Jump to content

obesellama

Members
 View Profile  See their activity

  • Posts

    14

  • Joined

  • Last visited

 Content Type 

Posts posted by obesellama

    Relinking to other website

    in Resolved Malware Removal Logs

    Posted

    & also when I look at some stores clothing it will say "Image not uploaded" but when I click on the image it shows up, also on youtube some videos will play with sound and others will be muted (when theyre supposed to be played with sound) I can -click- on it but it doesn't change or anything.

    Maybe those have nothing to do with it but this all started today. ALSO when I opened it on chrome youtube was fine but when I opened it on firefox it was all.... block ish? like it just showed the plain writing (html?)

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-11-16.02 - Camila 11/19/2012 1:17.3.4 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4395 [GMT -5:00]

    Running from: c:\users\Camila\Downloads\ComboFix.exe

    Command switches used :: c:\users\Camila\Desktop\CFScript.txt

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-19 to 2012-11-19 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-19 06:19 . 2012-11-19 06:19 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-19 06:19 . 2012-11-19 06:19 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-19 05:59 . 2012-11-19 05:59 -------- d-----w- c:\users\Camila\AppData\Roaming\Ad-Aware Antivirus

    2012-11-19 03:00 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{79DB478D-0EBD-42C9-A9A3-07FDCD2B4F01}\mpengine.dll

    2012-11-18 06:42 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

    2012-11-17 01:03 . 2012-11-17 01:03 -------- d-----w- c:\program files (x86)\QuickTime

    2012-11-15 08:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-15 08:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-15 08:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-15 08:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-15 08:02 . 2012-10-08 11:42 10925568 ----a-w- c:\windows\system32\ieframe.dll

    2012-11-15 08:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-15 08:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-15 08:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-15 08:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-15 08:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-15 08:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-15 08:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-04 21:26 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

    2012-11-04 21:26 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys

    2012-11-04 21:26 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll

    2012-11-04 21:26 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll

    2012-11-04 21:26 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll

    2012-11-04 21:26 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

    2012-11-04 21:26 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

    2012-11-04 21:26 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

    2012-11-04 21:26 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

    2012-11-04 21:26 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll

    2012-11-04 21:26 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

    2012-11-02 02:00 . 2012-11-02 02:00 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppwn7.dll

    2012-11-02 01:59 . 2012-11-02 01:59 289792 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpcpp6dn.DLL

    2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

    2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

    2012-10-22 05:05 . 2012-10-22 05:05 -------- d-----w- c:\program files (x86)\HP

    2012-10-21 21:17 . 2012-10-17 03:17 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    2012-10-21 21:17 . 2012-10-17 03:17 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49B0B3B4-8D3F-4547-B3CA-09FCF6B38E50}\gapaengine.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-15 08:01 . 2011-07-07 13:22 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-10-16 21:48 . 2012-04-14 15:47 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-16 21:48 . 2011-10-12 21:39 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-09-29 23:54 . 2012-10-18 06:05 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-09-14 19:19 . 2012-10-16 16:23 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-16 16:23 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-08-31 18:19 . 2012-10-16 16:23 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

    2012-08-31 02:03 . 2012-08-31 02:03 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

    2012-08-30 18:03 . 2012-10-15 23:10 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-15 23:10 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    2012-08-30 17:12 . 2012-10-15 23:10 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2012-08-30 07:27 . 2012-10-16 16:20 9308616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{396E5F65-D028-4220-AA37-4DE4DA3CFECB}\mpengine.dll

    2012-08-24 18:05 . 2012-10-16 16:23 220160 ----a-w- c:\windows\system32\wintrust.dll

    2012-08-24 16:57 . 2012-10-16 16:23 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

    2012-08-22 18:12 . 2012-09-12 01:46 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

    2012-08-22 18:12 . 2012-09-12 01:46 376688 ----a-w- c:\windows\system32\drivers\netio.sys

    2012-08-22 18:12 . 2012-09-12 01:46 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

    2012-08-21 21:01 . 2012-09-26 00:58 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

    2012-08-21 17:01 . 2012-09-13 03:44 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

    2012-08-21 17:01 . 2011-06-23 22:40 125872 ----a-w- c:\windows\system32\GEARAspi64.dll

    2012-08-21 17:01 . 2011-06-23 22:40 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll

    2012-08-21 09:12 . 2011-11-19 12:58 285328 ----a-w- c:\windows\system32\aswBoot.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]

    2012-09-20 20:06 87448 ----a-w- c:\program files (x86)\adawaretb\adawareDx.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

    "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-09-20 87448]

    .

