Jump to content

GOBBLAH

Members
  • Posts

    12
  • Joined

  • Last visited

Reputation

0 Neutral
  1. RogueKiller V7.6.5 [08/03/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: Chris n Mimi [Admin rights] Mode: Scan -- Date: 08/05/2012 15:32:59 ¤¤¤ Bad processes: 2 ¤¤¤ [sUSP PATH] MediaServer.exe -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -> KILLED [TermProc] [RESIDUE] MediaServer.exe -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -> KILLED [TermProc] ¤¤¤ Registry Entries: 4 ¤¤¤ [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FOLDER] U : c:\windows\installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U --> FOUND [ZeroAccess][FOLDER] L : c:\windows\installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L --> FOUND ¤¤¤ Driver: [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD5000BEVT-22ZAT0 ATA Device +++++ --- User --- [MBR] e34142bfadc0fd026db88ba655e4981c [bSP] 531d0b34e5551103c06668de331de7b0 : Windows 7 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 26626048 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26830848 | Size: 463838 Mo 3 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 250 | Size: 198 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[6].txt >> RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ; RKreport[6].txt
  2. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.02.07 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Chris n Mimi :: CHRISNMIMI-PC [administrator] 05/08/2012 2:48:24 PM mbam-log-2012-08-05 (14-48-24).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 547132 Time elapsed: 39 minute(s), 13 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Qoobox\Quarantine\C\Windows\assembly\GAC_32\Desktop.ini.vir (Trojan.0access) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\Windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\00000008.@.vir (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully. (end) Restarting then posting rogue
  3. Sorry, Just required a restart, No Idea... Sorry buddy ComboFix 12-08-05.02 - Chris n Mimi 05/08/2012 14:27:03.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.4091.2807 [GMT -4:00] Running from: c:\users\Chris n Mimi\Desktop\ComboFix.exe Command switches used :: c:\users\Chris n Mimi\Desktop\CFScript.txt.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L\00000004.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L\1afb2d56 c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L\201d3dde c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\00000004.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\00000008.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\000000cb.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\80000000.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\80000032.@ c:\windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\80000064.@ . . --------------- FCopy --------------- . c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe --> c:\windows\System32\services.exe . ((((((((((((((((((((((((( Files Created from 2012-07-05 to 2012-08-05 ))))))))))))))))))))))))))))))) . . 2012-08-05 18:33 . 2012-08-05 18:34 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\temp 2012-08-05 18:33 . 2012-08-05 18:33 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-08-02 18:04 . 2012-08-02 18:04 -------- d-----w- c:\users\Chris n Mimi\AppData\Roaming\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\programdata\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-08-02 18:03 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-01 07:00 . 2012-08-01 07:00 -------- d-----w- c:\program files (x86)\ConvertHelper 2012-08-01 06:53 . 2012-08-01 06:57 -------- d-----w- c:\users\Chris n Mimi\dwhelper 2012-07-23 21:54 . 2012-08-05 16:46 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\ElevatedDiagnostics 2012-07-18 03:56 . 2012-07-18 03:56 -------- d-----w- c:\program files\Speccy 2012-07-18 01:57 . 2012-08-05 17:22 -------- d-----w- c:\users\UpdatusUser 2012-07-18 01:56 . 2012-05-15 09:29 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-07-18 01:56 . 2012-05-15 09:29 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-07-18 01:56 . 2012-05-15 09:29 2561856 ----a-w- c:\windows\system32\nvsvcr.dll 2012-07-18 01:56 . 2012-05-15 09:29 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-07-18 01:56 . 2012-05-15 09:29 3149632 ----a-w- c:\windows\system32\nvsvc64.dll 2012-07-18 01:56 . 2012-05-15 09:28 6151488 ----a-w- c:\windows\system32\nvcpl.dll 2012-07-18 01:56 . 2012-05-15 10:48 68928 ----a-w- c:\windows\system32\OpenCL.dll 2012-07-18 01:56 . 2012-05-15 10:48 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll 2012-07-18 01:56 . 2012-07-18 01:56 -------- d-----w- c:\programdata\NVIDIA Corporation 2012-07-18 01:51 . 2012-07-18 01:51 -------- d-----w- c:\program files\CCleaner 2012-07-15 14:26 . 2012-07-15 14:47 -------- d-----w- c:\program files (x86)\Rosetta Stone 2012-07-15 14:12 . 2012-07-15 14:23 -------- d-----w- C:\rosetta 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\Xiph.Org 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\TVersity Codec Pack 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\TVersitybar 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\programdata\TVersity 2012-07-10 11:27 . 2012-07-10 11:27 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-03 15:03 . 2012-04-30 02:39 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-03 15:03 . 2012-04-30 02:39 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-21 06:42 . 2012-05-21 06:42 231376 ----a-w- c:\windows\system32\drivers\truecrypt.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{66bd2442-241b-44cd-8c7a-b51037053cdb}] 2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\TVersitybar\prxtbTVer.