Results 1 to 10 of 10

Thread: file format 8488

  1. #1
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    hi guy.. all my video format avi cannot be open anymore. All those video has been changed to format video 8488. How i can remove this malware from my PC. i have re-format my PC but my video still cannot be open and still in format 8488. Here i attach file picture. tq

    here is the log your require.tq

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-11-2016
    Ran by admin (administrator) on ADMIN-PC (27-11-2016 14:40:14)
    Running from H:\driver
    Loaded Profiles: admin (Available Profiles: admin)
    Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 8 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgfwsa.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
    (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
    () C:\ProgramData\DatacardService\DCService.exe
    (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
    (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
    (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    (Solvusoft Corporation) C:\Program Files (x86)\Solvusoft\Tray\SolvusoftTray.exe
    (Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
    (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
    (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe


    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
    HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
    HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2862928 2012-07-29] (ELAN Microelectronics Corp.)
    HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
    HKLM\...\Run: [CommonToolkitTray_Solvusoft] => C:\Program Files (x86)\Solvusoft\Tray\SolvusoftTray.exe [1686088 2015-09-24] (Solvusoft Corporation)
    HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
    HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [218896 2016-09-13] (AVG Technologies CZ, s.r.o.)
    HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [218896 2016-09-13] (AVG Technologies CZ, s.r.o.)
    HKU\S-1-5-21-1642817827-2581930201-3280809290-1000\...\MountPoints2: {d433c95c-b3f2-11e6-9576-ee0fe25c2308} - F:\AutoRun.exe
    HKU\S-1-5-21-1642817827-2581930201-3280809290-1000\...\MountPoints2: {d433c96c-b3f2-11e6-9576-ee0fe25c2308} - F:\AutoRun.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\..\Interfaces\{588152B2-A537-481D-9EDD-98B76CF5F16B}: [NameServer] 203.82.64.161 203.82.64.129

    Internet Explorer:
    ==================
    HKU\S-1-5-21-1642817827-2581930201-3280809290-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com.my/
    HKU\S-1-5-21-1642817827-2581930201-3280809290-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-my/?ocid=iehp
    Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
    Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
    Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
    Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

    FireFox:
    ========
    FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2011-06-05] (NVIDIA Corporation)
    FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2011-06-05] (NVIDIA Corporation)

