Here's the first group of files. There are a total of 19.
Here's the first group of files. There are a total of 19.
Second group...
Third group...
Fourth group...
The only thng that was found as suspicious was RWAR3Monitor.exe (RoadWarrior 3 Monitor This file is not digitally signed.) and that was because it has an unsigned driver.
Rootkit scans we have run have not found anything.
Please download MBRCheck.exe to your Desktop. Run the application.
If no infection is found, it will produce a report on the desktop. Post that report in your next reply.
If an infection is found, you will be presented with the following dialog:
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.
Windows Insider MVP Consumer Security 2009 - 2017
Please do not PM me for Malware help, we all benefit from posting on the open board.
Here's the MBRCheck log:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Professional
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Precision M2800
Logical Drives Mask: 0x0100000c
Kernel Drivers (total 210):
0x03256000 \SystemRoot\system32\ntoskrnl.exe
0x0320D000 \SystemRoot\system32\hal.dll
0x00B97000 \SystemRoot\system32\kdcom.dll
0x00C6D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CBC000 \SystemRoot\system32\PSHED.dll
0x00CD0000 \SystemRoot\system32\CLFS.SYS
0x00D2E000 \SystemRoot\system32\CI.dll
0x00E51000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F13000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F23000 \SystemRoot\system32\drivers\ACPI.sys
0x00F7A000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00F83000 \SystemRoot\system32\drivers\msisadrv.sys
0x00F8D000 \SystemRoot\system32\drivers\pci.sys
0x00FC0000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00FCD000 \SystemRoot\system32\DRIVERS\iusb3hcs.sys
0x00FD7000 \SystemRoot\System32\drivers\partmgr.sys
0x00FEC000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E00000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E0C000 \SystemRoot\system32\drivers\volmgr.sys
0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E21000 \SystemRoot\System32\drivers\mountmgr.sys
0x0100A000 \SystemRoot\system32\drivers\iaStorA.sys
0x012D3000 \SystemRoot\system32\drivers\storport.sys
0x01337000 \SystemRoot\system32\drivers\amdxata.sys
0x01342000 \SystemRoot\system32\drivers\fltmgr.sys
0x0138E000 \SystemRoot\system32\drivers\fileinfo.sys
0x013A2000 \SystemRoot\System32\Drivers\DLACDBHE.SYS
0x013A5000 \SystemRoot\System32\Drivers\DRVECDB.SYS
0x013C2000 \SystemRoot\System32\Drivers\PxHlpa64.sys
0x0144B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x016AD000 \SystemRoot\System32\Drivers\msrpc.sys
0x0170B000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01726000 \SystemRoot\System32\Drivers\cng.sys
0x01798000 \SystemRoot\System32\drivers\pcw.sys
0x017A9000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0188D000 \SystemRoot\system32\drivers\ndis.sys
0x0197F000 \SystemRoot\system32\drivers\NETIO.SYS
0x01800000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01A01000 \SystemRoot\System32\drivers\tcpip.sys
0x0182C000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x017B3000 \SystemRoot\system32\drivers\volsnap.sys
0x01875000 \SystemRoot\system32\DRIVERS\stdcfltn.sys
0x0187E000 \SystemRoot\System32\Drivers\spldr.sys
0x01600000 \SystemRoot\System32\drivers\rdyboost.sys
0x019DF000 \SystemRoot\system32\DRIVERS\SEDFilter.sys
0x0163A000 \SystemRoot\System32\Drivers\mup.sys
0x019F5000 \SystemRoot\system32\drivers\iaStorF.sys
0x0164C000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01655000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0168F000 \SystemRoot\system32\drivers\disk.sys
0x01400000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x01430000 \SystemRoot\system32\DRIVERS\CredFltL.sys
0x0143C000 \SystemRoot\system32\DRIVERS\avgrkx64.sys
0x01C39000 \SystemRoot\system32\DRIVERS\avgloga.sys
0x01C88000 \SystemRoot\system32\DRIVERS\avgmfx64.sys
0x01CAA000 \SystemRoot\system32\DRIVERS\avgidsha.sys
0x01CDE000 \SystemRoot\system32\DRIVERS\amdkmpfd.sys
0x04754000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0477E000 \SystemRoot\System32\Drivers\Null.SYS
0x04787000 \SystemRoot\System32\Drivers\Beep.SYS
0x0478E000 \SystemRoot\System32\Drivers\DLARTL_E.SYS
0x04797000 \SystemRoot\System32\drivers\vga.sys
0x047A5000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x047CA000 \SystemRoot\System32\drivers\watchdog.sys
