# Solved: Unsupported 16-bit application



## jlabit (Jan 24, 2005)

I recently started getting an error on boot that I cannot find the cause of. The error box is white and states:

The program or feature " \??\C:\a\.exe" cannot start or run due to incompatibility with 64-bit versions of Windows. Please contact the software vendor to ask if a 64-bit Windows compatible version is available.

There is also a small black box that comes up along with the white one that is labeled "C:\Windows\SysWOW64\cmd.exe. Except for that title at the top of the box, the box is blank. The computer is a Lenovo Y580 Gaming Laptop, with Windows 7 64-bit operating system installed. I haven't installed anything recently that would cause the error. I did upload MalwareBytes anti-malware software, and did a full scan, which showed nothing. I also have avast free antivirus on the machine with a scan that shows no problems. Anyone have any ideas on how to fix this, short of deleting each and every program on the laptop one at time? Thanks for your assistance.


----------



## dvk01 (Dec 14, 2002)

that sounds like possible malware 
follow advice *here* and post all the logs those programs make, so we can get an idea what is wrong.


----------



## jlabit (Jan 24, 2005)

Thanks for your reply. I tried to list all the info you requested but the website said the file was too big. I will post the first two, and then, if you still need the GMER, I will have to figure out how to do it. First, the HJT log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:39:02 PM, on 2/1/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\bfgclient\bfggameservices.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Temporary\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotsheet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [autoauto] c.bat
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Emsisoft Anti-Malware 8.0 - Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 10493 bytes