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [647864 2016-10-13] (AVG Technologies CZ, s.r.o.)
    R2 avgfws; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2050040 2016-10-13] (AVG Technologies CZ, s.r.o.)
    R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5332384 2016-10-13] (AVG Technologies CZ, s.r.o.)
    R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1149712 2016-09-13] (AVG Technologies CZ, s.r.o.)
    R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [727512 2016-10-13] (AVG Technologies CZ, s.r.o.)
    R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] () [File not signed]
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 athr; C:\Windows\System32\DRIVERS\athrx.sys [1594368 2010-03-02] (Atheros Communications, Inc.) [File not signed]
    R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.)
    R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [73480 2016-06-06] (AVG Technologies CZ, s.r.o.)
    R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [311552 2016-09-22] (AVG Technologies CZ, s.r.o.)
    R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [272640 2016-07-27] (AVG Technologies CZ, s.r.o.)
    R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [265472 2016-09-20] (AVG Technologies CZ, s.r.o.)
    R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)
    R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [254208 2016-09-26] (AVG Technologies CZ, s.r.o.)
    R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.)
    R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [299264 2016-07-27] (AVG Technologies CZ, s.r.o.)
    R0 avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [77056 2016-06-20] (AVG Technologies CZ, s.r.o.)
    S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    U3 aswMBR; \??\C:\Users\admin\AppData\Local\Temp\aswMBR.sys [X]
    U3 aswVmm; \??\C:\Users\admin\AppData\Local\Temp\aswVmm.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-11-27 14:40 - 2016-11-27 14:40 - 00000000 ____D C:\FRST
    2016-11-27 14:35 - 2016-11-27 14:35 - 00001948 _____ C:\Users\admin\Documents\aswMBR.txt
    2016-11-27 14:35 - 2016-11-27 14:35 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
    2016-11-27 14:35 - 2016-11-27 14:35 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
    2016-11-27 14:35 - 2016-11-27 14:35 - 00000512 _____ C:\Users\admin\Documents\MBR.dat
    2016-11-27 14:34 - 2016-11-27 14:34 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
    2016-11-27 14:31 - 2016-11-26 22:40 - 00000000 ____D C:\Windows\Panther
    2016-11-27 14:25 - 2016-11-26 22:45 - 00000000 ____D C:\Windows.old.000
    2016-11-27 14:06 - 2010-03-02 16:45 - 01594368 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\athrx.sys
    2016-11-27 12:27 - 2016-11-27 12:27 - 684680303 _____ C:\Windows\MEMORY.DMP
    2016-11-27 12:27 - 2016-11-27 12:27 - 00293864 _____ C:\Windows\Minidump\112716-50934-01.dmp
    2016-11-27 12:27 - 2016-11-27 12:27 - 00000000 ____D C:\Windows\Minidump
    2016-11-27 12:24 - 2016-11-27 12:24 - 00000000 ____D C:\Program Files\DIFX
    2016-11-27 11:57 - 2016-11-27 11:57 - 00001224 _____ C:\Users\admin\Documents\virus.csv
    2016-11-27 11:41 - 2016-11-27 11:41 - 00000000 ____D C:\Users\admin\AppData\Roaming\AVG
    2016-11-27 11:40 - 2016-11-27 11:40 - 00000948 _____ C:\Users\Public\Desktop\AVG Protection.lnk
    2016-11-27 11:40 - 2016-11-27 11:40 - 00000000 ____D C:\Users\admin\AppData\Roaming\TuneUp Software
    2016-11-27 11:40 - 2016-11-27 11:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
    2016-11-27 11:40 - 2016-11-27 11:40 - 00000000 ____D C:\Program Files\Common Files\AV
    2016-11-27 11:39 - 2016-11-27 14:36 - 00000000 ____D C:\ProgramData\MFAData
    2016-11-27 11:39 - 2016-11-27 11:39 - 00000000 ___HD C:\$AVG
    2016-11-27 11:39 - 2016-11-27 11:39 - 00000000 ____D C:\Users\admin\AppData\Local\MFAData
    2016-11-27 11:38 - 2016-11-27 11:41 - 00000000 ____D C:\Users\admin\AppData\Local\Avg
    2016-11-27 11:38 - 2016-11-27 11:39 - 00000000 ____D C:\Users\admin\AppData\Local\AvgSetupLog