0x047DA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x047E3000 \SystemRoot\system32\drivers\rdpencdd.sys
0x047EC000 \SystemRoot\system32\drivers\rdprefmp.sys
0x047F5000 \SystemRoot\System32\Drivers\Msfs.SYS
0x04400000 \SystemRoot\System32\Drivers\Npfs.SYS
0x04411000 \SystemRoot\system32\DRIVERS\tdx.sys
0x04433000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x01D03000 \SystemRoot\system32\DRIVERS\avgtdia.sys
0x01D49000 \SystemRoot\System32\DRIVERS\netbt.sys
0x04828000 \SystemRoot\system32\drivers\afd.sys
0x048B1000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x048BC000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x048C5000 \SystemRoot\system32\DRIVERS\pacer.sys
0x048EB000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x04901000 \SystemRoot\system32\DRIVERS\netbios.sys
0x04910000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0492B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x0493F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04990000 \SystemRoot\system32\drivers\nsiproxy.sys
0x0499C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x049A7000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x049B3000 \SystemRoot\System32\drivers\discache.sys
0x04C4B000 \SystemRoot\system32\drivers\csc.sys
0x04CCE000 \SystemRoot\System32\Drivers\dfsc.sys
0x04CEC000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x04CFD000 \SystemRoot\system32\DRIVERS\avgldx64.sys
0x04D3D000 \SystemRoot\system32\DRIVERS\avgidsdrivera.sys
0x04D84000 \SystemRoot\system32\DRIVERS\avgdiska.sys
0x04DAD000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x04EED000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x0508C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x05181000 \SystemRoot\System32\drivers\dxgmms1.sys
0x0F444000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x05400000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x057B8000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04E00000 \SystemRoot\system32\DRIVERS\iusb3xhc.sys
0x057DC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x057DE000 \SystemRoot\system32\DRIVERS\TeeDriverx64.sys
0x05000000 \SystemRoot\system32\DRIVERS\e1d62x64.sys
0x101E7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04F8D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x05DC0000 \SystemRoot\system32\DRIVERS\O2FJ2w7x64.sys
0x05A00000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x05A2F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0F400000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x05E9A000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x05F2A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x05F39000 \SystemRoot\system32\DRIVERS\parport.sys
0x05F56000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x05F81000 \SystemRoot\system32\DRIVERS\ST_Accel.sys
0x05F97000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x05FAD000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x05FB6000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x05FBB000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x05E00000 \SystemRoot\system32\DRIVERS\usb3Hub.sys
0x05E37000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x05E4D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x05E71000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x05FCB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x05E7D000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0F40F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x051C7000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x05DF2000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x05E98000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04C00000 \SystemRoot\system32\DRIVERS\ks.sys
0x0F430000 \SystemRoot\system32\drivers\POADrvr.sys
0x051E1000 \SystemRoot\system32\drivers\DellProf.sys
0x0F43A000 \SystemRoot\system32\drivers\DDDriver64Dcsa.sys
0x051EC000 \SystemRoot\system32\DRIVERS\iwdbus.sys
0x0507A000 \SystemRoot\system32\DRIVERS\TGBMPEnum.sys
0x04FE4000 \SystemRoot\system32\DRIVERS\umbus.sys
0x01D8E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04EC5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x07957000 \SystemRoot\system32\DRIVERS\portcls.sys
0x07994000 \SystemRoot\system32\DRIVERS\drmk.sys
0x079B6000 \SystemRoot\system32\drivers\ksthunk.sys
0x07800000 \SystemRoot\system32\DRIVERS\iusb3hub.sys
0x07AFF000 \SystemRoot\system32\drivers\RTDVHD64.sys