Next the DDS log

DS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 11.0.9600.16428
Run by Jim's Laptop at 14:43:12 on 2014-02-01
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8091.5973 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\bfgclient\bfggameservices.exe
C:\Temporary\HijackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.hotsheet.com/
uProxyServer = hxxp=127.0.0.1:8877;https=127.0.0.1:8877
uProxyOverride = <-loopback>
mWinlogon: Userinit = userinit.exe,
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
mRun: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
mRun: [autoauto] c.bat
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{7231F615-398A-4380-8D8D-F02A790FED86} : DHCPNameServer = 192.168.2.1
AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll
SSODL: WebCheck - <orphaned>
LSA: Notification Packages = scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
x64-Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe
x64-Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SynLenovoGestureMgr] C:\Program Files (x86)\Synaptics\SynTP\SynLenovoGestureMgr.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2013-12-30 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2013-12-30 207904]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2011-12-5 16152]
R0 LHDmgr;LHDmgr;C:\Windows\System32\drivers\LhdX64.sys [2013-12-30 39008]
R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2013-9-5 30496]
R1 A2DDA;A2 Direct Disk Access Support Driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2013-12-30 26176]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-12-30 1034464]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-12-30 422216]
R2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2013-12-30 4161512]
R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-12-5 659968]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-12-30 78648]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-12-30 50344]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-12-5 135952]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-12-30 13592]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2011-12-8 607456]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2013-12-30 161560]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-2-1 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2014-2-1 701512]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-12-30 363800]
R2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2011-12-8 594704]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\Windows\System32\drivers\AcpiVpc.sys [2011-12-15 30816]
R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2011-12-5 195584]
R3 aswStm;aswStm;C:\Windows\System32\drivers\aswstm.sys [2013-12-30 79672]
R3 bcbtums;Bluetooth RAM Firmware Download USB Filter;C:\Windows\System32\drivers\bcbtums.sys [2013-12-30 134696]
R3 btwampfl;btwampfl Bluetooth filter driver;C:\Windows\System32\drivers\btwampfl.sys [2013-12-30 621096]
R3 BTWDPAN;Bluetooth Personal Area Network;C:\Windows\System32\drivers\btwdpan.sys [2013-12-30 89640]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2013-12-30 39976]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2013-12-30 331264]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2011-12-5 355096]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2011-12-5 785688]
R3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2013-12-30 173656]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-2-1 25928]
R3 vm331avs;Digital Camera 1;C:\Windows\System32\drivers\vm331avs.sys [2013-12-30 952832]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2013-12-30 70960]
S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2011-12-5 195584]
S3 cleanhlp;cleanhlp;C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [2013-12-30 57024]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2013-12-31 111616]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-12-8 273168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-31 19456]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-12-31 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-12-31 30208]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-12-31 1255736]
S3 wsvd;wsvd;C:\Windows\System32\drivers\wsvd.sys [2009-7-21 121840]
.
=============== Created Last 30 ================
.
2014-02-01 19:36:51	--------	d-----w-	C:\Users\Jim's Laptop\AppData\Roaming\Malwarebytes
2014-02-01 19:36:41	25928	----a-w-	C:\Windows\System32\drivers\mbam.sys
2014-02-01 19:36:41	--------	d-----w-	C:\ProgramData\Malwarebytes
2014-02-01 19:36:41	--------	d-----w-	C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 18:14:56	10315576	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{DD250562-6274-412D-8436-A5935996D1C1}\mpengine.dll
2014-01-21 01:17:10	--------	d-----w-	C:\Users\Jim's Laptop\AppData\Local\Diagnostics
2014-01-19 23:11:59	74576	----a-w-	C:\Windows\System32\XAPOFX1_2.dll
2014-01-17 02:56:55	--------	d-----w-	C:\Users\Jim's Laptop\AppData\Local\Adobe
2014-01-16 00:31:47	99840	----a-w-	C:\Windows\System32\drivers\usbccgp.sys
2014-01-16 00:31:47	7808	----a-w-	C:\Windows\System32\drivers\usbd.sys
2014-01-16 00:31:47	53248	----a-w-	C:\Windows\System32\drivers\usbehci.sys
2014-01-16 00:31:47	376768	----a-w-	C:\Windows\System32\drivers\netio.sys
2014-01-16 00:31:47	343040	----a-w-	C:\Windows\System32\drivers\usbhub.sys
2014-01-16 00:31:47	325120	----a-w-	C:\Windows\System32\drivers\usbport.sys
2014-01-16 00:31:47	3156480	----a-w-	C:\Windows\System32\win32k.sys
2014-01-16 00:31:47	30720	----a-w-	C:\Windows\System32\drivers\usbuhci.sys
2014-01-16 00:31:47	25600	----a-w-	C:\Windows\System32\drivers\usbohci.sys
2014-01-09 23:21:14	--------	d-----w-	C:\Windows\pss
2014-01-08 19:58:45	--------	d-----w-	C:\Users\Jim's Laptop\.rainlendar2
2014-01-08 19:58:30	--------	d-----w-	C:\Program Files (x86)\Rainlendar2
2014-01-06 07:29:54	--------	d--h--w-	C:\Lenovo
.
==================== Find3M ====================
.
2013-12-31 05:33:20	9728	---ha-w-	C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 05:12:31	79672	----a-w-	C:\Windows\System32\drivers\aswstm.sys
2013-12-31 05:12:15	92544	----a-w-	C:\Windows\System32\drivers\aswRdr2.sys
2013-12-31 05:12:15	78648	----a-w-	C:\Windows\System32\drivers\aswMonFlt.sys
2013-12-31 05:12:15	65776	----a-w-	C:\Windows\System32\drivers\aswRvrt.sys
2013-12-31 05:12:15	43152	----a-w-	C:\Windows\avastSS.scr
2013-12-31 05:12:15	207904	----a-w-	C:\Windows\System32\drivers\aswVmm.sys
2013-12-31 05:12:15	1034464	----a-w-	C:\Windows\System32\drivers\aswSnx.sys
2013-12-31 04:46:18	19872	----a-w-	C:\Windows\System32\LenovoSDKEmSubSystem.dll
2013-12-31 04:46:17	39008	----a-w-	C:\Windows\System32\drivers\LhdX64.sys
2013-12-31 04:46:17	30816	----a-w-	C:\Windows\System32\drivers\AcpiVpc.sys
2013-12-18 12:13:56	270496	------w-	C:\Windows\System32\MpSigStub.exe
2013-11-26 10:19:07	2724864	----a-w-	C:\Windows\System32\mshtml.tlb
2013-11-26 10:18:23	4096	----a-w-	C:\Windows\System32\ieetwcollectorres.dll
2013-11-26 09:48:07	66048	----a-w-	C:\Windows\System32\iesetup.dll
2013-11-26 09:46:25	48640	----a-w-	C:\Windows\System32\ieetwproxystub.dll
2013-11-26 09:23:02	2724864	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2013-11-26 09:18:39	139264	----a-w-	C:\Windows\System32\ieUnatt.exe
2013-11-26 09:18:09	111616	----a-w-	C:\Windows\System32\ieetwcollector.exe
2013-11-26 09:16:57	708608	----a-w-	C:\Windows\System32\jscript9diag.dll
2013-11-26 08:35:02	5769216	----a-w-	C:\Windows\System32\jscript9.dll
2013-11-26 08:28:16	553472	----a-w-	C:\Windows\SysWow64\jscript9diag.dll
2013-11-26 08:16:12	4243968	----a-w-	C:\Windows\SysWow64\jscript9.dll
2013-11-26 08:02:16	1995264	----a-w-	C:\Windows\System32\inetcpl.cpl
2013-11-26 07:32:06	1928192	----a-w-	C:\Windows\SysWow64\inetcpl.cpl
2013-11-26 07:07:57	2334208	----a-w-	C:\Windows\System32\wininet.dll
2013-11-26 06:33:33	1820160	----a-w-	C:\Windows\SysWow64\wininet.dll
2013-11-24 06:59:54	14	----a-w-	C:\Windows\SysWow64\c.bat
2013-11-23 18:26:20	417792	----a-w-	C:\Windows\SysWow64\WMPhoto.dll
2013-11-23 17:47:34	465920	----a-w-	C:\Windows\System32\WMPhoto.dll
2013-11-12 02:23:09	2048	----a-w-	C:\Windows\System32\tzres.dll
2013-11-12 02:07:29	2048	----a-w-	C:\Windows\SysWow64\tzres.dll
.
============= FINISH: 14:43:22.49 ===============