    [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]

    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776]

    "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-08-08 540056]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    "HideFastUserSwitching"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

    "EnableShellExecuteHooks"= 1 (0x1)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

    "LoadAppInit_DLLs"=1 (0x1)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

    R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

    R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-03-10 1086520]

    R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2011-02-01 174168]

    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-24 1255736]

    R3 X6va005;X6va005;c:\users\Camila\AppData\Local\Temp\005941A.tmp [x]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2008-06-16 55024]

    S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]

    S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-06-24 89600]

    S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

    S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 30520]

    S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

    S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]

    S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]

    S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-22 2656280]

    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]

    S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-02-09 77424]

    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-08-18 1145960]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-19 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 21:48]

    .

    2012-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3125647080-838988720-1988284257-1000Core.job

    - c:\users\Camila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 01:22]

    .

    2012-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3125647080-838988720-1988284257-1000UA.job

    - c:\users\Camila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 01:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-05 391704]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

    TCP: DhcpNameServer = 128.172.1.5 128.172.90.11

    FF - ProfilePath - c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=

    FF - ExtSQL: 2012-09-25 23:15; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi

    FF - ExtSQL: 2012-10-16 23:49; {87934c42-161d-45bc-8cef-ef18abe2a30c}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}

    FF - ExtSQL: 2012-10-22 01:03; {ab91efd4-6975-4081-8552-1b3922ed79e2}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

    FF - ExtSQL: 2012-10-24 19:10; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-10 - (no file)

    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

    .

    .

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\mchInjDrv]

    "ImagePath"="\??\c:\windows\TEMP\mc26A65.tmp"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]

    "ImagePath"="\??\c:\users\Camila\AppData\Local\Temp\005941A.tmp"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-3125647080-838988720-1988284257-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{11DD574D-6389-D90B-5198-AD20F7C8D644}*]

    "hajihigkhfjeojne"=hex:6a,61,66,66,66,67,6c,68,65,6b,63,63,66,6c,64,68,70,6f,

    69,61,00,00

    "gaahbfdkeheokj"=hex:61,63,6e,65,6b,63,67,62,63,66,6d,67,6c,6e,61,70,66,6f,6d,

    65,65,64,6f,61,63,68,63,6b,6a,6d,61,62,6c,6d,6a,62,70,67,67,68,6a,65,70,66,\

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @DACL=(02 0010)

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @DACL=(02 0010)

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @DACL=(02 0010)

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2012-11-19 01:20:53

    ComboFix-quarantined-files.txt 2012-11-19 06:20

    ComboFix2.txt 2012-11-19 06:08

    .

    Pre-Run: 389,305,393,152 bytes free

    Post-Run: 389,248,798,720 bytes free

    .

    - - End Of File - - E3DAAD77F551946D2D277F9C39F1023F

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-11-16.02 - Camila 11/19/2012 1:02.2.4 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4115 [GMT -5:00]

    Running from: c:\users\Camila\Downloads\ComboFix.exe

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-19 to 2012-11-19 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-19 06:06 . 2012-11-19 06:06 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-19 06:06 . 2012-11-19 06:06 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-19 05:59 . 2012-11-19 05:59 -------- d-----w- c:\users\Camila\AppData\Roaming\Ad-Aware Antivirus

    2012-11-19 03:00 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{79DB478D-0EBD-42C9-A9A3-07FDCD2B4F01}\mpengine.dll

    2012-11-18 06:42 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

    2012-11-17 01:03 . 2012-11-17 01:03 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

    2012-11-17 01:03 . 2012-11-17 01:03 -------- d-----w- c:\program files (x86)\QuickTime

    2012-11-15 08:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-15 08:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-15 08:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-15 08:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-15 08:02 . 2012-10-08 11:42 10925568 ----a-w- c:\windows\system32\ieframe.dll

    2012-11-15 08:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-15 08:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-15 08:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-15 08:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-15 08:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-15 08:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-15 08:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-04 21:26 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

    2012-11-04 21:26 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys

    2012-11-04 21:26 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll

    2012-11-04 21:26 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll

    2012-11-04 21:26 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll

    2012-11-04 21:26 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

    2012-11-04 21:26 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

    2012-11-04 21:26 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

    2012-11-04 21:26 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

    2012-11-04 21:26 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll

    2012-11-04 21:26 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

    2012-11-02 02:00 . 2012-11-02 02:00 101376 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppwn7.dll

    2012-11-02 01:59 . 2012-11-02 01:59 289792 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpcpp6dn.DLL

