Yukon

October 17, 2012

oh boy. That one is a bugger. Looks like I had or have the later version Aleurion. Thanks for all your help. If anything acts funny I'll have to reformat.

October 16, 2012

All looks good. I think you got it. Is there any way to tell if the trojan was just listening, was it moving info in and out, what port it was using, or how long it had access?

Trying to gauge the severity to consider reformat. This comp is mainly gaming and has no direct access to banking but I do buy stuff online from time to time. Everything of note can be redownloaded from the cloud. I did put in Scotty. Any other precautions I could follow to help protect it or is reformat the only best answer?

October 16, 2012

Scan clean.

That's the only log in there but it looks and dates the same as the last one.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

October 15, 2012

ComboFix 12-10-14.03 - Mark 10/15/2012 3:47.3.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3797.2348 [GMT -5:00]

Running from: c:\users\Mark\Desktop\ComboFix.exe

Command switches used :: c:\users\Mark\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Mark\AppData\Roaming\DCE93291

.

((((((((((((((((((((((((( Files Created from 2012-09-15 to 2012-10-15 )))))))))))))))))))))))))))))))

.

2012-10-15 08:53 . 2012-10-15 08:53 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-15 01:13 . 2012-10-15 01:13 -------- d-----w- c:\users\Mark\AppData\Roaming\WinPatrol

2012-10-15 01:13 . 2012-10-15 01:13 -------- d-----w- c:\programdata\InstallMate

2012-10-15 01:13 . 2012-10-15 01:13 -------- d-----w- c:\program files (x86)\BillP Studios

2012-10-14 21:08 . 2012-08-30 05:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9F1B1531-07C5-4123-85A0-FBFE730160C3}\mpengine.dll

2012-10-14 14:46 . 2012-05-08 23:34 32600 ----a-w- c:\windows\system32\SmartDefragBootTime.exe

2012-10-14 14:46 . 2010-11-26 23:02 17720 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys

2012-10-14 06:05 . 2012-10-14 06:05 -------- d-----w- c:\program files\CCleaner

2012-10-14 06:04 . 2012-10-14 06:04 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-10-14 06:03 . 2012-10-14 06:00 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-10-14 06:01 . 2012-10-14 06:00 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-10-14 06:00 . 2012-10-14 06:00 -------- d-----w- c:\program files (x86)\Java

2012-10-14 05:59 . 2012-10-14 05:59 -------- d-----w- c:\programdata\McAfee

2012-10-14 05:49 . 2012-10-14 05:49 -------- d-----w- c:\program files (x86)\VS Revo Group

2012-10-14 05:08 . 2012-10-14 12:21 -------- d-----w- C:\TDSSKiller_Quarantine

2012-10-12 09:54 . 2012-08-30 05:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-10-12 09:30 . 2012-10-12 09:30 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-10-12 09:30 . 2012-10-12 09:30 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-10-12 09:30 . 2012-10-12 09:30 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-10-12 06:46 . 2012-10-12 06:46 -------- d-----w- c:\users\Mark\AppData\Local\Deployment

2012-10-10 13:47 . 2012-10-12 13:18 -------- d-----w- c:\windows\Microsoft Antimalware

2012-10-10 10:12 . 2012-10-10 10:12 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD4BC360-24BD-489D-B1FD-FCF443124E78}\gapaengine.dll

2012-10-10 10:10 . 2012-10-10 10:10 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-10-10 10:10 . 2012-10-10 10:10 -------- d-----w- c:\program files\Microsoft Security Client

2012-10-09 21:53 . 2012-10-09 21:53 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6C06212F-B0AA-448C-8C6C-40B79A46E8AF}\offreg.dll

2012-10-09 21:30 . 2012-08-30 07:27 9308616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6C06212F-B0AA-448C-8C6C-40B79A46E8AF}\mpengine.dll

2012-10-09 04:16 . 2012-10-09 04:16 -------- d-----w- c:\users\Mark\AppData\Roaming\OpenOffice.org