Finally, the attach log:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume1
Install Date: 12/30/2013 10:28:22 PM
System Uptime: 2/1/2014 1:52:44 PM (1 hours ago)
.
Motherboard: LENOVO | | Product Name
Processor: Intel(R) Core(TM) i7-3610QM CPU @ 2.30GHz | U3E1 | 2301/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 238 GiB total, 190.742 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: 
Description: Ethernet Controller
Device ID: PCI\VEN_1969&DEV_1091&SUBSYS_397917AA&REV_08\4&8F8BD4C&0&00E0
Manufacturer: 
Name: Ethernet Controller
PNP Device ID: PCI\VEN_1969&DEV_1091&SUBSYS_397917AA&REV_08\4&8F8BD4C&0&00E0
Service: 
.
==== System Restore Points ===================
.
RP19: 1/1/2014 1:40:48 PM - Removed uPlayer
RP20: 1/3/2014 11:28:14 AM - Windows Update
RP21: 1/7/2014 10:26:08 PM - Windows Update
RP22: 1/15/2014 6:31:36 PM - Windows Update
RP23: 1/16/2014 1:09:46 AM - Windows Update
RP24: 1/19/2014 5:11:26 PM - Installed DirectX
RP25: 1/20/2014 11:50:04 AM - Windows Update
RP26: 1/24/2014 2:35:14 PM - Windows Update
RP27: 1/28/2014 3:10:02 PM - Windows Update
RP28: 1/31/2014 12:20:33 PM - Installed HiJackThis
RP29: 1/31/2014 12:25:56 PM - Removed HiJackThis
RP30: 2/1/2014 1:30:52 PM - Removed Adobe Reader XI (11.0.06).
.
==== Installed Programs ======================
.
Adobe Reader XI (11.0.06)
avast! Free Antivirus
Big Fish: Game Manager
CCleaner
Emsisoft Anti-Malware
Energy Management
Google Chrome
Google Earth
Google Update Helper
Intel PROSet Wireless
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) OpenCL CPU Runtime
Intel(R) Processor Graphics
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed
Intel(R) Rapid Storage Technology
Intel(R) USB 3.0 eXtensible Host Controller Driver
Intel® PROSet/Wireless WiFi Software
Intel® Trusted Connect Service Client
JMicron Flash Media Controller Driver
Lenovo Bluetooth with Enhanced Data Rate Software
Lenovo EasyCamera
Lenovo OneKey Recovery
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 4.5.1
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
NVIDIA Control Panel 327.02
NVIDIA Graphics Driver 327.02
NVIDIA Install Application
NVIDIA Optimus 1.14.17
NVIDIA PhysX
NVIDIA PhysX System Software 9.11.1111
NVIDIA Update 1.14.17
NVIDIA Update Components
Rainlendar2 (remove only)
Realtek High Definition Audio Driver
Synaptics Pointing Device Driver
Windows Driver Package - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1)
WinRAR 5.01 (64-bit)
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
2/1/2014 1:53:32 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
2/1/2014 1:53:32 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/1/2014 1:53:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2/1/2014 1:53:07 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
2/1/2014 1:53:07 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
.
==== End Of File ===========================

Thanks again for your help. I have that GMER log but it is exceptionally long. Might have done something wrong creating it.


----------



## dvk01 (Dec 14, 2002)

Delete any existing version of ComboFix you have sitting on your desktop
*Please read and follow all these instructions very carefully*​* Do not edit or remove any information or user names etc, otherwise we cannot fix the problem. If you insist on editing out anything then I will close the topic & refuse to offer any help.  *

Download ComboFix from *Here*to your Desktop.

***Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer***
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


*Very Important!* *Temporarily disable* your *anti-virus* and *anti-malware* real-time protection and any *script blocking components of them or your firewall*_* before* _performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results" or stop combofix running at all_
Click on *THIS LINK * to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
*Remember to re enable the protection again after combofix has finished*
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running 
Double click on *combofix.exe* & follow the prompts.​If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. 
Please post the *"C:\ComboFix.txt" * for further review

*****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze *****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.Read  HERE  why we disable autoruns

*Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version. *

Please tell us if it has cured the problems or if there are any outstanding issues

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 *If Combofix reboot is due to a rootkit, the screen may stay black for several minutes on reboot, this is normal*
 *If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue *(Those items will not be deleted)

Post the log in next reply please...


