fleury

July 16, 2012

Wow. That appears to have fixed it. It had the side effect of deleting my other Chrome profiles for some reason, but they were pretty easy to set up again. And when I did so, the uTorrent thing was not coming up like before! Thanks!'

--

Marc.

July 15, 2012

SystemLook 30.07.11 by jpshortstuff

Log created at 15:50 on 15/07/2012 by Marc

Administrator - Elevation successful

========== folderfind ==========

Searching for "*CRE*"

C:\Program Files\Common Files\microsoft shared\THEMES12\CONCRETE d------ [18:55 30/07/2008]

C:\Program Files\Hewlett-Packard\HP Software UI\PC Registration d------ [11:21 21/12/2006]

C:\Program Files\LEGO Company\LEGO Digital Designer\HTML\StarterModels\Creator d------ [04:09 24/01/2012]

C:\Program Files\Microsoft SDKs\Windows\v7.0A\Bootstrapper\Packages\vcredist_x64 d------ [02:29 01/09/2010]

C:\Program Files\Microsoft SDKs\Windows\v7.0A\Bootstrapper\Packages\vcredist_x86 d------ [02:30 01/09/2010]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\CSharp\WPF\1033\WPFSplashScreen.zip d------ [08:25 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1033\SplashScreen.zip d------ [08:26 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\VisualBasic\WPF\1033\WPFSplashScreen.zip d------ [08:26 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\VB\Snippets\1033\data\xml\XML - Create d------ [02:27 01/09/2010]

C:\Program Files\Microsoft Visual Studio 10.0\VC\VCResourceTemplates d------ [02:27 01/09/2010]

C:\Program Files\Notepad++\user.manual\Images\Screenshots d------ [00:54 13/03/2011]

C:\System.sav\TSCREEN d------ [20:21 27/11/2006]

C:\Users\Marc\AppData\Local\Bizarre Creations d------ [19:02 14/01/2010]

C:\Users\Marc\AppData\Local\CRE d------ [02:42 28/05/2012]

C:\Users\Marc\AppData\Local\Google\GBScreensaver d------ [23:16 19/09/2009]

C:\Users\Marc\AppData\Local\Microsoft\Credentials d---s-- [10:12 03/01/2008]

C:\Users\Marc\AppData\Roaming\Ipswitch\WS_FTP\HTML\Res_409_12.0.1\SSHCLIENTKEYCREATE d------ [23:22 10/08/2009]

C:\Users\Marc\AppData\Roaming\Ipswitch\WS_FTP\HTML\Res_409_12.0.1\SSLCREATECERTWIZ d------ [23:22 10/08/2009]

C:\Users\Marc\AppData\Roaming\Microsoft\Credentials d---s-- [10:12 03/01/2008]

C:\Users\Marc\brickstore-cache\M\cre001 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre002 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre003 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre004 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre005 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre006 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre010 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre011 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\P\crssprt02pb72 d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb77 d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb38b d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb64a d------ [04:40 27/12/2011]

C:\Users\Marc\Calibre Library\J. K. Rowling\Harry Potter and the Chamber of Secrets (462) d------ [02:20 30/12/2010]

C:\Users\Marc\Documents\LEGO Creations d------ [20:22 27/07/2009]

C:\Users\Mcx1\AppData\Local\Microsoft\Credentials d---s-- [03:39 23/11/2011]

C:\Users\Mcx1\AppData\Roaming\Microsoft\Credentials d---s-- [03:39 23/11/2011]

C:\Windows\assembly\GAC_MSIL\IEExecRemote dr----- [11:18 02/11/2006]

C:\Windows\ehome\CreateDisc d------ [12:37 02/11/2006]

C:\Windows\ehome\CreateDisc\SonicResources d------ [12:37 02/11/2006]

