boldfin

August 17

Yes, that did resolve the issue.

Thanks again.

August 16

Brave seems to be working as is should now. No longer do I have countless ads and popups on every web page I visit. That is fantastic.

However, I am still getting tons of Threat detections by Defender - all of which it cannot remediate. I just got another one moments ago:

August 16

I've updated/uninstalled all the programs.

I have also updated my version of Win10 to the latest version.

Fixlog.txt

August 16

Yes, I am still using a Brother AIO printer from 2012.

I'll follow the rest of your instructions unless that info somehow adds an additional step to be taken.

August 15

Thank you. Here are the fresh logs.

FSS.txt SecurityCheck.txt Addition_15-08-2024 12.35.14.txt FRST_15-08-2024 12.35.14.txt

August 15

Thank you very much for your reply. I am a little surprised though to hear that you don't see signs of an infection. MalwareBytes isn't finding any threats, but both Defender and ESET are. But I could certainly be confusing detections with infections. I guess they could be two different things.

At any rate, I do know that Brave is definitely being affected by something. I use that Browser on all my PC's and its built-in ad blocker (Shields) has worked flawlessly until a couple of days ago, which corresponds to when these threats were initially detected. Now every website I visit is riddled with ads. Images on the sites load ads instead of the intended images. Many pages simply won't load at all. That's got to be a sign of some sort of adware infestation.

All of this continues to happen despite having cleared cookies, and all site data. Last night I completely uninstalled Brave and reinstalled it. The same symptoms have resumed after the UI/RI of Brave. It's made web-browsing on this PC basically unusable for me and my kids.

At this point, I am open to any suggestions you might have. If you think a running a generic cleanup script might help, I say let's do it.

Let me know if I can provide any other logs or details to assist you, and again - I appreciate your help!

August 15

Windows Defender and other AV tools have detected a few threats, some of which were left "unremediated". MBAW is now actively blocking numerous incoming port scans and compromised sites, and my Browser has clearly become infected with Adware.

ESET Scan Log.txt Malwarebytes Scan Report 2024-08-15 172858.txt FRST.txt Addition.txt

July 17, 2012

It appears to be working normally. I rescanned with MBAW and MS Security Essentials, and no threats were found. I understand that there is no guarantee that the system is truly "clean", but please tell me if I should consider nuke/pave at this point.

July 15, 2012

I just completed an automatic scan with the AVPTool, per your instructions. It took six hours to run the scan of my main drive. No threats were detected, so there is no Detected Threats report to post in this reply.

Just to make sure, I ran another MBAW Quick Scan:

Malwarebytes Anti-Malware (PRO) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.14.07

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Rob :: BOLDFIN420 [administrator]

Protection: Enabled

7/14/2012 10:45:03 PM

mbam-log-2012-07-14 (22-45-03).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 285703

Time elapsed: 9 minute(s), 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

What do you recommend at this point?

July 14, 2012

I am back in town. I ran scans with MS Security Essentials znd MBAW, both came back with one threat each. MSSE reported a Win32 worm, which I quarantined, MBAW log is posted below. What next steps do you recommend?

Malwarebytes Anti-Malware (PRO) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.14.07

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Rob :: BOLDFIN420 [administrator]

Protection: Enabled

7/14/2012 12:56:05 PM

mbam-log-2012-07-14 (12-56-05).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 280845

Time elapsed: 7 minute(s), 57 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Users\Rob\AppData\Roaming\jullli_2012 (Stolen.Data) -> Quarantined and deleted successfully.

(end)

July 9, 2012

FYI - I am going to be travelling for a few days, and unable to continue th ecleaning process on this computer until I return. I appreciate your help so far, and will contact you when I return.

July 9, 2012

Just ran the scan again. Log below:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

esets_scanner_update returned -1 esets_gle=53251

July 8, 2012

I ran the scan with ESET's online tool. It took several hours. There were a few quarantined programs, most of which I recognized as being installed by me:

Uniblue Registry Booster, etc.

The log.txt doesn't see to say much...