----------



## jlabit (Jan 24, 2005)

Thanks again for the help. The ComboFix file is listed below:

ComboFix 14-02-01.01 - Jim's Laptop 02/01/2014 20:53:54.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8091.5267 [GMT -6:00]
Running from: c:\users\Jim's Laptop\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\programdata\Roaming
c:\windows\SysWow64\c.bat
.
.
((((((((((((((((((((((((( Files Created from 2014-01-02 to 2014-02-02 )))))))))))))))))))))))))))))))
.
.
2014-02-02 02:56 . 2014-02-02 02:56	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-02-02 02:56 . 2014-02-02 02:56	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-01 23:11 . 2014-02-01 23:11	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD250562-6274-412D-8436-A5935996D1C1}\offreg.dll
2014-02-01 19:40 . 2014-02-01 19:40	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\users\Jim's Laptop\AppData\Roaming\Malwarebytes
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\programdata\Malwarebytes
2014-02-01 19:36 . 2013-04-04 20:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-01-31 18:14 . 2013-12-16 07:54	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD250562-6274-412D-8436-A5935996D1C1}\mpengine.dll
2014-01-21 01:17 . 2014-01-21 01:17	--------	d-----w-	c:\users\Jim's Laptop\AppData\Local\Diagnostics
2014-01-19 23:11 . 2008-10-27 16:04	518480	----a-w-	c:\windows\system32\XAudio2_3.dll
2014-01-17 02:56 . 2014-02-01 19:41	--------	d-----w-	c:\users\Jim's Laptop\AppData\Local\Adobe
2014-01-16 00:31 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-16 00:31 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-16 00:31 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-16 00:31 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-16 00:31 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-16 00:31 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-16 00:31 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-16 00:31 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-01-16 00:31 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-08 19:58 . 2014-02-01 19:53	--------	d-----w-	c:\users\Jim's Laptop\.rainlendar2
2014-01-08 19:58 . 2014-01-08 19:58	--------	d-----w-	c:\program files (x86)\Rainlendar2
2014-01-06 07:30 . 2014-01-06 07:30	--------	d-----w-	c:\programdata\CyberLink
2014-01-06 07:29 . 2014-01-06 07:29	--------	d-----w-	C:\Lenovo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-16 07:09 . 2013-12-31 05:14	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-31 06:35 . 2013-12-31 06:35	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-31 06:35 . 2013-12-31 06:35	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-12-31 06:35 . 2013-12-31 06:35	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-12-31 06:35 . 2013-12-31 06:35	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-12-31 06:35 . 2013-12-31 06:35	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-12-31 06:35 . 2013-12-31 06:35	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-12-31 06:35 . 2013-12-31 06:35	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-12-31 06:35 . 2013-12-31 06:35	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-12-31 06:35 . 2013-12-31 06:35	81408	----a-w-	c:\windows\system32\icardie.dll
2013-12-31 06:35 . 2013-12-31 06:35	774144	----a-w-	c:\windows\system32\jscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-12-31 06:35 . 2013-12-31 06:35	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-31 06:35 . 2013-12-31 06:35	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-31 06:35 . 2013-12-31 06:35	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-12-31 06:35 . 2013-12-31 06:35	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-12-31 06:35 . 2013-12-31 06:35	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-12-31 06:35 . 2013-12-31 06:35	62464	----a-w-	c:\windows\system32\pngfilt.dll
2013-12-31 06:35 . 2013-12-31 06:35	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-12-31 06:35 . 2013-12-31 06:35	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-12-31 06:35 . 2013-12-31 06:35	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2013-12-31 06:35 . 2013-12-31 06:35	548352	----a-w-	c:\windows\system32\vbscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-12-31 06:35 . 2013-12-31 06:35	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-12-31 06:35 . 2013-12-31 06:35	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-12-31 06:35 . 2013-12-31 06:35	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-12-31 06:35 . 2013-12-31 06:35	48128	----a-w-	c:\windows\system32\imgutil.dll
2013-12-31 06:35 . 2013-12-31 06:35	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-12-31 06:35 . 2013-12-31 06:35	413696	----a-w-	c:\windows\system32\html.iec
2013-12-31 06:35 . 2013-12-31 06:35	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-31 06:35 . 2013-12-31 06:35	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-12-31 06:35 . 2013-12-31 06:35	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-31 06:35 . 2013-12-31 06:35	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-12-31 06:35 . 2013-12-31 06:35	30208	----a-w-	c:\windows\system32\licmgr10.dll
2013-12-31 06:35 . 2013-12-31 06:35	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-12-31 06:35 . 2013-12-31 06:35	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2013-12-31 06:35 . 2013-12-31 06:35	247808	----a-w-	c:\windows\system32\msls31.dll
2013-12-31 06:35 . 2013-12-31 06:35	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-12-31 06:35 . 2013-12-31 06:35	243200	----a-w-	c:\windows\system32\webcheck.dll
2013-12-31 06:35 . 2013-12-31 06:35	235520	----a-w-	c:\windows\system32\url.dll
2013-12-31 06:35 . 2013-12-31 06:35	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-12-31 06:35 . 2013-12-31 06:35	195584	----a-w-	c:\windows\system32\msrating.dll
2013-12-31 06:35 . 2013-12-31 06:35	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-12-31 06:35 . 2013-12-31 06:35	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-12-31 06:35 . 2013-12-31 06:35	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-12-31 06:35 . 2013-12-31 06:35	147968	----a-w-	c:\windows\system32\occache.dll
2013-12-31 06:35 . 2013-12-31 06:35	143872	----a-w-	c:\windows\system32\wextract.exe
2013-12-31 06:35 . 2013-12-31 06:35	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-12-31 06:35 . 2013-12-31 06:35	13824	----a-w-	c:\windows\system32\mshta.exe
2013-12-31 06:35 . 2013-12-31 06:35	135680	----a-w-	c:\windows\system32\iepeers.dll
2013-12-31 06:35 . 2013-12-31 06:35	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-12-31 06:35 . 2013-12-31 06:35	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-12-31 06:35 . 2013-12-31 06:35	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-12-31 06:35 . 2013-12-31 06:35	1228800	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-12-31 06:35 . 2013-12-31 06:35	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-12-31 06:35 . 2013-12-31 06:35	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-12-31 06:35 . 2013-12-31 06:35	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-12-31 06:35 . 2013-12-31 06:35	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-12-31 06:35 . 2013-12-31 06:35	101376	----a-w-	c:\windows\system32\inseng.dll
2013-12-31 05:33 . 2013-12-31 05:33	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2013-12-31 05:33 . 2013-12-31 05:33	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2013-12-31 05:33 . 2013-12-31 05:33	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3928064	----a-w-	c:\windows\system32\d2d1.dll
2013-12-31 05:33 . 2013-12-31 05:33	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2013-12-31 05:33 . 2013-12-31 05:33	363008	----a-w-	c:\windows\system32\dxgi.dll
2013-12-31 05:33 . 2013-12-31 05:33	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3419136	----a-w-	c:\windows\SysWow64\d2d1.dll
2013-12-31 05:33 . 2013-12-31 05:33	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	296960	----a-w-	c:\windows\system32\d3d10core.dll
2013-12-31 05:33 . 2013-12-31 05:33	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2013-12-31 05:33 . 2013-12-31 05:33	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2013-12-31 05:33 . 2013-12-31 05:33	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2013-12-31 05:33 . 2013-12-31 05:33	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2013-12-31 05:33 . 2013-12-31 05:33	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2013-12-31 05:33 . 2013-12-31 05:33	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2013-12-31 05:33 . 2013-12-31 05:33	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2013-12-31 05:33 . 2013-12-31 05:33	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2013-12-31 05:33 . 2013-12-31 05:33	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2013-12-31 05:33 . 2013-12-31 05:33	1988096	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2013-12-31 05:33 . 2013-12-31 05:33	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2013-12-31 05:33 . 2013-12-31 05:33	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2013-12-31 05:33 . 2013-12-31 05:33	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2013-12-31 05:33 . 2013-12-31 05:33	1643520	----a-w-	c:\windows\system32\DWrite.dll
2013-12-31 05:33 . 2013-12-31 05:33	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files (x86)\Rainlendar2\Rainlendar2.exe" [2014-01-01 2608736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"331BigDog"="c:\program files (x86)\USB Camera\VM331_STI.EXE" [2011-11-24 548864]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2011-12-05 291096]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-31 3764024]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2011-12-22 1344288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ scecli c:\program files\Lenovo\Bluetooth Software\BtwProximityCP.dll
.
3;3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys;c:\windows\SYSNATIVE\Drivers\vm331avs.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - FWLOIKOD
*Deregistered* - fwloikod
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-28 18:14	1211672	----a-w-	c:\program files (x86)\Google\Chrome\Application\32.0.1700.102\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-31 05:02]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-31 05:02]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-31 05:12	287280	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2013-12-31 8076848]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2013-12-31 6199344]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-28 12343400]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-16 1156712]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.hotsheet.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=127.0.0.1:8877;https=127.0.0.1:8877
uInternet Settings,ProxyOverride = <-loopback>
IE: Send image to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-autoauto - c.bat
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynLenovoGestureMgr - c:\program files (x86)\Synaptics\SynTP\SynLenovoGestureMgr.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-02-01 20:57:38
ComboFix-quarantined-files.txt 2014-02-02 02:57
.
Pre-Run: 203,871,723,520 bytes free
Post-Run: 203,480,248,320 bytes free
.
- - End Of File - - 85709D5EC0293BD8BC5453287AB7B06D