C:\Windows\System32\config\systemprofile\AppData\Local\Google\GBScreensaver d------ [20:54 24/01/2010]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.16386_none_ef9a51cfc4df6184 d------ [11:18 02/11/2006]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.16720_none_ef94d833c4e430f8 d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.20883_none_d8cceed7de8675eb d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.18000_none_ef6ed38bc5370a50 d------ [11:21 24/09/2008]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.18111_none_ef6fbce9c5363d99 d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.22230_none_d8a42d85dedbb6ac d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6002.18005_none_ef4a58c7c5889e64 d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6000.16386_none_3fd3e2bdc5a2408e d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6001.18000_none_420aa4b9c28d5162 d------ [11:21 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6002.18005_none_43f61dc5bfaf1cae d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.0.6000.16386_en-us_5fe4036ea556b4f7 d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6000.16386_none_d9008ac592026334 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6001.18000_none_db374cc18eed7408 d------ [11:20 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6002.18005_none_dd22c5cd8c0f3f54 d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-credwiz.resources_31bf3856ad364e35_6.0.6000.16386_en-us_0dcdf312c69f3fe9 d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.0.6000.16386_none_9da3eeaf6eea0db4 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-eventcreate.resources_31bf3856ad364e35_6.0.6000.16386_en-us_163f93beca50608f d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.0.6000.16386_none_d32c0ea842a8cb28 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16386_none_6997bcdc5b8aeeb5 d------ [12:36 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16510_none_69dd6e605b578d62 d------ [04:10 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16552_none_69b42f445b762fd4 d------ [04:24 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20625_none_6a613cb17478c7d0 d------ [04:10 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20671_none_6a272bed74a4ee29 d------ [04:24 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6001.18000_none_6bce7ed85875ff89 d------ [11:23 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6002.18005_none_6db9f7e45597cad5 d------ [11:47 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-security-credssp_31bf3856ad364e35_6.0.6000.16386_none_c1816f73a4a4f3fd d------ [11:19 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-security-credssp_31bf3856ad364e35_6.0.6001.18000_none_c3b8316fa19004d1 d------ [01:03 20/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-sonic-createdisc_31bf3856ad364e35_6.0.6000.16386_none_3dbfc4bbf1adf534 d------ [12:35 02/11/2006]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.16386_none_e106c2e628087e97 d------ [11:19 02/11/2006]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e101494a280d4e0b d------ [14:34 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.20883_none_ca395fee41af92fe d------ [14:34 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e0dc2e00285f5aac d------ [14:33 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6001.22230_none_ca109e9c4204d3bf d------ [14:33 15/02/2009]

-= EOF =-

July 12, 2012

On my existing profiles, there's nothing there.

"Boo... You have no extensions :-( Want to browse the gallery instead?"

If I create a new user and then go to the Extensions options page, it shows the same thing (no extensions) for about ten or twenty seconds, and then the uTorrentControl2 extension appears (along with the button next to the tab URL). I have clicked on the garbage can icon to remove the extension every time.

--

Marc.

July 12, 2012

SystemLook 30.07.11 by jpshortstuff

Log created at 20:58 on 11/07/2012 by Marc

Administrator - Elevation successful

========== folderfind ==========

Searching for "*torrent*"

C:\Qoobox\Quarantine\C\Users\Marc\AppData\Local\uTorrent d------ [06:49 10/07/2012]

C:\Qoobox\Quarantine\C\Users\Marc\Documents\Torrents d------ [06:49 10/07/2012]

========== regfind ==========

Searching for "torrent"

[HKEY_CURRENT_USER\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent]

"Extension"=".torrent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_USERS\S-1-5-21-3952486750-2209785099-4280780671-1000\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_USERS\S-1-5-21-3952486750-2209785099-4280780671-1000_Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

-= EOF =-

July 11, 2012

Still the same as last update -- my existing Chrome profile seems to work fine, but if I add a new profile, within a few seconds the extension button appears and a new tab is launched, at http://www.utorrent.com/utorrent-control-complete

--

Marc.

July 10, 2012

The step at the command prompt gave me "The requested operation requires elevation."

However, I continued with the ComboFix process. Here's the log:

ComboFix 12-07-08.03 - Marc 10/07/2012 2:29.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.1013.190 [GMT -4:00]

Running from: c:\users\Marc\Desktop\ComboFix.exe

Command switches used :: c:\users\Marc\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Marc\AppData\Local\uTorrent

c:\users\Marc\AppData\Roaming\inst.exe

c:\users\Marc\AppData\Roaming\vso_ts_preview.xml

c:\users\Marc\Documents\Torrents

c:\users\Marc\Documents\Torrents\1001_Books_You_Must_Read_Before_You_Die.5787852.TPB.torrent

c:\users\Marc\Documents\Torrents\2500__sci-fi_ebooks_in_epub_format.5698246.TPB.torrent

c:\users\Marc\Documents\Torrents\623_BOOKS_FOR_THE_IPHONE___IPAD_EPUB.5826551.TPB.torrent