    2016-11-27 11:38 - 2016-11-27 11:39 - 00000000 ____D C:\ProgramData\Avg
    2016-11-27 11:38 - 2016-11-27 11:39 - 00000000 ____D C:\Program Files (x86)\AVG
    2016-11-27 11:38 - 2016-11-27 11:38 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
    2016-11-27 10:03 - 2016-11-27 14:36 - 00000368 _____ C:\Windows\Tasks\WinThruster64-admin-Startup.job
    2016-11-27 10:03 - 2016-11-27 14:33 - 00000376 _____ C:\Windows\Tasks\WinThruster64-admin-Notification.job
    2016-11-27 10:03 - 2016-11-27 10:03 - 00003440 _____ C:\Windows\System32\Tasks\WinThruster64-admin-Notification
    2016-11-27 10:03 - 2016-11-27 10:03 - 00002748 _____ C:\Windows\System32\Tasks\WinThruster64-admin-Startup
    2016-11-27 10:03 - 2016-11-27 10:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Solvusoft
    2016-11-27 10:02 - 2016-11-27 10:02 - 00002061 _____ C:\Users\Public\Desktop\WinThruster.lnk
    2016-11-27 10:02 - 2016-11-27 10:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solvusoft
    2016-11-27 10:02 - 2016-11-27 10:02 - 00000000 ____D C:\Program Files\Solvusoft
    2016-11-27 10:02 - 2016-11-27 10:02 - 00000000 ____D C:\Program Files (x86)\Solvusoft
    2016-11-27 10:00 - 2016-11-27 10:02 - 00000000 ___HD C:\ProgramData\{B96EB44A-7860-4F13-BC9A-0A73CA5F11C2}
    2016-11-27 10:00 - 2016-11-27 10:02 - 00000000 ____D C:\ProgramData\Solvusoft
    2016-11-27 10:00 - 2016-11-27 10:00 - 08932000 _____ (Solvusoft Corporation ) C:\Users\admin\Downloads\Setup_WinThruster_2016.exe
    2016-11-27 10:00 - 2016-11-27 10:00 - 00000000 ____D C:\Users\admin\AppData\Local\IIIQF
    2016-11-27 09:49 - 2016-11-27 09:49 - 00000000 ____D C:\Users\admin\AppData\Roaming\Intel
    2016-11-27 09:49 - 2016-11-27 09:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
    2016-11-27 09:49 - 2016-11-27 09:49 - 00000000 ____D C:\ProgramData\Intel
    2016-11-27 09:49 - 2016-11-27 09:49 - 00000000 ____D C:\Program Files\Common Files\Intel
    2016-11-27 09:49 - 2016-11-27 09:49 - 00000000 ____D C:\Program Files (x86)\Cisco
    2016-11-27 09:22 - 2016-11-27 09:22 - 00002039 _____ C:\Users\admin\Desktop\QQPlayer.lnk
    2016-11-27 09:22 - 2016-11-27 09:22 - 00000030 _____ C:\Windows\QQPlayer.INI
    2016-11-27 09:22 - 2016-11-27 09:22 - 00000000 ____D C:\Users\admin\AppData\Roaming\Tencent
    2016-11-27 09:22 - 2016-11-27 09:22 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tencent
    2016-11-27 09:22 - 2016-11-27 09:22 - 00000000 ____D C:\Program Files (x86)\Tencent
    2016-11-27 09:18 - 2016-11-27 09:18 - 00000000 ____D C:\Users\admin\Desktop\V1.1.0.0157_Win7_64
    2016-11-27 09:14 - 2016-11-27 09:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
    2016-11-27 09:11 - 2016-11-27 14:33 - 00000000 ____D C:\ProgramData\NVIDIA
    2016-11-27 09:11 - 2016-11-27 09:11 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
    2016-11-27 09:10 - 2016-11-27 09:11 - 00000000 ____D C:\Program Files\NVIDIA Corporation
    2016-11-27 09:10 - 2016-11-27 09:10 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
    2016-11-27 09:10 - 2011-06-05 07:22 - 20465256 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 18580072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 15051368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 13076328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
    2016-11-27 09:10 - 2011-06-05 07:22 - 13011560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 12842600 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 10061416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 08106088 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 06597736 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 06029928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 04936808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 03182184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 02954856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 02871400 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 02579560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 02207336 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 01970280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 01626728 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6420141.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 01394280 _____ (NVIDIA Corporation) C:\Windows\system32\nvgenco642061.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 00067176 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 00057960 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