----------



## jlabit (Jan 24, 2005)

dvk01, that seemed to have fixed the problem. I did not get the boxes after reboot after running Combofix. Can you tell me what was fixed? I am very knowledgeable about hardware, but ignorant of software and malware. Was it a virus or Trojan? Thank you very much for your assistance.


----------



## dvk01 (Dec 14, 2002)

there was a file set to run at boot time, that was possibly malicious 
Combofix has dealt with it 
BUT I would like to get a copy to check it & see what it actually does and whether there might be other files left over that could cause problems later on

can you please go to C:\qoobox & right click the quarantine folder, select send to compressed(zip) folders 
that will make a zipped copy of the quarantine folder
then 
please upload that to http://www.thespykiller.co.uk/index.php?board=1.0 so we can examine the files and submit to antivirus companies if needed

Just press new topic, fill in the needed details 
In the subject box please put: Files for DVK01

In the body of the post paste the contents of the code box: 

```
combofix Quarantine folder from 
http://forums.techguy.org/windows-7/1118968-unsupported-16-bit-application.html#post8852425
```
 & then press the browse button and then navigate to & select the files on your computer, When the file is listed in the windows press send to upload the file


----------



## jlabit (Jan 24, 2005)

I performed the follow-up you requested. Hope I got it right. Thanks again.