2012-10-09 04:14 . 2012-10-09 04:14 -------- d-----w- c:\program files (x86)\OpenOffice.org 3

2012-10-02 04:12 . 2012-10-02 04:12 -------- d-----w- c:\program files (x86)\SEGA

2012-10-01 09:26 . 2012-10-01 17:53 -------- d-----w- c:\users\Mark\AppData\Roaming\The Creative Assembly

2012-09-25 23:11 . 2012-08-21 18:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-09-25 23:10 . 2012-09-25 23:10 -------- d-----w- c:\program files\iPod

2012-09-25 23:10 . 2012-09-25 23:11 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-09-25 23:10 . 2012-09-25 23:11 -------- d-----w- c:\program files\iTunes

2012-09-25 23:10 . 2012-09-25 23:11 -------- d-----w- c:\program files (x86)\iTunes

2012-09-25 23:10 . 2012-09-25 23:10 -------- d-----w- c:\programdata\Apple Computer

2012-09-25 23:10 . 2012-10-06 19:32 -------- d-----w- c:\users\Mark\AppData\Local\Apple

2012-09-25 23:10 . 2012-09-25 23:10 -------- d-----w- c:\program files (x86)\Apple Software Update

2012-09-25 23:09 . 2012-09-25 23:09 -------- d-----w- c:\program files\Common Files\Apple

2012-09-25 23:09 . 2012-09-25 23:10 -------- d-----w- c:\program files (x86)\Common Files\Apple

2012-09-25 23:09 . 2012-09-25 23:10 -------- d-----w- c:\programdata\Apple

2012-09-25 19:41 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-13 20:25 . 2012-08-29 16:35 15712 ----a-w- c:\windows\system32\drivers\SWDUMon.sys

2012-10-12 06:24 . 2012-04-13 06:21 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-12 06:24 . 2011-07-07 12:40 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-09 21:55 . 2011-12-06 05:31 65309168 ----a-w- c:\windows\system32\MRT.exe

2012-09-25 02:07 . 2012-08-17 02:03 183152 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2012-09-07 22:04 . 2011-12-06 07:51 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-07 13:15 . 2012-09-07 13:15 12872 ----a-w- c:\windows\system32\bootdelete.exe

2012-09-04 21:50 . 2012-09-04 21:50 2849336 ----a-r- c:\users\Mark\AppData\Roaming\Microsoft\Installer\{3BDDFDBC-29CC-4EB7-AA5A-6C6332A1CD38}\Icon_2.exe

2012-09-04 21:50 . 2012-09-04 21:50 2849336 ----a-r- c:\users\Mark\AppData\Roaming\Microsoft\Installer\{3BDDFDBC-29CC-4EB7-AA5A-6C6332A1CD38}\Icon_1.exe

2012-08-31 03:03 . 2012-08-31 03:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

2012-08-31 03:03 . 2012-08-31 03:03 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

2012-08-22 18:12 . 2012-09-12 15:44 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-12 15:44 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-12 15:44 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-12 15:44 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-21 18:01 . 2012-08-21 18:01 125872 ----a-w- c:\windows\system32\GEARAspi64.dll

2012-08-21 18:01 . 2012-08-21 18:01 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll

2012-08-20 17:38 . 2012-10-09 21:29 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-08-02 17:58 . 2012-09-12 15:44 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-08-02 16:57 . 2012-09-12 15:44 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

2012-07-25 22:51 . 2012-07-25 22:51 42440 ----a-w- c:\windows\SysWow64\xfcodec.dll

2012-07-25 22:51 . 2012-07-25 22:51 28104 ----a-w- c:\windows\system32\xfcodec64.dll

2012-07-23 20:59 . 2012-06-08 05:15 24960 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2012-07-18 18:15 . 2012-08-16 09:51 3148800 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2012-09-20 363752]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Hawking Wireless Utility.lnk - c:\program files (x86)\Hawking\Common\HawkingWirelessUtility.exe [2011-12-5 1630208]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-06 135664]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-06 135664]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]