    2016-11-27 09:10 - 2011-06-05 07:22 - 00011240 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvBridge.kmd
    2016-11-27 09:10 - 2011-06-05 07:22 - 00007621 _____ C:\Windows\system32\nvinfo.pb
    2016-11-27 09:10 - 2011-05-10 02:41 - 01426536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco642040.dll
    2016-11-27 09:10 - 2011-05-10 02:41 - 00174184 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
    2016-11-27 09:10 - 2011-05-10 02:41 - 00029288 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
    2016-11-27 09:08 - 2016-11-27 09:08 - 00000000 ____D C:\Program Files (x86)\ASM104xUSB3
    2016-11-27 09:04 - 2016-11-27 09:04 - 00000000 ____D C:\Program Files\Elantech
    2016-11-27 09:04 - 2012-07-29 21:12 - 00309584 _____ (ELAN Microelectronics Corp.) C:\Windows\system32\Drivers\ETD.sys
    2016-11-27 09:00 - 2010-09-22 01:59 - 00056344 _____ (Intel Corporation) C:\Windows\system32\Drivers\HECIx64.sys
    2016-11-27 08:59 - 2011-01-13 19:58 - 00413800 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
    2016-11-27 08:59 - 2011-01-13 19:58 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
    2016-11-27 08:59 - 2011-01-13 19:58 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
    2016-11-27 08:56 - 2016-11-27 08:56 - 00000000 ____D C:\Program Files (x86)\Intel
    2016-11-27 08:56 - 2016-11-27 08:56 - 00000000 ____D C:\Intel
    2016-11-27 08:56 - 2010-10-04 13:02 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
    2016-11-27 08:54 - 2016-11-27 08:54 - 00000000 ____D C:\Windows\SysWOW64\sda
    2016-11-27 08:54 - 2011-03-15 18:09 - 09888360 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsUVStoricon.dll
    2016-11-27 08:54 - 2011-03-15 18:09 - 00311400 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\rtsuvstor.sys
    2016-11-27 08:54 - 2010-11-11 14:14 - 00017512 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\diskperf64.sys
    2016-11-27 08:52 - 2016-11-27 09:49 - 00000000 ____D C:\Program Files\Intel
    2016-11-27 08:52 - 2016-11-27 08:52 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_AMPPAL_01009.Wdf
    2016-11-27 08:49 - 2016-11-27 08:59 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
    2016-11-27 08:49 - 2016-11-27 08:59 - 00000000 ____D C:\Program Files (x86)\Realtek
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\Users\admin\AppData\Local\Downloaded Installations
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\ProgramData\SonicFocus
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virage Logic, Corp
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\Program Files\Realtek
    2016-11-27 08:49 - 2016-11-27 08:49 - 00000000 ____D C:\Program Files (x86)\ASUS
    2016-11-27 08:49 - 2011-08-16 18:46 - 03056360 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
    2016-11-27 08:49 - 2011-08-16 16:57 - 01501696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
    2016-11-27 08:49 - 2011-08-16 14:43 - 03200104 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
    2016-11-27 08:49 - 2011-08-16 14:43 - 02518120 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
    2016-11-27 08:49 - 2011-08-15 16:47 - 00093800 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInst64.dll
    2016-11-27 08:49 - 2011-07-29 14:46 - 01827944 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
    2016-11-27 08:49 - 2011-07-28 00:55 - 02604376 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
    2016-11-27 08:49 - 2011-07-28 00:55 - 02132824 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