0x07D32000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x07D4F000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x07D5D000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x07D76000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x07D7F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x07D8D000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x07D9A000 \SystemRoot\System32\Drivers\usbvideo.sys
0x07DC8000 \SystemRoot\system32\DRIVERS\ibtusb.sys
0x07E49000 \SystemRoot\system32\DRIVERS\btmhsf.sys
0x07FA9000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x07A00000 \SystemRoot\System32\Drivers\bthport.sys
0x07FC1000 \SystemRoot\System32\Drivers\cvusbdrv.sys
0x07FD2000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x07E00000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x07E10000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x07A8C000 \SystemRoot\system32\DRIVERS\btmaux.sys
0x07E30000 \SystemRoot\System32\Drivers\crashdmp.sys
0x07E3E000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x04440000 \SystemRoot\System32\Drivers\dump_iaStorA.sys
0x07AB3000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00040000 \SystemRoot\System32\win32k.sys
0x07AC6000 \SystemRoot\System32\drivers\Dxapi.sys
0x07AD2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00500000 \SystemRoot\System32\TSDDD.dll
0x00710000 \SystemRoot\System32\cdd.dll
0x0785F000 \SystemRoot\system32\drivers\luafv.sys
0x07AE0000 \SystemRoot\System32\Drivers\DRVEDDM.SYS
0x07E48000 \SystemRoot\System32\Drivers\DLADResE.SYS
0x07882000 \SystemRoot\System32\Drivers\DLAIFS_E.SYS
0x07AEE000 \SystemRoot\System32\Drivers\DLAOPIOE.SYS
0x07AF5000 \SystemRoot\System32\Drivers\DLAPoolE.SYS
0x078A5000 \SystemRoot\system32\drivers\WudfPf.sys
0x078BE000 \SystemRoot\System32\Drivers\DLABMFSE.SYS
0x078C8000 \SystemRoot\System32\Drivers\DLABOIOE.SYS
0x079BC000 \SystemRoot\System32\Drivers\DLAUDFAE.SYS
0x079DC000 \SystemRoot\System32\Drivers\DLAUDF_E.SYS
0x049C2000 \??\C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys
0x078D1000 \SystemRoot\system32\DRIVERS\WinUSB.sys
0x04709000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x04EDA000 \SystemRoot\System32\DRIVERS\scfilter.sys
0x04FF6000 \SystemRoot\System32\Drivers\wbfcvusbdrv.sys
0x04DD3000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x04A01000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04A54000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04A67000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x04A7F000 \SystemRoot\system32\drivers\HTTP.sys
0x04B48000 \SystemRoot\system32\DRIVERS\bowser.sys
0x04B66000 \SystemRoot\System32\drivers\mpsdrv.sys
0x04B7E000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x04BAB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x04800000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x0989F000 \SystemRoot\system32\drivers\peauth.sys
0x09945000 \SystemRoot\System32\Drivers\secdrv.SYS
0x09950000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09981000 \??\C:\Windows\system32\Drivers\SSPORT.sys
0x09989000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0999B000 \SystemRoot\SYSTEM32\DRIVERS\WibuKey64.sys
0x078EC000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0A883000 \SystemRoot\System32\DRIVERS\srv.sys
0x0A91B000 \??\C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys
0x0A92B000 \SystemRoot\System32\Drivers\fastfat.SYS
0x0B00A000 \SystemRoot\system32\drivers\mrxdav.sys
0x0B033000 \SystemRoot\system32\DRIVERS\Netwsw02.sys
0x0B392000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x0B39F000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x770F0000 \Windows\System32\ntdll.dll
0x47C70000 \Windows\System32\smss.exe
0xFF410000 \Windows\System32\apisetschema.dll
Processes (total 182):
0 System Idle Process
4 System
380 C:\Windows\System32\smss.exe
516 C:\PROGRA~2\AVG\AVG2015\avgrsa.exe
588 C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
620 csrss.exe
1088 C:\Windows\System32\wininit.exe
1124 csrss.exe
1160 C:\Windows\System32\services.exe
1168 C:\Windows\System32\lsass.exe
1176 C:\Windows\System32\lsm.exe
1260 C:\Windows\System32\winlogon.exe
1320 C:\Windows\System32\svchost.exe
1428 C:\Windows\System32\svchost.exe
1500 C:\Program Files\Dell\Dell Data Protection\Security Tools\Authentication\Bin\DpHostW.exe
1556 C:\Windows\System32\atiesrxx.exe
1596 C:\Windows\System32\svchost.exe
1636 C:\Windows\System32\svchost.exe