----------



## dvk01 (Dec 14, 2002)

OK there is a bit more to do 
Download the attached CFScript.txt and save it to your desktop or the same folder that you downloaded combofix to originally ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press *SAVE * and choose desktop in the list of selections in that window & press save)
*Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished *
Close any open browsers 
Then drag the CFScript.txt into the ComboFix.exe or renamed combofix icon as shown in the screenshot below.










This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply

*Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum *

This will create a zip file inside C:\QooBox\quarantine named something like [38][email protected]

at the end it will pop up an alert & open your browser and ask you to send the zip file

please follow those instructions. We need to see the zip file before we can carry on with the fix

If there is no pop up alert or open browser then

please go to http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so I can examine them and if needed distribute them to antivirus companies.
Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files ( do not post HJT logs there as they will not get dealt with)

Files to submit:
the zip file inside C:\QooBox\quarantine created by combofix named something like [38][email protected]

or to 
http://www.bleepingcomputer.com/submit-malware.php?channel=38


----------



## jlabit (Jan 24, 2005)

Here is the Combofix.txt file.

ComboFix 14-02-01.01 - Jim's Laptop 02/02/2014 19:15:35.3.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8091.5579 [GMT -6:00]
Running from: c:\users\Jim's Laptop\Desktop\ComboFix.exe
Command switches used :: c:\users\Jim's Laptop\Desktop\cfscript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\a
c:\a\.exe
c:\a\6.exe
c:\a\FiddlerCore.dll
c:\a\internetport3.exe
c:\a\loading.gif
c:\a\ping.txt
c:\a\stm.bat
c:\a\thedata.zip
c:\a\ver.ini
.
.
((((((((((((((((((((((((( Files Created from 2014-01-03 to 2014-02-03 )))))))))))))))))))))))))))))))
.
.
2014-02-03 01:17 . 2014-02-03 01:17	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-02-03 01:17 . 2014-02-03 01:17	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-01 19:40 . 2014-02-01 19:40	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\users\Jim's Laptop\AppData\Roaming\Malwarebytes
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2014-02-01 19:36 . 2014-02-01 19:36	--------	d-----w-	c:\programdata\Malwarebytes
2014-02-01 19:36 . 2013-04-04 20:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-01-31 18:14 . 2013-12-16 07:54	10315576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD250562-6274-412D-8436-A5935996D1C1}\mpengine.dll
2014-01-21 01:17 . 2014-01-21 01:17	--------	d-----w-	c:\users\Jim's Laptop\AppData\Local\Diagnostics
2014-01-19 23:11 . 2008-10-27 16:04	518480	----a-w-	c:\windows\system32\XAudio2_3.dll
2014-01-17 02:56 . 2014-02-01 19:41	--------	d-----w-	c:\users\Jim's Laptop\AppData\Local\Adobe
2014-01-16 00:31 . 2013-11-27 01:41	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2014-01-16 00:31 . 2013-11-27 01:41	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2014-01-16 00:31 . 2013-11-27 01:41	53248	----a-w-	c:\windows\system32\drivers\usbehci.sys
2014-01-16 00:31 . 2013-11-27 01:41	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2014-01-16 00:31 . 2013-11-27 01:41	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2014-01-16 00:31 . 2013-11-27 01:41	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2014-01-16 00:31 . 2013-11-27 01:41	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2014-01-16 00:31 . 2013-11-26 11:40	376768	----a-w-	c:\windows\system32\drivers\netio.sys
2014-01-16 00:31 . 2013-11-26 10:32	3156480	----a-w-	c:\windows\system32\win32k.sys
2014-01-08 19:58 . 2014-02-02 18:26	--------	d-----w-	c:\users\Jim's Laptop\.rainlendar2
2014-01-08 19:58 . 2014-01-08 19:58	--------	d-----w-	c:\program files (x86)\Rainlendar2
2014-01-06 07:30 . 2014-01-06 07:30	--------	d-----w-	c:\programdata\CyberLink
2014-01-06 07:29 . 2014-01-06 07:29	--------	d-----w-	C:\Lenovo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-16 07:09 . 2013-12-31 05:14	86054176	----a-w-	c:\windows\system32\MRT.exe
2013-12-31 06:35 . 2013-12-31 06:35	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-31 06:35 . 2013-12-31 06:35	194048	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-12-31 06:35 . 2013-12-31 06:35	942592	----a-w-	c:\windows\system32\jsIntl.dll
2013-12-31 06:35 . 2013-12-31 06:35	90112	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-12-31 06:35 . 2013-12-31 06:35	86016	----a-w-	c:\windows\SysWow64\iesysprep.dll
2013-12-31 06:35 . 2013-12-31 06:35	86016	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2013-12-31 06:35 . 2013-12-31 06:35	84992	----a-w-	c:\windows\system32\mshtmled.dll
2013-12-31 06:35 . 2013-12-31 06:35	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2013-12-31 06:35 . 2013-12-31 06:35	81408	----a-w-	c:\windows\system32\icardie.dll
2013-12-31 06:35 . 2013-12-31 06:35	774144	----a-w-	c:\windows\system32\jscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-12-31 06:35 . 2013-12-31 06:35	74240	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-31 06:35 . 2013-12-31 06:35	71680	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-31 06:35 . 2013-12-31 06:35	645120	----a-w-	c:\windows\SysWow64\jsIntl.dll
2013-12-31 06:35 . 2013-12-31 06:35	626176	----a-w-	c:\windows\system32\msfeeds.dll
2013-12-31 06:35 . 2013-12-31 06:35	62464	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-12-31 06:35 . 2013-12-31 06:35	62464	----a-w-	c:\windows\system32\pngfilt.dll
2013-12-31 06:35 . 2013-12-31 06:35	61952	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2013-12-31 06:35 . 2013-12-31 06:35	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2013-12-31 06:35 . 2013-12-31 06:35	616104	----a-w-	c:\windows\system32\ieapfltr.dat
2013-12-31 06:35 . 2013-12-31 06:35	548352	----a-w-	c:\windows\system32\vbscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-12-31 06:35 . 2013-12-31 06:35	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2013-12-31 06:35 . 2013-12-31 06:35	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-12-31 06:35 . 2013-12-31 06:35	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-12-31 06:35 . 2013-12-31 06:35	48128	----a-w-	c:\windows\system32\imgutil.dll
2013-12-31 06:35 . 2013-12-31 06:35	454656	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-12-31 06:35 . 2013-12-31 06:35	453120	----a-w-	c:\windows\system32\dxtmsft.dll
2013-12-31 06:35 . 2013-12-31 06:35	413696	----a-w-	c:\windows\system32\html.iec