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-05-14 880496] "Facebook Update"="c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] "Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-05 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "CloneCDTray"="c:\program files (x86)\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736] . c:\users\Chris n Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2012-5-14 576000] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-18 113120] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] . . Contents of the 'Scheduled Tasks' folder . 2012-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 15:03] . 2012-08-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000Core.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . 2012-08-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000UA.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Chris n Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\dpdtnpbh.default\ . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\programdata\TVersity\Media Server\MediaServer.exe . ************************************************************************** . Completion time: 2012-08-05 14:38:26 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-05 18:38 ComboFix2.txt 2012-08-05 16:36 . Pre-Run: 316,415,520,768 bytes free Post-Run: 316,439,330,816 bytes free . - - End Of File - - D757A3F2CECAD822468669032549A5D9
  4. I fixed the issue, But combo doesnt seem to save a new log ComboFix 12-08-05.02 - Chris n Mimi 05/08/2012 12:10:20.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.4091.2635 [GMT -4:00] Running from: c:\users\Chris n Mimi\Downloads\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini . c:\windows\system32\Services.exe . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2012-07-05 to 2012-08-05 ))))))))))))))))))))))))))))))) . . 2012-08-05 16:30 . 2012-08-05 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-08-02 18:04 . 2012-08-02 18:04 -------- d-----w- c:\users\Chris n Mimi\AppData\Roaming\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\programdata\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-08-02 18:03 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-01 07:00 . 2012-08-01 07:00 -------- d-----w- c:\program files (x86)\ConvertHelper 2012-08-01 06:53 . 2012-08-01 06:57 -------- d-----w- c:\users\Chris n Mimi\dwhelper 2012-07-23 21:54 . 2012-07-23 21:54 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\ElevatedDiagnostics 2012-07-18 03:56 . 2012-07-18 03:56 -------- d-----w- c:\program files\Speccy 2012-07-18 01:57 . 2012-07-18 01:57 -------- d-----w- c:\users\UpdatusUser 2012-07-18 01:56 . 2012-05-15 09:29 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-07-18 01:56 . 2012-05-15 09:29 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-07-18 01:56 . 2012-05-15 09:29 2561856 ----a-w- c:\windows\system32\nvsvcr.dll 2012-07-18 01:56 . 2012-05-15 09:29 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-07-18 01:56 . 2012-05-15 09:29 3149632 ----a-w- c:\windows\system32\nvsvc64.dll 2012-07-18 01:56 . 2012-05-15 09:28 6151488 ----a-w- c:\windows\system32\nvcpl.dll 2012-07-18 01:56 . 2012-05-15 10:48 68928 ----a-w- c:\windows\system32\OpenCL.dll 2012-07-18 01:56 . 2012-05-15 10:48 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll 2012-07-18 01:56 . 2012-07-18 01:56 -------- d-----w- c:\programdata\NVIDIA Corporation 2012-07-18 01:51 . 2012-07-18 01:51 -------- d-----w- c:\program files\CCleaner 2012-07-15 14:26 . 2012-07-15 14:47 -------- d-----w- c:\program files (x86)\Rosetta Stone 2012-07-15 14:12 . 2012-07-15 14:23 -------- d-----w- C:\rosetta 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\Xiph.Org 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\TVersity Codec Pack 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\TVersitybar 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\programdata\TVersity 2012-07-10 11:27 . 2012-07-10 11:27 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-03 15:03 . 2012-04-30 02:39 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-03 15:03 . 2012-04-30 02:39 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-21 06:42 . 2012-05-21 06:42 231376 ----a-w- c:\windows\system32\drivers\truecrypt.sys . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2009-07-14 . 24ACB7E5BE595468E3B9AA488B9B4FCB . 328704 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe [-] 2009-07-14 . 014A9CB92514E27C0107614DF764BC06 . 328704 . . [6.1.7600.16385] .. c:\windows\system32\services.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{66bd2442-241b-44cd-8c7a-b51037053cdb}] 2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\TVersitybar\prxtbTVer.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-04 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056] R4 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-05 113120] R4 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 15:03] . 2012-08-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000Core.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . 2012-08-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000UA.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local LSP: mswsock.dll TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Chris n Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\dpdtnpbh.default\ . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Steam\SteamService.exe . ************************************************************************** . Completion time: 2012-08-05 12:36:30 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-05 16:36 . Pre-Run: 315,740,917,760 bytes free Post-Run: 316,381,765,632 bytes free . - - End Of File - - FE0E7A77E01C6B184D820D5C252CAEED
  5. I get an error during combofix Error opening C:\32788r22fwjfw\License\iexplorer.exe When i ignore error, I dont have a updated Combofix file.