1676 C:\Windows\System32\svchost.exe
1708 C:\Windows\System32\svchost.exe
1768 DpCardEngine.exe
1868 C:\Windows\System32\svchost.exe
1988 C:\Windows\System32\igfxCUIService.exe
2036 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
1704 C:\Windows\System32\atieclxx.exe
2088 C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
2148 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
2160 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
2216 WUDFHost.exe
2372 WUDFHost.exe
2496 C:\Windows\System32\svchost.exe
2728 C:\Windows\System32\spoolsv.exe
2772 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
2804 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
2896 C:\Windows\System32\svchost.exe
2996 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
3024 C:\Program Files\DellTPad\HidMonitorSvc.exe
3044 C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
3068 C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
2260 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2452 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.Loader.exe
3152 C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebCaptureService.exe
3316 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
3432 C:\Windows\System32\svchost.exe
3516 C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
3716 C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
3732 C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
3708 C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe
3172 C:\Windows\System32\IPROSetMonitor.exe
2316 C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe
3988 C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe
2364 C:\Program Files (x86)\NetSetMan\nsmservice.exe
2356 C:\Program Files (x86)\Visioneer\OneTouch 4.0\OtService.exe
4104 C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe
4140 C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
4188 C:\Program Files\Dell\PPO\poaService.exe
4216 C:\Program Files\Dell\PPO\poaSmSrv.exe
4248 C:\Program Files\Dell\PPO\poaTaServ.exe
4272 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
4296 C:\Program Files\Visioneer\RWAR3\RWAR3HV_0002_0.EXE
4348 C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
4404 C:\Windows\System32\svchost.exe
4460 C:\Windows\SysWOW64\TgbStarter.exe
4508 C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
4564 C:\Program Files (x86)\Windows Network Accelerater\v3\winvxm.exe
4660 C:\Windows\System32\SearchIndexer.exe
4768 unsecapp.exe
4808 C:\Program Files (x86)\YouTube-Downloader\A4\youtubeserv.exe
4816 WmiPrvSE.exe
4852 unsecapp.exe
5000 C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
5048 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.exe
5124 WmiPrvSE.exe
5296 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.MgmtServer.exe
5444 C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
6000 C:\Windows\System32\svchost.exe
6632 C:\Windows\System32\taskhost.exe
6640 C:\Program Files\DellTPad\Apoint.exe
6776 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
6816 C:\Windows\System32\dwm.exe
6932 C:\Windows\explorer.exe
7028 C:\Program Files (x86)\EMC Captiva\Captiva Cloud Runtime\Emc.Captiva.WebToolkitHost.exe
4936 C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
6216 C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
4740 C:\Windows\System32\igfxHK.exe
6444 C:\Windows\System32\igfxTray.exe
6460 C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
6492 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
6408 C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
6524 C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
6352 C:\Program Files\Dell\PPO\DellPoaEvents.exe
6684 C:\Windows\System32\rundll32.exe
7132 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
6112 C:\Program Files\Dell\Dell Data Protection\Client Security Framework\Dell.SecurityManager.SystrayApp.exe
6184 C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtect64.exe
6656 C:\Windows\System32\rundll32.exe
6356 C:\Program Files\BOINC\boinctray.exe
7188 C:\Program Files\BOINC\boincmgr.exe
7252 C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
7316 C:\Program Files\Windows Sidebar\sidebar.exe
7456 C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
7476 C:\Program Files (x86)\WIBUKEY\Server\WkSvMgr.exe
7512 C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
7544 C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