2013-12-31 06:35 . 2013-12-31 06:35	40448	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-31 06:35 . 2013-12-31 06:35	36352	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-12-31 06:35 . 2013-12-31 06:35	34816	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-31 06:35 . 2013-12-31 06:35	337408	----a-w-	c:\windows\SysWow64\html.iec
2013-12-31 06:35 . 2013-12-31 06:35	30208	----a-w-	c:\windows\system32\licmgr10.dll
2013-12-31 06:35 . 2013-12-31 06:35	296960	----a-w-	c:\windows\system32\dxtrans.dll
2013-12-31 06:35 . 2013-12-31 06:35	263376	----a-w-	c:\windows\system32\iedkcs32.dll
2013-12-31 06:35 . 2013-12-31 06:35	247808	----a-w-	c:\windows\system32\msls31.dll
2013-12-31 06:35 . 2013-12-31 06:35	24576	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-12-31 06:35 . 2013-12-31 06:35	243200	----a-w-	c:\windows\system32\webcheck.dll
2013-12-31 06:35 . 2013-12-31 06:35	235520	----a-w-	c:\windows\system32\url.dll
2013-12-31 06:35 . 2013-12-31 06:35	235008	----a-w-	c:\windows\system32\elshyph.dll
2013-12-31 06:35 . 2013-12-31 06:35	195584	----a-w-	c:\windows\system32\msrating.dll
2013-12-31 06:35 . 2013-12-31 06:35	182272	----a-w-	c:\windows\SysWow64\msls31.dll
2013-12-31 06:35 . 2013-12-31 06:35	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-12-31 06:35 . 2013-12-31 06:35	151552	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-12-31 06:35 . 2013-12-31 06:35	147968	----a-w-	c:\windows\system32\occache.dll
2013-12-31 06:35 . 2013-12-31 06:35	143872	----a-w-	c:\windows\system32\wextract.exe
2013-12-31 06:35 . 2013-12-31 06:35	139264	----a-w-	c:\windows\SysWow64\wextract.exe
2013-12-31 06:35 . 2013-12-31 06:35	13824	----a-w-	c:\windows\system32\mshta.exe
2013-12-31 06:35 . 2013-12-31 06:35	135680	----a-w-	c:\windows\system32\iepeers.dll
2013-12-31 06:35 . 2013-12-31 06:35	13312	----a-w-	c:\windows\SysWow64\mshta.exe
2013-12-31 06:35 . 2013-12-31 06:35	13312	----a-w-	c:\windows\system32\msfeedssync.exe
2013-12-31 06:35 . 2013-12-31 06:35	131072	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-12-31 06:35 . 2013-12-31 06:35	1228800	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-12-31 06:35 . 2013-12-31 06:35	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-12-31 06:35 . 2013-12-31 06:35	111616	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-12-31 06:35 . 2013-12-31 06:35	105984	----a-w-	c:\windows\system32\iesysprep.dll
2013-12-31 06:35 . 2013-12-31 06:35	1051136	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-12-31 06:35 . 2013-12-31 06:35	101376	----a-w-	c:\windows\system32\inseng.dll
2013-12-31 05:33 . 2013-12-31 05:33	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2013-12-31 05:33 . 2013-12-31 05:33	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2013-12-31 05:33 . 2013-12-31 05:33	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3928064	----a-w-	c:\windows\system32\d2d1.dll
2013-12-31 05:33 . 2013-12-31 05:33	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2013-12-31 05:33 . 2013-12-31 05:33	363008	----a-w-	c:\windows\system32\dxgi.dll
2013-12-31 05:33 . 2013-12-31 05:33	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3419136	----a-w-	c:\windows\SysWow64\d2d1.dll
2013-12-31 05:33 . 2013-12-31 05:33	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	296960	----a-w-	c:\windows\system32\d3d10core.dll
2013-12-31 05:33 . 2013-12-31 05:33	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2013-12-31 05:33 . 2013-12-31 05:33	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2013-12-31 05:33 . 2013-12-31 05:33	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2013-12-31 05:33 . 2013-12-31 05:33	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-31 05:33 . 2013-12-31 05:33	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2013-12-31 05:33 . 2013-12-31 05:33	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2013-12-31 05:33 . 2013-12-31 05:33	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2013-12-31 05:33 . 2013-12-31 05:33	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2013-12-31 05:33 . 2013-12-31 05:33	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2013-12-31 05:33 . 2013-12-31 05:33	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2013-12-31 05:33 . 2013-12-31 05:33	1988096	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2013-12-31 05:33 . 2013-12-31 05:33	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2013-12-31 05:33 . 2013-12-31 05:33	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2013-12-31 05:33 . 2013-12-31 05:33	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2013-12-31 05:33 . 2013-12-31 05:33	1643520	----a-w-	c:\windows\system32\DWrite.dll
2013-12-31 05:33 . 2013-12-31 05:33	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="c:\program files (x86)\Rainlendar2\Rainlendar2.exe" [2014-01-01 2608736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"331BigDog"="c:\program files (x86)\USB Camera\VM331_STI.EXE" [2011-11-24 548864]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2011-12-05 291096]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-31 3764024]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2011-12-22 1344288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ scecli c:\program files\Lenovo\Bluetooth Software\BtwProximityCP.dll
.
R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys;c:\windows\SYSNATIVE\Drivers\vm331avs.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-28 18:14	1211672	----a-w-	c:\program files (x86)\Google\Chrome\Application\32.0.1700.102\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-31 05:02]
.
2014-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-31 05:02]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-31 05:12	287280	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2013-12-31 8076848]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2013-12-31 6199344]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-28 12343400]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-16 1156712]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SynLenovoGestureMgr"="c:\program files (x86)\Synaptics\SynTP\SynLenovoGestureMgr.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.hotsheet.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <-loopback>
IE: Send image to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
.
**************************************************************************
.
Completion time: 2014-02-02 19:19:42 - machine was rebooted
ComboFix-quarantined-files.txt 2014-02-03 01:19
ComboFix2.txt 2014-02-02 07:25
ComboFix3.txt 2014-02-02 02:57
.
Pre-Run: 203,234,353,152 bytes free
Post-Run: 203,321,434,112 bytes free
.
- - End Of File - - 9EA80A6D2ADA6D9D0101BA7A80ECFB2B