    2016-11-27 08:49 - 2011-07-22 19:35 - 01247848 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
    2016-11-27 08:49 - 2011-06-30 16:14 - 01560168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
    2016-11-27 08:49 - 2011-05-31 09:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
    2016-11-27 08:49 - 2011-05-31 09:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
    2016-11-27 08:49 - 2011-05-05 15:24 - 02085440 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
    2016-11-27 08:49 - 2011-05-05 14:15 - 00220512 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
    2016-11-27 08:49 - 2011-05-05 14:14 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
    2016-11-27 08:49 - 2011-05-05 14:14 - 00078176 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
    2016-11-27 08:49 - 2010-11-08 07:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
    2016-11-27 08:49 - 2010-11-03 18:31 - 00332392 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
    2016-11-27 08:49 - 2010-11-03 18:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
    2016-11-27 08:49 - 2010-09-27 09:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
    2016-11-27 08:49 - 2010-07-22 16:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
    2016-11-27 08:49 - 2010-07-22 16:37 - 00200800 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
    2016-11-27 08:49 - 2010-07-11 21:28 - 00180048 _____ (Sonic Focus, Inc.) C:\Windows\system32\SFProc64.dll
    2016-11-27 08:49 - 2010-07-11 21:28 - 00086352 _____ (Sonic Focus, Inc.) C:\Windows\system32\SFComm64.dll
    2016-11-27 08:49 - 2010-07-11 21:28 - 00083792 _____ (Sonic Focus, Inc.) C:\Windows\system32\SFSAPO64.dll
    2016-11-27 08:49 - 2010-07-11 21:28 - 00082768 _____ (Sonic Focus, Inc.) C:\Windows\system32\SFHAPO64.dll
    2016-11-27 08:49 - 2010-07-11 21:28 - 00082768 _____ (Sonic Focus, Inc.) C:\Windows\system32\SFDAPO64.dll
    2016-11-27 08:49 - 2009-11-24 09:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
    2016-11-27 08:49 - 2009-11-24 09:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
    2016-11-27 08:49 - 2009-11-24 09:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
    2016-11-27 08:49 - 2009-11-24 09:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
    2016-11-27 08:49 - 2009-11-17 18:12 - 00108960 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
    2016-11-27 08:48 - 2016-11-27 08:49 - 00000000 ___HD C:\Program Files (x86)\Temp
    2016-11-27 08:48 - 2011-07-11 14:17 - 01698408 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
    2016-11-27 08:44 - 2016-11-27 08:44 - 00000000 ____D C:\Users\admin\AppData\Roaming\WinRAR
    2016-11-27 08:44 - 2016-11-27 08:44 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    2016-11-27 08:44 - 2016-11-27 08:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    2016-11-27 08:44 - 2016-11-27 08:44 - 00000000 ____D C:\Program Files\WinRAR
    2016-11-27 08:43 - 2016-11-27 08:43 - 00000000 ____D C:\Users\admin\Documents\winrar
    2016-11-27 08:38 - 2016-11-27 08:38 - 00000000 ____D C:\Windows.old
    2016-11-27 07:59 - 2016-11-27 14:31 - 00008192 __RSH C:\BOOTSECT.BAK
    2016-11-27 07:59 - 2010-11-21 11:23 - 00383786 __RSH C:\bootmgr
    2016-11-27 02:40 - 2016-11-27 02:40 - 00000000 ____D C:\Users\admin\AppData\Roaming\Curiolab
    2016-11-27 01:24 - 2016-11-27 09:17 - 00000000 ____D C:\Program Files (x86)\Exterminate It!
    2016-11-27 01:24 - 2016-11-27 01:24 - 15637544 _____ (CURIOLAB S.M.B.A.) C:\Users\admin\Downloads\ExterminateItSetup.exe
    2016-11-27 01:24 - 2016-11-27 01:24 - 00001107 _____ C:\Users\Public\Desktop\Exterminate It!.lnk
    2016-11-27 01:24 - 2016-11-27 01:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exterminate It!
    2016-11-27 00:13 - 2016-11-27 00:12 - 00002362 _____ C:\Users\admin\Downloads\index2.swf
    2016-11-27 00:12 - 2016-11-27 09:17 - 00059584 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
    2016-11-27 00:12 - 2016-11-27 00:12 - 00001247 _____ C:\Users\Public\Desktop\Celcom Broadband Manager.lnk