c:\users\Marc\Documents\Torrents\All_Physics_Books_Categorized.4555365.TPB.torrent

c:\users\Marc\Documents\Torrents\Bored_to_Death_Season_01.5258374.TPB.torrent

c:\users\Marc\Documents\Torrents\categories.txt

c:\users\Marc\Documents\Torrents\It__s_A_Wonderful_Life_Uncut_1946_DvDrip[Eng]-greenbud1969.4614456.TPB.torrent

c:\users\Marc\Documents\Torrents\itemtypes.txt

c:\users\Marc\Documents\Torrents\Joda_rompack_for_the_Nintendo_DS_[2601-2700].4413494.TPB.torrent

c:\users\Marc\Documents\Torrents\Joda_rompack_for_the_Nintendo_DS_[3101-3200].4644384.TPB.torrent

c:\users\Marc\Documents\Torrents\Lost.S01-05_complete_DVDRiP.5383685.TPB.torrent

c:\users\Marc\Documents\Torrents\Nintendo_DS_ROMs_4801_-_4900.5615573.TPB.torrent

c:\users\Marc\Documents\Torrents\Rome-Season_1___2.4638175.TPB.torrent

c:\users\Marc\Documents\Torrents\Shrek_Forever_After_(2010)_DVD-R_(eng-spa-fra)_[manuvoulquin].5989463.TPB.torrent

c:\users\Marc\Documents\Torrents\Snow_White_and_the_Seven_Dwarfs_luxe_Edition(2009)(ENG_NL)2Lions.5134560.TPB.torrent

c:\users\Marc\Documents\Torrents\Sonic_X_Series_1.3631362.TPB.torrent

c:\users\Marc\Documents\Torrents\Star_Trek-The_Original_Series_(Season_1)_Remastered_And_Enhanced.5515718.TPB.torrent

c:\users\Marc\Documents\Torrents\The.Fairly.OddParents.5.Seasons.4584020.TPB.torrent

c:\users\Marc\Documents\Torrents\The_Earthsea_Cycle-_Ursula_K._Le_Guin_(Epub__Mobi__Lit__Pdf).5943625.TPB.torrent

c:\users\Marc\Documents\Torrents\The_Social_Network_2010_DVDSCR_XViD-WBZ_.5915536.TPB.torrent

c:\users\Marc\Documents\Torrents\TV__Arthur_(Marc_Brown)_PBS_Kids_[season_01_-_10]_FULL_EPISODES.5181352.TPB.torrent

c:\users\Marc\Documents\Torrents\Wolverine_and_the_X-Men_-_Season_1_-_Complete.4785976.TPB.torrent

c:\windows\Downloaded Program Files\setup.dll

c:\windows\Fonts\HandelGotDOT-Bol.otf

c:\windows\system32\muzapp.exe

.

((((((((((((((((((((((((( Files Created from 2012-06-10 to 2012-07-10 )))))))))))))))))))))))))))))))

.

2012-07-10 06:51 . 2012-07-10 11:40 -------- d-----w- c:\users\Marc\AppData\Local\temp

2012-07-10 06:51 . 2012-07-10 06:51 -------- d-----w- c:\users\Mcx1\AppData\Local\temp

2012-07-10 06:51 . 2012-07-10 06:51 -------- d-----w- c:\users\Guest\AppData\Local\temp

2012-07-10 06:51 . 2012-07-10 06:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-10 03:59 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{858BB809-42FE-4982-B089-A90033A0DDF6}\mpengine.dll

2012-07-09 04:01 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-07-04 03:56 . 2012-06-03 04:40 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{175742C7-8CFB-4ABB-9044-6E8CACFE704E}\gapaengine.dll

2012-06-21 23:57 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-21 23:57 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-21 23:57 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-21 23:57 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-21 23:55 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-21 23:55 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-21 23:55 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-21 23:53 . 2012-06-02 19:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-21 23:53 . 2012-06-02 19:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-15 05:07 . 2012-06-15 05:07 -------- d-----w- c:\programdata\Kaspersky Lab

2012-06-14 01:25 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll

2012-06-14 01:25 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll

2012-06-14 01:25 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll

2012-06-14 01:24 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-14 01:24 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys

2012-06-13 11:36 . 2012-06-13 11:36 -------- d-----w- c:\program files\ESET

2012-06-12 21:37 . 2012-06-12 21:37 -------- d-----w- c:\program files\Dropbox

2012-06-12 21:33 . 2012-07-10 01:32 -------- d-----w- c:\users\Marc\AppData\Roaming\Dropbox

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-03 04:40 . 2012-06-03 04:56 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2012-06-03 03:40 . 2012-06-03 03:40 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13F0BDB0-AB9F-463E-82F2-8C56660EB083}\offreg.dll

2012-05-29 07:38 . 2011-03-02 11:57 330240 ----a-w- c:\windows\MASetupCaller.dll

2012-05-15 05:43 . 2012-06-03 03:20 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13F0BDB0-AB9F-463E-82F2-8C56660EB083}\mpengine.dll

2012-05-05 14:07 . 2012-04-13 10:53 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-05-05 14:07 . 2011-06-07 04:56 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Marc\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Marc\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-15 00:32 94208 ----a-w- c:\users\Marc\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"googletalk"="c:\users\Marc\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-05-30 21432]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-05-21 3905920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]

"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2006-10-18 317152]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2006-10-18 472800]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-05-30 3521464]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

.

c:\users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Marc\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-6 27502520]

EvernoteClipper.lnk - c:\program files\Evernote\Evernote\EvernoteClipper.exe [2012-1-23 1014112]

KooBits 4.lnk - c:\program files\KooBits 4.0\KooBits 4.0.exe [N/A]

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 14:07]

.

2012-07-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3952486750-2209785099-4280780671-1000Core.job

- c:\users\Marc\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 22:46]

.

2012-07-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3952486750-2209785099-4280780671-1000UA.job

- c:\users\Marc\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 22:46]

.

------- Supplementary Scan -------

.

uStart Page = https://www.google.ca/

mStart Page = hxxp://sympatico.ca

IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1 192.168.2.1

DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} - hxxps://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab

DPF: {F79364C6-8DF2-4060-BF77-35239AC7BCB1} - hxxps://connect.startek.com/Hyperion/zeroadmin/component/Insight/setup.cab

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-07-10 07:43

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(1060)

c:\users\Marc\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Microsoft Security Client\MsMpEng.exe

c:\windows\system32\WLANExt.exe

c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\wbem\unsecapp.exe

.

**************************************************************************

.

Completion time: 2012-07-10 07:57:33 - machine was rebooted

ComboFix-quarantined-files.txt 2012-07-10 11:56

ComboFix2.txt 2012-06-19 03:25

.

Pre-Run: 12,817,362,944 bytes free

Post-Run: 11,938,877,440 bytes free

.

- - End Of File - - 110F8ED5F40414798E922171D1754254

July 9, 2012

SystemLook 30.07.11 by jpshortstuff

Log created at 00:24 on 09/07/2012 by Marc

Administrator - Elevation successful

========== folderfind ==========

Searching for "*torrent*"

C:\Users\Marc\AppData\Local\uTorrent d------ [03:48 25/06/2011]

C:\Users\Marc\Documents\Torrents d------ [02:47 07/01/2008]

========== regfind ==========

Searching for "torrent"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98FC260C-971D-44E3-91FB-0DF611DC1CD4}]

"AppPath"="C:\Program Files\uTorrent"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98FC260C-971D-44E3-91FB-0DF611DC1CD4}]

"AppName"="uTorrent.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\utorrent.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\torrent]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.torrent\OpenWithList]

"b"="uTorrent.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.[Movie-Torrentz]]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.torrent]

[HKEY_CURRENT_USER\Software\Classes\Applications\uTorrent.exe]

[HKEY_CURRENT_USER\Software\Classes\Applications\uTorrent.exe\shell\open\command]

@=""C:\Program Files\uTorrent\uTorrent.exe" "%1""

[HKEY_CURRENT_USER\Software\Classes\btdna\DefaultIcon]

@=""C:\Program Files\uTorrent\uTorrent.exe" ",0"

[HKEY_CURRENT_USER\Software\Classes\btdna\shell\open\command]

@=""C:\Program Files\uTorrent\uTorrent.exe" "/DNA""

[HKEY_CURRENT_USER\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrent]

"Extension"=".torrent"

[HKEY_CURRENT_USER\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent]

"Extension"=".torrent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SOFTWARE\Conduit\AppPaths\client]

"AppPath"="C:\Program Files\uTorrent\uTorrent.exe"