R3 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2012-10-13 15712]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-06 1255736]

R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]

R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-09-05 64952]

R4 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]

R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R4 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2011-04-15 79488]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2011-04-15 40064]

S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-06-29 204288]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 GREGService;GREGService;c:\program files (x86)\Gateway\Registration\GREGsvc.exe [2011-05-30 36456]

S2 Live Updater Service;Live Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2011-04-22 244624]

S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Hawking\Common\RaRegistry64.exe [2009-10-06 212256]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys [2011-03-17 87168]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-06-29 9371136]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-06-29 309760]

S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys [2011-03-17 188544]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-06-06 231440]

S3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWrt.sys [2011-02-14 44624]

S3 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-03-29 598312]

S3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [2010-01-16 1101600]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-16 533096]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\WinPatrol.exe" [2012-09-20 363752]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

uLocal Page = c:\windows\system32\blank.htm

mDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW

mStart Page = hxxp://www.bing.com/?pc=MAGW

mLocal Page = c:\windows\SysWOW64\blank.htm

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va009]

"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,

7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,

36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0

"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,

64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c

"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,

69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}"=hex:51,66,7a,6c,4c,1d,38,12,33,9a,b5,

a3,d3,20,bf,0a,dd,4e,0a,79,58,05,bd,88

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{F9E44926-2497-46F3-8A25-928136AC079E}"=hex:51,66,7a,6c,4c,1d,38,12,48,4a,f7,

fd,a5,6a,9d,03,f5,33,d1,c1,33,f2,43,8a

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:47,07,9b,a8,59,a3,cd,01

.

[HKEY_USERS\S-1-5-21-1328668111-2955040079-3877466703-1000\Software\SecuROM\License information*]

"datasecu"=hex:64,cb,39,92,8f,d5,c4,c5,ae,a2,43,ef,76,7d,be,5f,09,aa,80,3c,52,

99,b6,8f,b0,ff,2e,68,41,47,61,73,cc,38,9e,b5,2d,36,ef,e5,5b,86,0b,65,a4,20,\

"rkeysecu"=hex:9f,8b,92,ca,2a,25,50,2a,82,f5,96,72,90,4f,38,c1

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-10-15 03:55:09

ComboFix-quarantined-files.txt 2012-10-15 08:55

ComboFix2.txt 2012-10-14 21:05

ComboFix3.txt 2012-10-14 13:52

.

Pre-Run: 738,639,785,984 bytes free

Post-Run: 738,591,084,544 bytes free

.

- - End Of File - - 04AACFE6D1B74AE8C65EC6F1AE5D6D96

October 15, 2012

I looked in DOS and windows view and could not locate that file. Eset scanned in that folder where the file should be so I know it exists. It must be hidden in some manner. Below is the Eset log but it looks awful small.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

October 14, 2012

I re-enabled ms sec essentials after running this combo fix. The comp is certainly behaving much more stably and I see no sign of svchost.exe. You sir are a genius! I'm a Comp tech and I bow to your excellent skills!

If you see anything else that looks or feels strange I can easily delete anything. It's mostly gaming and other software I can always retrieve from the cloud. Just takes a lil time.

ComboFix 12-10-14.03 - Mark 10/14/2012 15:57:47.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3797.2423 [GMT -5:00]

Running from: c:\users\Mark\Desktop\ComboFix.exe

Command switches used :: c:\users\Mark\Desktop\cfscript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-09-14 to 2012-10-14 )))))))))))))))))))))))))))))))

.

2012-10-14 21:04 . 2012-10-14 21:04 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-14 14:46 . 2012-05-08 23:34 32600 ----a-w- c:\windows\system32\SmartDefragBootTime.exe

2012-10-14 14:46 . 2010-11-26 23:02 17720 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys

2012-10-14 14:01 . 2012-08-30 05:27 9308616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B0137904-0436-4B46-BF7A-B8DDC0190A1C}\mpengine.dll