The other file was sent to Spykiller, because it said it could not make web contact automatically. Hope I'm not screwing this up.


----------



## dvk01 (Dec 14, 2002)

we have got all the bad files this time. The first time we only stopped them running. 
Can you zip up the quarantine folder again for me & upload it to spykiller so I can examine them & submit them to antivirus companies ( if needed)

Once you have done that then as everything looks ok now and your problems have stopped 
*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
* Click *START* then * RUN*
* Now type *Combofix /Uninstall * in the runbox and click *OK*. Note the *space *between the *X* and the */U*, it needs to be there.









This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here* http://myonlinesecurity.co.uk/how-to-protect-yourself-and-tighten-security/ *for info on how to tighten your security settings and how to help prevent future attacks.

and scan here* http://secunia.com/vulnerability_scanning/personal* for out of date & vulnerable common applications on your computer and update whatever it suggests.

Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place. * If windows update doesn't work, please come back & tell us*


----------



## jlabit (Jan 24, 2005)

Quarantine files sent per your request. Thank you very much dvk01. Have no idea where I picked that up, as I run a good anti-virus, and thought I was fairly knowledgeable about what not to do on the internet. Appreciate all the work you have done to assist me and many others on here. Have a great day.


----------



## dvk01 (Dec 14, 2002)

it looks like it was something to take control of your router & use it for malicious purposes but it is hard to tell exactly what it dopes as many of the files are legitimate files that are used by genuine networking tools but are being misused in this case

The entire package has been submitted to the antivirus companies to add detections as they see fit. 
only one of the files was detected by anything so far


----------