7660 C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
7704 C:\Windows\System32\igfxEM.exe
7756 C:\Program Files\DellTPad\ApMsgFwd.exe
7860 C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe
7936 C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
8020 C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
8140 C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
7184 C:\Program Files (x86)\Nuance\PDF Professional 7\PdfPro7Hook.exe
7304 C:\Program Files (x86)\AVG\AVG2015\avgui.exe
7328 C:\Program Files\DellTPad\hidfind.exe
7344 C:\Program Files\DellTPad\ApntEx.exe
7392 C:\Windows\System32\conhost.exe
7496 C:\Program Files (x86)\Canon Electronics\P215II\TouchDR.exe
3240 C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
7748 C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
7592 C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
7812 C:\Windows\System32\wbem\unsecapp.exe
7784 C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
7712 C:\Program Files (x86)\NetSetMan\netsetman.exe
7600 C:\Windows\SysWOW64\ctfmon.exe
8572 C:\Program Files\BOINC\boinc.exe
8584 C:\Windows\System32\conhost.exe
8928 C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
8940 C:\Windows\System32\conhost.exe
9016 C:\Program Files\Windows Media Player\wmpnetwk.exe
9212 C:\Windows\System32\svchost.exe
9700 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
9748 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxRpcSs.exe
9848 C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SandboxDcomLaunch.exe
10164 C:\ProgramData\Invincea\Enterprise\Bin\x64\InvProtectAgent64.exe
236 C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
10532 C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe
10648 C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
10900 C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
10980 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
11136 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
4728 C:\Windows\System32\drivers\o2flash.exe
8060 C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
9000 C:\Windows\System32\wuauclt.exe
6376 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
6380 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
9380 C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
7776 C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
6472 WmiPrvSE.exe
6252 C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
5256 C:\Windows\System32\conhost.exe
10896 C:\Windows\System32\taskmgr.exe
9880 C:\Windows\System32\wlanext.exe
10288 C:\Windows\System32\conhost.exe
19260 C:\Windows\splwow64.exe
19672 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
18964 C:\Windows\System32\audiodg.exe
20284 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
20472 C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
20744 C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
27832 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
27072 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
28096 C:\ProgramData\BOINC\projects\http://www.enigmaathome.net\wrapper_...s_intelx86.exe
28608 C:\ProgramData\BOINC\projects\http://www.enigmaathome.net\wrapper_...s_intelx86.exe
26816 C:\ProgramData\BOINC\projects\milkyway.cs.rpi.edu_milkyway\milkyway_separation__modified_fit_1.36_windows_x86_64.exe
28020 C:\ProgramData\BOINC\projects\asteroidsathome.net_boinc\period_search_10210_windows_x86_64__sse2.exe
27744 C:\ProgramData\BOINC\projects\http://www.enigmaathome.net\wrapper_...s_intelx86.exe
28260 C:\ProgramData\BOINC\projects\http://www.enigmaathome.net\wrapper_...s_intelx86.exe
28512 C:\Windows\System32\conhost.exe
23464 C:\ProgramData\BOINC\slots\7\enigma_0.76.exe
28540 C:\ProgramData\BOINC\slots\0\enigma_0.76.exe
27140 C:\Windows\System32\conhost.exe
27008 C:\Windows\System32\conhost.exe
26752 C:\ProgramData\BOINC\slots\2\enigma_0.76.exe
27788 C:\ProgramData\BOINC\slots\8\enigma_0.76.exe
28328 C:\Windows\System32\conhost.exe
28312 C:\Windows\System32\conhost.exe
28032 C:\totalcmd\TOTALCMD.EXE
29676 dllhost.exe
29048 dllhost.exe
29384 C:\Users\Henry\Desktop\MBRCheck.exe
25104 C:\Windows\System32\conhost.exe
27508 C:\Windows\System32\dllhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`f1600000 (NTFS)
\\.\Y: --> \\.\PhysicalDrive0 at offset 0x00000000`02800000 (NTFS)
PhysicalDrive0 Model Number: ST1000LM014-1EJ164, Rev: DEMA
Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
Done!