    2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

    2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

    2012-10-22 05:05 . 2012-10-22 05:05 -------- d-----w- c:\program files (x86)\HP

    2012-10-21 21:17 . 2012-10-17 03:17 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    2012-10-21 21:17 . 2012-10-17 03:17 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{49B0B3B4-8D3F-4547-B3CA-09FCF6B38E50}\gapaengine.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-15 08:01 . 2011-07-07 13:22 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-10-16 21:48 . 2012-04-14 15:47 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-16 21:48 . 2011-10-12 21:39 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-09-29 23:54 . 2012-10-18 06:05 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-09-14 19:19 . 2012-10-16 16:23 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-16 16:23 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-08-31 18:19 . 2012-10-16 16:23 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2012-08-31 02:03 . 2012-08-31 02:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

    2012-08-31 02:03 . 2012-08-31 02:03 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

    2012-08-30 18:03 . 2012-10-15 23:10 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-15 23:10 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    2012-08-30 17:12 . 2012-10-15 23:10 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2012-08-30 07:27 . 2012-10-16 16:20 9308616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{396E5F65-D028-4220-AA37-4DE4DA3CFECB}\mpengine.dll

    2012-08-24 18:05 . 2012-10-16 16:23 220160 ----a-w- c:\windows\system32\wintrust.dll

    2012-08-24 16:57 . 2012-10-16 16:23 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

    2012-08-22 18:12 . 2012-09-12 01:46 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

    2012-08-22 18:12 . 2012-09-12 01:46 376688 ----a-w- c:\windows\system32\drivers\netio.sys

    2012-08-22 18:12 . 2012-09-12 01:46 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

    2012-08-21 21:01 . 2012-09-26 00:58 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

    2012-08-21 17:01 . 2012-09-13 03:44 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

    2012-08-21 17:01 . 2011-06-23 22:40 125872 ----a-w- c:\windows\system32\GEARAspi64.dll

    2012-08-21 17:01 . 2011-06-23 22:40 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll

    2012-08-21 09:12 . 2011-11-19 12:58 285328 ----a-w- c:\windows\system32\aswBoot.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]

    2012-09-20 20:06 87448 ----a-w- c:\program files (x86)\adawaretb\adawareDx.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

    "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-09-20 87448]

    .

    [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]

    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-10 421776]

    "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-08-08 540056]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    "HideFastUserSwitching"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

    "EnableShellExecuteHooks"= 1 (0x1)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

    "LoadAppInit_DLLs"=1 (0x1)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

    R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

    R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-03-10 1086520]

    R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2011-02-01 174168]

    R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [2008-03-13 27136]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-24 1255736]

    R3 X6va005;X6va005;c:\users\Camila\AppData\Local\Temp\005941A.tmp [x]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2008-06-16 55024]

    S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-10-09 169312]

    S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-06-24 89600]

    S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

    S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 30520]

    S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

    S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]

    S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]

    S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-22 2656280]

    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]

    S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-02-09 77424]

    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-08-18 1145960]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-19 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 21:48]

    .

    2012-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3125647080-838988720-1988284257-1000Core.job

    - c:\users\Camila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 01:22]

    .

    2012-04-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3125647080-838988720-1988284257-1000UA.job

    - c:\users\Camila\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-11 01:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-05 391704]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

    TCP: DhcpNameServer = 128.172.1.5 128.172.90.11

    FF - ProfilePath - c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=

    FF - ExtSQL: 2012-09-25 23:15; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi

    FF - ExtSQL: 2012-10-16 23:49; {87934c42-161d-45bc-8cef-ef18abe2a30c}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}

    FF - ExtSQL: 2012-10-22 01:03; {ab91efd4-6975-4081-8552-1b3922ed79e2}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

    FF - ExtSQL: 2012-10-24 19:10; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-10 - (no file)

    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

    .

    .

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\mchInjDrv]

    "ImagePath"="\??\c:\windows\TEMP\mc26A65.tmp"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]

    "ImagePath"="\??\c:\users\Camila\AppData\Local\Temp\005941A.tmp"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-3125647080-838988720-1988284257-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{11DD574D-6389-D90B-5198-AD20F7C8D644}*]

    "hajihigkhfjeojne"=hex:6a,61,66,66,66,67,6c,68,65,6b,63,63,66,6c,64,68,70,6f,

    69,61,00,00

    "gaahbfdkeheokj"=hex:61,63,6e,65,6b,63,67,62,63,66,6d,67,6c,6e,61,70,66,6f,6d,

    65,65,64,6f,61,63,68,63,6b,6a,6d,61,62,6c,6d,6a,62,70,67,67,68,6a,65,70,66,\

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @DACL=(02 0010)

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @DACL=(02 0010)

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @DACL=(02 0010)

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

    "Key"="ActionsPane3"

    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2012-11-19 01:08:17

    ComboFix-quarantined-files.txt 2012-11-19 06:08

    .