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

Is this normal?

July 6, 2012

In your previous instructions, you asked me to uninstall the Ask.com Toolbar. This program was not listed under installed programs. There was a folder for it, however, in C:/program files - which I deleted. This was done yesterday.

ComboFix 12-07-05.02 - Rob 07/05/2012 19:50:26.2.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3326.1784 [GMT -7:00]

Running from: c:\users\Rob\Desktop\ComboFix.exe

Command switches used :: c:\users\Rob\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-06-06 to 2012-07-06 )))))))))))))))))))))))))))))))

.

2012-07-06 03:00 . 2012-07-06 03:00 -------- d-----w- c:\users\Mcx3-BOLDFIN420\AppData\Local\temp

2012-07-06 03:00 . 2012-07-06 03:00 -------- d-----w- c:\users\Mcx2-BOLDFIN420\AppData\Local\temp

2012-07-06 03:00 . 2012-07-06 03:00 -------- d-----w- c:\users\Jennifer\AppData\Local\temp

2012-07-06 03:00 . 2012-07-06 03:00 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-06 03:00 . 2012-07-06 03:00 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2012-07-05 15:12 . 2012-07-06 03:00 -------- d-----w- c:\users\Rob\AppData\Local\temp

2012-07-04 22:58 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8AE3E55-479C-4BE7-A1E7-E0043E77E064}\mpengine.dll

2012-07-03 14:57 . 2012-02-10 10:28 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F9D91BEC-DBDE-4167-9C7A-165D901E6BFD}\gapaengine.dll

2012-07-03 14:56 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-06-28 04:16 . 2012-06-28 04:16 -------- d-----w- c:\programdata\ATI

2012-06-28 04:16 . 2012-06-28 04:16 -------- d-----w- c:\program files\AMD AVT

2012-06-28 04:16 . 2012-06-28 04:16 -------- d-----w- c:\program files\AMD APP

2012-06-23 07:44 . 2012-06-23 07:44 9815752 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-06-23 07:09 . 2012-06-30 20:36 -------- d-----w- c:\users\Rob\AppData\Local\QuickPar

2012-06-23 07:08 . 2012-06-23 07:08 -------- d-----w- c:\program files\QuickPar

2012-06-23 06:59 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-23 06:59 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-23 06:59 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-23 06:59 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-23 06:59 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-23 06:59 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-23 06:59 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-23 06:59 . 2012-06-02 22:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-23 06:59 . 2012-06-02 22:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-17 03:33 . 2012-06-17 03:33 -------- d-----w- c:\program files\Newsbin

2012-06-13 22:14 . 2012-04-28 04:41 919040 ----a-w- c:\windows\system32\rdpcorets.dll

2012-06-13 22:14 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-13 22:14 . 2012-05-15 01:05 2343936 ----a-w- c:\windows\system32\win32k.sys

2012-06-13 22:14 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-06-13 22:14 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll

2012-06-13 22:14 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-06-13 03:06 . 2012-06-13 03:06 -------- d-----w- c:\program files\EaseUS

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2028-06-08 23:38 . 2011-08-11 04:48 158720 ----a-w- c:\windows\system32\VPMSDU32.DLL

2012-06-23 07:44 . 2012-04-03 01:49 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-23 07:44 . 2011-06-06 15:56 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-27 01:22 . 2012-04-27 01:22 413696 ----a-r- c:\users\Rob\AppData\Roaming\Microsoft\Installer\{4229F016-3A60-439E-B626-DE4BD457469F}\ARPPRODUCTICON.exe

2011-03-18 17:53 . 2011-04-10 23:44 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2012-05-09 06:39 1011344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2012-05-09 06:39 1011344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2012-05-09 06:39 1011344 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2569616]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840]

"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"EKAIO2StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe" [2011-12-10 2756608]

"My Movies Tray"="c:\program files\Binnerup Consult\My Movies for Windows Media Center\My Movies Tray.exe" [2011-12-15 477392]

"NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-15 113288]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-11-20 128296]