The only thing that looked suspicious to me was
https://www.virustotal.com/en/file/b...1d05/analysis/
enigma_5.32_windows_intelx86.exe This file is not digitally signed. No suspicious behavior reported so far.
Bkav HW32.Laneul.kwqw <--detected by an unknown antivirus
that all looks fine with a non infected MBR now. If something had been found we would see
Unknown MBR code or MBR Code Faked!
We have run other rootkit and trojan scans that are clear.
I think we'll have to wait this one out for a while and see if anything should pop up or start showing alerts cause, I can't find anything.
Last edited by Juliet; 2015-03-04 at 23:16.
Windows Insider MVP Consumer Security 2009 - 2017
Please do not PM me for Malware help, we all benefit from posting on the open board.
Originally Posted by Juliet
The Enigma_5.32 file is known safe, I have it running on several computers. It's part of the BOINC (Berkley Open Infrastructure for Network Computing) science projects. This particular one is crunching one of the last 3 unbroken German Enigma code messages from World War II.
And I'm almost thinking that I might have seen something useful, I just need to verify if I'm correct. I upgraded an installed program, and in the process it's upgrade link (Known safe website) opened my 'default' browser, Internet Explorer. Keep in mind that for the past 4 months, I've set Firefox as my default browser about 200 or 300 times, each time I boot my laptop and open Firefox. And, I have told Internet Explorer *not* to set as default, probably 10 to 150 times so far.
Anyway, while performing the upgrade, with IE open for about 30 minutes, I had no rogue processes. However, when I opened Firefox to check my email, I had the rogue processes within just a couple of minutes. So... did I actually see something, or did I mis-interpret what I was seeing?
I also need to figure out the differences between my choices of Internet Explorer. I have 3 options available; 1- the standard Internet Explorer, 2- Internet Explorer (No Add-ons) [yes, that's the selection under All Programs, Accessories, System Tools], and 3- Dell Protected Workspace, which uses Internet Explorer. I'm almost thinking that the IE session that was opened was under Dell Protected Workspace, because, if I remember correctly, the window had a green border. The green border is the Dell PWS visual indicator.
I'll have to experiment for a bit, and hopefully I can come up with something that might help explain what's going on.
Also, just for grins and giggles, I was thinking about making a list of all Iexplore.exe files on my system, with file size and file date, and checking to see if any of them match known file forgeries.
This may help.....
Dell Protected Workspace. I am not familiar with this, to me it suggest an added secure browser.
I know people use IE 'No Add-ons' to troubleshoot, and had thought of using it to see if that was what was causing issues here but, no malicious Add-ons were found.
Also, from what you've posted about changes for default browser not holding, might be related to security settings such as SpyBot Teatimer but, settings in other security tools can do the same.
~~~~~~~~~~~~~~
Let's try to make system changes to make Firefox your default browser.
Click on the Windows logo to open the Start menu, then select Control Panel. The Control Panel window will open.
Click on the link labeled Programs. The Programs panel will open.
Click on the link labeled Set your default programs. The Set your default programs panel will open.
In the Programs list on the left side of the window, click Firefox.
In the right side of the window, click Set this program as default.
~~~~~~
From the screen capture it shows using Flash from a temp directorey and we can take care of that now.
Please Run TFC by OldTimer to clear temporary files:
TFC by OldTimer and save it to your desktop.
Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.
~~~~~
We need to check which version of Flash player your using and make sure it's up to date.
Please run this security check for my review.
Download Security Check by screen317 from here.
- Save it to your Desktop.
- Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Windows Insider MVP Consumer Security 2009 - 2017
Please do not PM me for Malware help, we all benefit from posting on the open board.
Posting Permissions