    2016-11-27 00:12 - 2016-11-27 00:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Celcom Broadband Manager
    2016-11-27 00:11 - 2016-11-27 00:12 - 00000000 ____D C:\ProgramData\DatacardService
    2016-11-27 00:11 - 2016-11-27 00:12 - 00000000 ____D C:\Program Files (x86)\Celcom Broadband Manager
    2016-11-27 00:11 - 2016-11-27 00:11 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_ew_jubusenum_01009.Wdf
    2016-11-27 00:11 - 2010-09-03 17:36 - 00196608 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juwwanecm.sys
    2016-11-27 00:11 - 2010-09-03 17:35 - 00030208 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juextctrl.sys
    2016-11-27 00:11 - 2010-08-31 18:09 - 00256000 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbnet.sys
    2016-11-27 00:11 - 2010-08-24 22:53 - 00091648 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcacm.sys
    2016-11-27 00:11 - 2010-08-07 17:49 - 00121600 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
    2016-11-27 00:11 - 2010-07-27 15:26 - 00086016 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jubusenum.sys
    2016-11-27 00:11 - 2010-07-27 15:26 - 00054784 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcecm.sys
    2016-11-27 00:11 - 2010-07-27 09:52 - 00117248 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwusbdev.sys
    2016-11-27 00:11 - 2010-05-10 14:22 - 00999936 _____ (DiBcom SA) C:\Windows\system32\Drivers\mod7700.sys
    2016-11-27 00:11 - 2010-05-04 16:50 - 00022528 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwupgrade.sys
    2016-11-27 00:11 - 2010-03-20 12:06 - 00013952 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_usbenumfilter.sys
    2016-11-27 00:11 - 2010-01-18 18:48 - 00032768 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
    2016-11-27 00:11 - 2009-07-14 14:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
    2016-11-27 00:11 - 2009-07-14 14:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01009.dll
    2016-11-26 23:47 - 2016-11-27 00:50 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2016-11-26 23:47 - 2016-11-26 23:47 - 00001134 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2016-11-26 23:47 - 2016-11-26 23:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2016-11-26 23:47 - 2014-12-19 10:47 - 30560957 _____ (Tencent ) C:\Users\admin\Documents\QQPlayer_Setup_English.exe
    2016-11-26 23:46 - 2016-11-26 23:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
    2016-11-26 23:46 - 2016-11-26 23:46 - 00000000 ____D C:\ProgramData\Malwarebytes
    2016-11-26 23:46 - 2016-11-24 21:42 - 22851472 _____ (Malwarebytes ) C:\Users\admin\Documents\mbam-setup-2.2.1.1043.exe
    2016-11-26 23:46 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2016-11-26 23:46 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
    2016-11-26 23:46 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2016-11-26 22:43 - 2016-11-18 01:22 - 46830224 _____ C:\Users\admin\Documents\Firefox Setup 50.0.exe
    2016-11-26 22:43 - 2016-10-18 22:38 - 268254784 _____ (AVG Technologies CZ, s.r.o.) C:\Users\admin\Documents\AVG_Antivirus_Free_x64_693.exe
    2016-11-26 22:41 - 2016-11-27 09:23 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
    2016-11-26 22:41 - 2016-11-26 22:41 - 00001467 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2016-11-26 22:41 - 2016-11-26 22:41 - 00001427 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
    2016-11-26 22:40 - 2016-11-27 09:49 - 00000000 ____D C:\Users\admin
    2016-11-26 22:40 - 2016-11-26 22:40 - 00000020 ___SH C:\Users\admin\ntuser.ini
    2016-11-26 22:40 - 2016-11-26 22:40 - 00000000 _SHDL C:\Users\admin\My Documents
    2016-11-26 22:40 - 2016-11-26 22:40 - 00000000 _SHDL C:\Users\admin\Documents\My Videos
    2016-11-26 22:40 - 2016-11-26 22:40 - 00000000 _SHDL C:\Users\admin\Documents\My Pictures
    2016-11-26 22:40 - 2016-11-26 22:40 - 00000000 _SHDL C:\Users\admin\Documents\My Music
    2016-11-26 22:40 - 2010-11-21 15:16 - 00000000 ____D C:\Users\admin\AppData\Roaming\Media Center Programs
    2016-11-26 16:24 - 2016-11-26 16:24 - 00171136 __RSH C:\w7ldr

