Week ========
.
1/7/2013 4:06:40 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/4/2013 5:11:24 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
.
==== End Of File ===========================
GMER:
GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-07 18:49:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000DM rev.1AJ1 931.51GB
Running: gmer.exe; Driver: C:\Users\Kyle\AppData\Local\Temp\kxldqpow.sys
---- User code sections - GMER 2.0 ----
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2924] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000076d1548e 5 bytes JMP 0000000100080800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074d51401 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074d51419 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074d51431 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074d5144a 2 bytes [D5, 74]
.text ... * 9
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074d514dd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074d514f5 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074d5150d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074d51525 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074d5153d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074d51555 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074d5156d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074d51585 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074d5159d 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074d515b5 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074d515cd 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074d516b2 2 bytes [D5, 74]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074d516bd 2 bytes [D5, 74]
---- Threads - GMER 2.0 ----
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2464] 00000000731862ee
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2664] 0000000077662e25
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2700] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2708] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2900] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2772] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2816] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2904] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2720] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3036] 000000006e2d28ad
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3040] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2968] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2964] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2856] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:1064] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:1280] 000000006daca510
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2040] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:3464] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:2868] 00000000380b5530
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4232] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4236] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4256] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4264] 000000007516d864
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4328] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4332] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4336] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4340] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4344] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4348] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4352] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4356] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4360] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4364] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4368] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4416] 0000000077663e45
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4420] 000000006f430540
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4460] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4464] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4468] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4472] 00000000301a81a4
Thread C:\Program Files (x86)\Steam\Steam.exe [2872:4500] 000000006f54b420
Thread [3016:2808] 000000007383345e
Thread [3016:2764] 000000007383345e
Thread [3016:2768] 000000007383345e
Thread [3016:2740] 000000007383345e
Thread [3016:2736] 000000007383345e
Thread [3016:2748] 000000007383345e
Thread [3016:3024] 0000000077663e45
Thread [3016:3028] 0000000077662e25
Thread [3016:2776] 0000000034068190
Thread [3016:2792] 0000000077663e45
Thread [3016:3356] 000000006d68786a
Thread [3016:3364] 00000000731862ee
Thread [3016:3436] 0000000031014e30
Thread [3016:3444] 000000001601f3c0
Thread [3016:3448] 000000001601fc10
Thread [3016:3452] 0000000016035790
Thread [3016:3456] 00000000160338a0
Thread [3016:3460] 0000000016033bf0
Thread [3016:4012] 00000000735127c1
Thread [3016:4080] 0000000077663e45
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3248] 000007fef5afcc10
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3292] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3576] 000007fefefd0168
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3608] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3616] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3652] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3712] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3716] 000007fef5acf718
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3724] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3728] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3732] 000007fef59b143c
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:3836] 000007fef5ff6050
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4572] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4804] 000007fef59bb564
Thread C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752:4832] 000007fef59bb564
---- Processes - GMER 2.0 ----
Library ? (*** suspicious ***) @ [3016] 0000000000400000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [1752] 000007feff320000
---- EOF - GMER 2.0 ----