  6. I just used the restore point, Everything seems normal agin, here is the log. SystemLook 30.07.11 by jpshortstuff Log created at 13:25 on 05/08/2012 by Chris n Mimi Administrator - Elevation successful ========== Filefind ========== Searching for "services.exe" C:\Windows\System32\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 014A9CB92514E27C0107614DF764BC06 C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 24ACB7E5BE595468E3B9AA488B9B4FCB -= EOF =-
  7. Ran the program! It turned off my wifi and video setting and some other stuff, And it didnt make a restore point, And the restore point i made is missing..Computers in worse shape now that it was before i ran ComboFix ComboFix 12-08-05.02 - Chris n Mimi 05/08/2012 12:10:20.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.4091.2635 [GMT -4:00] Running from: c:\users\Chris n Mimi\Downloads\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini . c:\windows\system32\Services.exe . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2012-07-05 to 2012-08-05 ))))))))))))))))))))))))))))))) . . 2012-08-05 16:30 . 2012-08-05 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-08-02 18:04 . 2012-08-02 18:04 -------- d-----w- c:\users\Chris n Mimi\AppData\Roaming\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\programdata\Malwarebytes 2012-08-02 18:03 . 2012-08-02 18:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-08-02 18:03 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-01 07:00 . 2012-08-01 07:00 -------- d-----w- c:\program files (x86)\ConvertHelper 2012-08-01 06:53 . 2012-08-01 06:57 -------- d-----w- c:\users\Chris n Mimi\dwhelper 2012-07-23 21:54 . 2012-07-23 21:54 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\ElevatedDiagnostics 2012-07-18 03:56 . 2012-07-18 03:56 -------- d-----w- c:\program files\Speccy 2012-07-18 01:57 . 2012-07-18 01:57 -------- d-----w- c:\users\UpdatusUser 2012-07-18 01:56 . 2012-05-15 09:29 889664 ----a-w- c:\windows\system32\nvvsvc.exe 2012-07-18 01:56 . 2012-05-15 09:29 63296 ----a-w- c:\windows\system32\nvshext.dll 2012-07-18 01:56 . 2012-05-15 09:29 2561856 ----a-w- c:\windows\system32\nvsvcr.dll 2012-07-18 01:56 . 2012-05-15 09:29 118080 ----a-w- c:\windows\system32\nvmctray.dll 2012-07-18 01:56 . 2012-05-15 09:29 3149632 ----a-w- c:\windows\system32\nvsvc64.dll 2012-07-18 01:56 . 2012-05-15 09:28 6151488 ----a-w- c:\windows\system32\nvcpl.dll 2012-07-18 01:56 . 2012-05-15 10:48 68928 ----a-w- c:\windows\system32\OpenCL.dll 2012-07-18 01:56 . 2012-05-15 10:48 61248 ----a-w- c:\windows\SysWow64\OpenCL.dll 2012-07-18 01:56 . 2012-07-18 01:56 -------- d-----w- c:\programdata\NVIDIA Corporation 2012-07-18 01:51 . 2012-07-18 01:51 -------- d-----w- c:\program files\CCleaner 2012-07-15 14:26 . 2012-07-15 14:47 -------- d-----w- c:\program files (x86)\Rosetta Stone 2012-07-15 14:12 . 2012-07-15 14:23 -------- d-----w- C:\rosetta 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\Xiph.Org 2012-07-12 14:54 . 2012-07-12 14:54 -------- d-----w- c:\program files (x86)\TVersity Codec Pack 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\users\Chris n Mimi\AppData\Local\Conduit 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\program files (x86)\TVersitybar 2012-07-12 14:53 . 2012-07-12 14:53 -------- d-----w- c:\programdata\TVersity 2012-07-10 11:27 . 2012-07-10 11:27 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-03 15:03 . 2012-04-30 02:39 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-08-03 15:03 . 2012-04-30 02:39 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-05-21 06:42 . 2012-05-21 06:42 231376 ----a-w- c:\windows\system32\drivers\truecrypt.sys . . ------- Sigcheck ------- Note: Unsigned files aren't necessarily malware. . [7] 2009-07-14 . 24ACB7E5BE595468E3B9AA488B9B4FCB . 328704 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe [-] 2009-07-14 . 014A9CB92514E27C0107614DF764BC06 . 328704 . . [6.1.7600.16385] .. c:\windows\system32\services.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{66bd2442-241b-44cd-8c7a-b51037053cdb}] 2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\TVersitybar\prxtbTVer.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{66bd2442-241b-44cd-8c7a-b51037053cdb}"= "c:\program files (x86)\TVersitybar\prxtbTVer.