"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2011-12-22 362432]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-27 931200]

"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2012-05-09 1061520]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-06 641664]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2011-2-7 603504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Users^Rob^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]

path=c:\users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

backup=c:\windows\pss\OpenOffice.org 3.3.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]

2010-06-08 01:48 362488 ----a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]

2012-04-27 16:12 6065784 ----a-w- c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]

2010-07-02 18:24 95744 ----a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent]

2011-09-20 21:53 1493288 ----a-w- c:\program files\Nero\Nero 11\Nero BackItUp\NBAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]

2010-06-08 01:47 2605424 ----a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]

2011-03-07 13:33 89456 ----a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 BackupReader;BackupReader;c:\windows\system32\DRIVERS\BackupReader.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]

R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys [x]

S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [x]

S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2012/02/28 18:50];c:\program files\CyberLink\PowerDVD DX\000.fcl [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 arXfrSvc;Windows Media Center TV Archive Transfer Service;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [x]

S2 DkTahsp;OCUR SDV Service;c:\windows\system32\dktahsp.exe [x]

S2 esClient;Windows Media Center Client Service;c:\program files\Windows Home Server\esClient.exe [x]

S2 HPMSSConnectorSvc;HPMSSConnectorService;c:\program files\Hewlett-Packard\HP MediaSmart Server\MSSConnectorService.exe [x]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 MediaCollectorService;MediaCollectorService;c:\program files\Hewlett-Packard\HP MediaSmart Server\MediaCollectorClient.exe [x]

S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [x]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]

S2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 msta;Tuning Adapter Service;c:\windows\system32\Drivers\msta.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 07:44]

.

2012-07-06 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2012-04-11 18:56]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://sn123w.snt123.mail.live.com/default.aspx?wa=wsignin1.0

Trusted Zone: highland.com\office

DPF: {16F67783-7E72-4C39-99C4-4780A8335484} - hxxp://www.syncmyride.com/Own/Modules/UpdateCenter/applets/sync.cab

FF - ProfilePath - c:\users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\mz85hv77.default\

FF - prefs.js: network.proxy.type - 0

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]

"ImagePath"="\??\c:\program files\CyberLink\PowerDVD DX\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-408190252-3311634441-3888657169-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-408190252-3311634441-3888657169-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-07-05 20:02:53

ComboFix-quarantined-files.txt 2012-07-06 03:02

ComboFix2.txt 2012-07-05 15:33

.

Pre-Run: 388,650,045,440 bytes free

Post-Run: 388,093,710,336 bytes free

.

- - End Of File - - 1AF48684F65612D6250FD1803BF15C11

July 5, 2012

Ran ComboFix:

ComboFix 12-07-05.02 - Rob 07/05/2012 8:04.1.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3326.1858 [GMT -7:00]

Running from: c:\users\Rob\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\users\Rob\AppData\Roaming\8D5595

c:\users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

c:\users\Rob\AppData\Roaming\UseNetServ.exe

c:\users\Rob\AppData\Roaming\UseServe.exe

c:\users\Rob\g2mdlhlpx.exe

.

((((((((((((((((((((((((( Files Created from 2012-06-05 to 2012-07-05 )))))))))))))))))))))))))))))))

.

2012-07-05 15:12 . 2012-07-05 15:30 -------- d-----w- c:\users\Rob\AppData\Local\temp

2012-07-05 15:12 . 2012-07-05 15:12 -------- d-----w- c:\users\Mcx3-BOLDFIN420\AppData\Local\temp

2012-07-05 15:12 . 2012-07-05 15:12 -------- d-----w- c:\users\Mcx2-BOLDFIN420\AppData\Local\temp

2012-07-05 15:12 . 2012-07-05 15:12 -------- d-----w- c:\users\Jennifer\AppData\Local\temp

2012-07-05 15:12 . 2012-07-05 15:12 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-05 14:59 . 2012-07-05 14:59 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E8AE3E55-479C-4BE7-A1E7-E0043E77E064}\MpKsl405aafcf.sys