    Pre-Run: 389,533,556,736 bytes free

    Post-Run: 389,241,954,304 bytes free

    .

    - - End Of File - - BDBA3F6D9C6E57E6CE54F0CC6CC2618A

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    RogueKiller V8.3.0 [Nov 18 2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website: http://tigzy.geekstogo.com/roguekiller.php

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Camila [Admin rights]

    Mode : Remove -- Date : 11/18/2012 23:45:47

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 1 ¤¤¤

    [HJPOL] HKCU\[...]\System : disableregistrytools (0) -> DELETED

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost

    128.172.10.97 pay4print

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD5000BEKT-60KA9T0 +++++

    --- User ---

    [MBR] db8fd259f0199b77e81f3e8212a8eb0e

    [bSP] c654edf1e29efa47bb27b1b52f37d17b : Windows 7/8 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 460614 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 943747072 | Size: 16022 Mo

    3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 976560128 | Size: 103 Mo

    User = LL1 ... OK!

    User != LL2 ... KO!

    --- LL2 ---

    [MBR] 65738813e3df82fe4096fe73e94bcece

    [bSP] c654edf1e29efa47bb27b1b52f37d17b : Windows 7/8 MBR Code

    Partition table:

    0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo

    1 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 159793152 | Size: 4000 Mo

    2 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 167985152 | Size: 2000 Mo

    3 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 172081152 | Size: 2000 Mo

    Finished : << RKreport[2]_D_11182012_02d2345.txt >>

    RKreport[1]_S_11182012_02d2345.txt ; RKreport[2]_D_11182012_02d2345.txt

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    # AdwCleaner v2.008 - Logfile created 11/18/2012 at 23:41:24

    # Updated 17/11/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Camila - CAMILA-HP

    # Boot Mode : Normal

    # Running from : C:\Users\Camila\Downloads\adwcleaner(1).exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    Folder Deleted : C:\ProgramData\blekko toolbars

    ***** [Registry] *****

    Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Registry is clean.

    -\\ Mozilla Firefox v16.0.2 (en-US)

    Profile name : default

    File : C:\Users\Camila\AppData\Roaming\Mozilla\Firefox\Profiles\8iu7rq47.default\prefs.js

    [OK] File is clean.

    -\\ Google Chrome v18.0.1025.152

    File : C:\Users\Camila\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [6017 octets] - [16/10/2012 18:20:17]

    AdwCleaner[R2].txt - [6077 octets] - [16/10/2012 18:24:47]

    AdwCleaner[R3].txt - [6137 octets] - [16/10/2012 18:25:38]

    AdwCleaner[s3].txt - [5802 octets] - [16/10/2012 18:26:00]

    AdwCleaner[s4].txt - [1317 octets] - [18/11/2012 23:41:24]

    ########## EOF - C:\AdwCleaner[s4].txt - [1377 octets] ##########

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    Results of screen317's Security Check version 0.99.54

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    Microsoft Security Essentials

    Antivirus up to date!

    `````````Anti-malware/Other Utilities Check:`````````

    Ad-Aware

    Malwarebytes Anti-Malware version 1.65.1.1000

    Java 6 Update 29

    Java version out of Date!

    Adobe Flash Player 11.4.402.287

    Adobe Reader X (10.1.4)

    Mozilla Firefox (16.0.2)

    Google Chrome 18.0.1025.151

    Google Chrome 18.0.1025.152

    ````````Process Check: objlist.exe by Laurent````````

    Microsoft Security Essentials MSMpEng.exe

    Microsoft Security Essentials msseces.exe

    Ad-Aware AAWService.exe is disabled!

    Ad-Aware AAWTray.exe is disabled!

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 1%

    ````````````````````End of Log``````````````````````

    i think i am still infected?

    in Resolved Malware Removal Logs

    Posted

    i posted a while ago on another account that my computer was still being slow sometimes(i have so much memory and expect my computer to be a bit faster really)

    i had the svchost but got it removed with help from the forum.

    a couple a weeks ago on firefox i was getting randomly redirected to some other sites (i would just delete it and open another tab) i cleaned my computer and it kinda went away.

    (it still redirects sometimes on chrome but i dont use that browser)

    help please? and any way of preventing these things?

    attach.txt

    dds.txt

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.