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-11-27 14:40 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\rescache
    2016-11-27 14:37 - 2009-07-14 13:13 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
    2016-11-27 14:37 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\inf
    2016-11-27 14:35 - 2009-07-14 13:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
    2016-11-27 14:35 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\system32\sysprep
    2016-11-27 14:33 - 2010-11-21 15:16 - 00000000 ____D C:\Windows\CSC
    2016-11-27 14:32 - 2009-07-14 13:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2016-11-27 14:31 - 2009-07-14 13:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
    2016-11-27 14:12 - 2009-07-14 12:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2016-11-27 14:12 - 2009-07-14 12:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2016-11-27 09:11 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\Help
    2016-11-27 09:06 - 2009-07-14 12:45 - 00279552 _____ C:\Windows\system32\FNTCACHE.DAT
    2016-11-27 00:12 - 2009-07-14 11:20 - 00000000 ____D C:\Windows\ModemLogs

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2016-11-27 01:43

    ==================== End of FRST.txt ============================
    Attached Images Attached Images
    Attached Files Attached Files
    Last edited by tashi; 2016-11-27 at 17:10. Reason: Merged two posts, copy pasted log into topic

  2. #2
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,959

    Default

    Hi

    I don't know if I can fix this, I see errors related to different things then from what you report.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The below items need to be removed/uninstalled from your computer. They are adware/malware packed

    WinThruster (HKLM-x32\...\WinThruster) (Version: 1.16.8 - Solvusoft Corporation) <==== ATTENTION
    WinThruster (Version: 1.16.8 - Solvusoft Corporation) Hidden <==== ATTENTION
    WinThruster_2016
    registry repair software


    ~~~~~~~~~~

    AdwCleaner
    • Please download AdwCleaner and save the file to your Desktop.
      In order to use AdwCleaner, you have to agree the Eula:
    • Right-click AdwCleaner.exe and select Run as administrator to run the programme.
    • Follow the prompts.
    • Click Scan.
    • Upon completion, click Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
    • Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
    • Click Clean.
    • Follow the prompts and allow your computer to reboot.
    • After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

    -- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

    ~~

    Please download Junkware Removal Tool
    or from here http://downloads.malwarebytes.org/file/jrt
    to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.


    ~~
    please post
    AdwCleaner[C1].txt
    JRT.txt
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  3. #3
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    Hi bro.. Here is the result.. Please advice


    # AdwCleaner v6.030 - Logfile created 01/12/2016 at 16:16:28
    # Updated on 19/10/2016 by Malwarebytes
    # Database : 2016-12-01.1 [Server]
    # Operating System : Windows 7 Ultimate (X64)
    # Username : USER - USER-PC
    # Running from : C:\Users\USER\Downloads\AdwCleaner.exe
    # Mode: Clean
    # Support : hxxps://www.malwarebytes.com/support



    ***** [ Services ] *****



    ***** [ Folders ] *****

    [#] Folder deleted on reboot: C:\ProgramData\Thunder Network
    [#] Folder deleted on reboot: C:\ProgramData\thunder network
    [#] Folder deleted on reboot: C:\ProgramData\Application Data\Thunder Network
    [#] Folder deleted on reboot: C:\ProgramData\Application Data\thunder network


    ***** [ Files ] *****



    ***** [ DLL ] *****



    ***** [ WMI ] *****



    ***** [ Shortcuts ] *****



    ***** [ Scheduled Tasks ] *****



    ***** [ Registry ] *****

    [-] Key deleted: HKU\S-1-5-21-1053248485-957906623-3906508135-1000\Software\Ask.com.tmp
    [#] Key deleted on reboot: HKCU\Software\Ask.com.tmp
    [#] Key deleted on reboot: [x64] HKCU\Software\Ask.com.tmp
    [-] Data restored: HKU\S-1-5-21-1053248485-957906623-3906508135-1000\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data restored: HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
    [-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
    [-] Value deleted: HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel [Homepage]


    ***** [ Web browsers ] *****



    *************************

    :: "Tracing" keys deleted
    :: Winsock settings cleared

    *************************

    C:\AdwCleaner\AdwCleaner[C0].txt - [1694 Bytes] - [01/12/2016 16:16:28]
    C:\AdwCleaner\AdwCleaner[S0].txt - [2047 Bytes] - [01/12/2016 16:10:14]

    ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1840 Bytes] ##########

  4. #4
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    Hi ..guy please advice

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.9 (09.30.2016)
    Operating System: Windows 7 Ultimate x64
    Ran by USER (Administrator) on Thu 12/01/2016 at 17:13:59.71
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 26

