For the past week I've been dealing with internet redirects, ping.exe using 100% system resources and making my computer run at dangerously high temperatures, as well as the PUP.Bitminer found in the malwarebytes full search that won't go away (like many posting here recently, apparently!). I've read a considerable amount on these issues and have tried everything I know, but I can't get them resolved with any anti-virus software I know of. Any help you can offer would be greatly appreciated!! Below are the DDS logs.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514
Run by pbrucea at 14:05:06 on 2011-12-20
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4061.3207 [GMT -6:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\FBAgent.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
dRunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f
dRunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{3B3445EC-A397-4336-90D5-3E59DD556A82} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{3B3445EC-A397-4336-90D5-3E59DD556A82}\75869647564596765627D27657563747 : DhcpNameServer = 76.85.229.110 76.85.229.111 192.168.33.1
TCP: Interfaces\{6A97EAA0-6FF2-495C-8416-5A755F14911A} : DhcpNameServer = 129.93.5.53 129.93.6.189
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Hosts: 216.240.133.193 www.google-analytics.com.
Hosts: 216.240.133.193 ad-emea.doubleclick.net.
Hosts: 216.240.133.193 www.statcounter.com.
Hosts: 69.72.252.254 www.google-analytics.com.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\pbrucea\AppData\Roaming\Mozilla\Firefox\Profiles\t13jjwt9.default\
FF - prefs.js: browser.search.selectedEngine - Search the Web
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/?rlz=1V1IPYX
.
============= SERVICES / DRIVERS ===============
.
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]
R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2010-2-8 14904]
R2 IMFservice;IMF Service;C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2011-12-19 820568]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 NETw1v64;Intel® Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\NETw1v64.sys --> C:\Windows\system32\DRIVERS\NETw1v64.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]
S3 RegFilter;RegFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\RegFilter.sys [2011-12-19 33184]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 UrlFilter;UrlFilter;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\UrlFilter.sys [2011-12-19 21872]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 FileMonitor;FileMonitor;C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [2011-12-19 20336]
.
=============== Created Last 30 ================
.
2011-12-19 21:30:37 -------- d-sh--w- C:\$RECYCLE.BIN
2011-12-19 19:33:59 518144 ----a-w- C:\Windows\SWREG.exe
2011-12-19 19:33:59 256000 ----a-w- C:\Windows\PEV.exe
2011-12-19 19:16:00 -------- d-----w- C:\Program Files\iTunes
2011-12-19 19:16:00 -------- d-----w- C:\Program Files\iPod
2011-12-19 19:16:00 -------- d-----w- C:\Program Files (x86)\iTunes
2011-12-19 18:59:17 750488 ----a-w- C:\Windows\System32\npdeployJava1.dll
2011-12-19 18:56:04 -------- d-----w- C:\Program Files (x86)\SpeedFan
2011-12-19 18:14:53 -------- d-----w- C:\Users\pbrucea\AppData\Local\Seven Zip
2011-12-19 15:59:17 99840 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HPZPPLHN.DLL
2011-12-19 06:26:59 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\IObit
2011-12-19 06:21:07 -------- d-----w- C:\ProgramData\IObit
2011-12-19 06:21:04 -------- d-----w- C:\Program Files (x86)\IObit
2011-12-19 05:33:44 -------- d-----w- C:\Program Files (x86)\FileHippo.com
2011-12-19 05:09:33 -------- d-----w- C:\Program Files\CCleaner
2011-12-19 03:19:56 -------- d-----w- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2011-12-19 03:15:48 -------- d-----w- C:\Users\pbrucea\AppData\Local\PackageAware
2011-12-15 13:57:18 -------- d-----w- C:\Program Files\Microsoft Security Client
2011-12-14 22:34:59 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-12-14 22:34:59 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-12-14 22:34:35 3145216 ----a-w- C:\Windows\System32\win32k.sys
2011-12-14 22:34:33 723456 ----a-w- C:\Windows\System32\EncDec.dll
2011-12-14 22:34:33 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-12-14 22:34:28 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-12-14 22:34:28 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-12-12 01:19:19 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\EeeStorageUploader
2011-12-12 01:19:10 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\ASUS WebStorage
2011-12-11 15:20:12 -------- d-----w- C:\Program Files\SystemRequirementsLab
2011-12-11 15:02:48 -------- d-----w- C:\Users\pbrucea\AppData\Local\Sunbelt Software
2011-12-08 03:26:02 -------- d-----w- C:\Program Files (x86)\Toolbar Cleaner
2011-12-07 03:03:34 660368 ----a-w- C:\Windows\System32\deployJava1.dll
2011-12-07 02:40:28 -------- d-----w- C:\Program Files\ESET
2011-12-06 20:23:21 -------- d-----w- C:\Program Files (x86)\ESET
2011-12-06 18:00:18 118784 ----a-w- C:\Windows\SysWow64\MSSTDFMT.DLL
2011-12-06 02:02:45 234536 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2011-12-04 22:31:01 -------- d-----w- C:\Program Files (x86)\Steam
2011-12-04 22:31:01 -------- d-----w- C:\Program Files (x86)\Common Files\Steam
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2011-12-03 16:21:35 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2011-12-01 21:26:24 21712 ----a-w- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
2011-12-01 21:26:24 -------- d-----w- C:\Users\pbrucea\AppData\Local\eSupport.com
2011-11-29 12:53:34 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B347379D-6B93-4EC6-8137-4E35BF71D246}\mpengine.dll
2011-11-23 04:15:17 98816 ----a-w- C:\Windows\sed.exe
2011-11-23 04:15:17 208896 ----a-w- C:\Windows\MBR.exe
2011-11-22 17:59:40 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-11-22 17:01:32 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\SUPERAntiSpyware.com
2011-11-22 17:01:14 -------- d-----w- C:\ProgramData\!SASCORE
2011-11-22 17:01:11 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2011-11-22 17:01:11 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2011-11-22 15:00:29 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\F08BF
2011-11-22 14:59:54 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\8ECF0
2011-11-22 14:59:45 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\VQQQdKRTT
2011-11-22 14:59:45 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\KUUClzNNyxAuv2o
2011-11-22 14:59:29 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\z77ddELL8g
2011-11-22 14:59:28 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\ZNNttxP0ucS1b3n
2011-11-22 14:59:28 -------- d-----w- C:\Users\pbrucea\AppData\Roaming\hsWWJJ7fEL8T
.
==================== Find3M ====================
.
2011-12-07 03:10:34 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-05 05:41:43 1188864 ----a-w- C:\Windows\System32\wininet.dll
2011-11-05 04:35:00 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-10-26 05:21:20 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2011-10-24 20:29:02 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2011-10-24 20:29:02 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 14:05:57.19 ===============
Attached File(s)
-
DDS.txt (14.02K)
Number of downloads: 0 -
Attach.zip (4.08K)
Number of downloads: 0

Help
This topic is locked

Back to top