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{66bd2442-241b-44cd-8c7a-b51037053cdb}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-04 1353080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056] R4 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-05 113120] R4 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-05-15 1262400] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-04-18 188736] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-08-05 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 15:03] . 2012-08-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000Core.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . 2012-08-05 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4203899070-259090772-3981430821-1000UA.job - c:\users\Chris n Mimi\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-31 00:39] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = *.local LSP: mswsock.dll TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Chris n Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\dpdtnpbh.default\ . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Steam\SteamService.exe . ************************************************************************** . Completion time: 2012-08-05 12:36:30 - machine was rebooted ComboFix-quarantined-files.txt 2012-08-05 16:36 . Pre-Run: 315,740,917,760 bytes free Post-Run: 316,381,765,632 bytes free . - - End Of File - - FE0E7A77E01C6B184D820D5C252CAEED
  8. I dont have a flash drive Is there some else i can use?
  9. Recently noticed huge lag spikes for no reason, Popped on my Scanner, And found out I had BCminer. Here is my Log: Malware Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Chris n Mimi :: CHRISNMIMI-PC [administrator] 04/08/2012 1:48:34 PM mbam-log-2012-08-04 (14-53-43).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 553883 Time elapsed: 40 minute(s), 33 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Windows\Installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U\00000008.@ (Trojan.Dropper.BCMiner) -> No action taken. (end) RogueKiller V7.6.5 [08/03/2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7600 ) 64 bits version Started in : Normal mode User: Chris n Mimi [Admin rights] Mode: Scan -- Date: 08/04/2012 14:56:53 ¤¤¤ Bad processes: 2 ¤¤¤ [sUSP PATH] MediaServer.exe -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -> KILLED [TermProc] [RESIDUE] MediaServer.exe -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -> KILLED [TermProc] ¤¤¤ Registry Entries: 5 ¤¤¤ [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Chris n Mimi\AppData\Local\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\n.) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : c:\windows\installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\@ --> FOUND [ZeroAccess][FOLDER] U : c:\windows\installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U --> FOUND [ZeroAccess][FOLDER] L : c:\windows\installer\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L --> FOUND [ZeroAccess][FILE] @ : c:\users\chris n mimi\appdata\local\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\@ --> FOUND [ZeroAccess][FOLDER] U : c:\users\chris n mimi\appdata\local\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\U --> FOUND [ZeroAccess][FOLDER] L : c:\users\chris n mimi\appdata\local\{30639c85-cbb6-9e72-5d3f-ed6d208e99ac}\L --> FOUND [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND [susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> CANNOT FIX ¤¤¤ Driver: [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD5000BEVT-22ZAT0 ATA Device +++++ --- User --- [MBR] e34142bfadc0fd026db88ba655e4981c [bSP] 531d0b34e5551103c06668de331de7b0 : Windows 7 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13000 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 26626048 | Size: 100 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 26830848 | Size: 463838 Mo 3 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 250 | Size: 198 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1].txt >> RKreport[1].txt Id Much rather remove the poblem then have to formate Thanks for any help in advance <3
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.