    Successfully deleted: C:\ProgramData\thunder network (Folder)
    Successfully deleted: C:\Users\Public\thunder network (Folder)
    Successfully deleted: C:\Users\USER\AppData\Roaming\dg (Folder)
    Successfully deleted: C:\Windows\system32\drivers\dgsafe.sys (File)
    Successfully deleted: C:\Windows\SysWOW64\drivers\dgsafe.sys (File)
    Successfully deleted: C:\Program Files (x86)\mydrivers (Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AC8FC9W (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3OM3U2H2 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\965KM5N4 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
    Successfully deleted: C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NH93E5P5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\prefetch\APNSTUB.EXE-A2814457.pf (File)
    Successfully deleted: C:\Windows\prefetch\DRIVERGENIUS.EXE-11E51084.pf (File)
    Successfully deleted: C:\Windows\prefetch\DRIVERUPDATE.EXE-B13B4484.pf (File)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AC8FC9W (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3OM3U2H2 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\965KM5N4 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NH93E5P5 (Temporary Internet Files Folder)
    Successfully deleted: C:\Windows\SysWOW64\dg597 (Folder)



    Registry: 1

    Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\dgpnpsev (Registry Key)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Thu 12/01/2016 at 17:16:13.09
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  5. #5
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,959

    Default

    Let's update Malwarebytes Anti-Malware

    Open Malwarebytes Anti-Malware
    • On the Dashboard click on Update Now
    • Go to the Setting Tab
    • Under Setting go to Detection and Protection
    • Under PUP and PUM make sure both are set to show Treat Detections as Malware
    • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
    • Then on the Dashboard click on Scan
    • Make sure to select THREAT SCAN
    • Then click on Scan
    • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
    • If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
    • Upon completion of the scan (or after the reboot), click the History tab.
    • Click Application Logs, followed by the first Scan Log.
    • Click Export,followed by Copy to Clipboard. Paste the log in your next reply.

    ~~

    Please download Emsisoft Emergency Kit and save it to your desktop.
    Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
    • Leave all settings as they are and click the Extract button at the bottom.
    • A folder named EEK will be created in the root of the drive (usually c:\).
    • After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
    • The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
    • Please click Yes so that it downloads the latest database updates.
    • When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
    • Click on Scan to be taken to the scan options.
    • If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
    • Click on the Malware Scan button to start the scan.
    • When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
    • When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
    • Please save the log in Notepad on your desktop, and copy it to your next reply.
    • When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  6. #6
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 12/2/2016
    Scan Time: 9:01 AM
    Logfile: Malware results.txt
    Administrator: Yes

    Version: 2.2.1.1043
    Malware Database: v2016.12.02.01
    Rootkit Database: v2016.11.20.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows 7
    CPU: x64
    File System: NTFS
    User: USER

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 266078
    Time Elapsed: 6 min, 21 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

  7. #7
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    Emsisoft Emergency Kit - Version 12.0
    Last update: 12/2/2016 9:34:37 AM
    User account: USER-PC\USER
    Computer name: USER-PC
    OS version: Windows 7x64

    Scan settings:

    Scan type: Quick Scan
    Objects: Rootkits, Memory, Traces

    Detect PUPs: On
    Scan archives: Off
    ADS Scan: On
    File extension filter: Off
    Direct disk access: Off

    Scan start: 12/2/2016 9:37:40 AM
    C:\Users\USER\AppData\Local\Temp\APN-Stub detected: Application.Win32.WebToolbar (A) []

    Scanned 61791
    Found 1

    Scan end: 12/2/2016 9:37:49 AM
    Scan time: 0:00:09

    C:\Users\USER\AppData\Local\Temp\APN-Stub Application.Win32.WebToolbar (A)

    Deleted 1

  8. #8
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,959

    Default

    Hows the computer now?
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  9. #9
    Junior Member
    Join Date
    Nov 2016
    Posts
    6

    Default

    The problem still exists. I have movie, file and picture which are cannot play using any media and also picture file which cannot be view. All the file become file type 8488. Before this the file format of my movie file is AVI but after that it become file type 8488 which i suspect it cause by malware. Please advice my how i can restore back of my movie and file to originally format which . Here i attach the sample for your analyse.

  10. #10
    Security Expert Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    3,959

    Default

    Exterminate It! <== needs to be uninstalled
    http://www.isthisfilesafe.com/sha1/1...1_details.aspx

    QQ??3.7 (HKU\S-1-5-21-1642817827-2581930201-3280809290-1000\...\QQPlayer) (Version: 3.7 - ????(??)????)
    was the above installed lately and you think it may have caused the extensions to change?
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •