Jump to content

terra24

Members
 View Profile  See their activity

  • Posts

    9

  • Joined

  • Last visited

 Content Type 

Posts posted by terra24

    remove a Babylon infection

    in Resolved Malware Removal Logs

    Posted

    Hi CatByte

    I tried all browsers , all seem to be babylon free. I changed everything back to the settings where it would show up ie home page set to a page rather than a bookmark etc thats where the new page would be hijacked and all is working properly. I have opened and closed the browsers a few times and tested again. No problems found.

    I would say that the problem has been fixed.

    Thank you. I will be making a donation.

    Do I need to uninstall the tools etc.. any special removal instructions.

    remove a Babylon infection

    in Resolved Malware Removal Logs

    Posted

    Hi CatByte

    I ran the OTL as described, log is below.

    All browsers now seem free of Babylon search. (thankyou)

    All processes killed

    ========== OTL ==========

    HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

    HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

    Registry key HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\PROGRA~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll deleted successfully.

    File move failed. c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18 scheduled to be moved on reboot.

    Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.

    ========== FILES ==========

    < ipconfig /flushdns /c >

    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    C:\Users\Terra-x\Desktop\cmd.bat deleted successfully.

    C:\Users\Terra-x\Desktop\cmd.txt deleted successfully.

    ========== COMMANDS ==========

    C:\Windows\System32\drivers\etc\Hosts moved successfully.

    HOSTS file reset successfully

    [EMPTYTEMP]

    User: All Users

    User: Default

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 0 bytes

    User: Jeremy

    ->Temp folder emptied: 0 bytes

    ->Temporary Internet Files folder emptied: 314162258 bytes

    ->Java cache emptied: 0 bytes

    ->FireFox cache emptied: 85022900 bytes

    ->Google Chrome cache emptied: 432230100 bytes

    ->Flash cache emptied: 5881 bytes

    User: Public

    ->Temp folder emptied: 0 bytes

    User: Terra-x

    ->Temp folder emptied: 67545 bytes

    ->Temporary Internet Files folder emptied: 21287849 bytes

    ->Java cache emptied: 0 bytes

    ->FireFox cache emptied: 9949860 bytes

    ->Google Chrome cache emptied: 7690576 bytes

    ->Flash cache emptied: 2675 bytes

    %systemdrive% .tmp files removed: 0 bytes

    %systemroot% .tmp files removed: 0 bytes

    %systemroot%\System32 .tmp files removed: 0 bytes

    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes

    %systemroot%\System32\drivers .tmp files removed: 0 bytes

    Windows Temp folder emptied: 0 bytes

    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36074817 bytes

    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 865.00 mb

    OTL by OldTimer - Version 3.2.69.0 log created on 12022012_104948

    Files\Folders moved on Reboot...

    c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings folder moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content folder moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components folder moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension folder moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} folder moved successfully.

    C:\ProgramData\Browser Manager\2.5.911.18 folder moved successfully.

    C:\ProgramData\Browser Manager folder moved successfully.

    C:\Users\Terra-x\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...

    remove a Babylon infection

    in Resolved Malware Removal Logs

    Posted

    Hi CatByte

    I ran the combofix as described the log is below.

    The Babylon appears to be fixed in firefox and chrome but is still present in the address bar of IE 9.

    ComboFix 12-12-01.02 - Terra-x 02/12/2012 8:06.2.8 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.8169.5443 [GMT 11:00]

    Running from: c:\users\Terra-x\Desktop\ComboFix.exe

    Command switches used :: c:\users\Terra-x\Desktop\CFScript.txt

    AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    FILE ::

    "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip"

    "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip"

    "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip"

    "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip"

    "d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip"

    "d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip"

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip

    d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip

    d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip

    d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip

    d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip

    d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-11-01 to 2012-12-01 )))))))))))))))))))))))))))))))

    .

    .

    2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Jeremy\AppData\Local\temp

    2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-12-01 06:25 . 2012-12-01 06:25 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

    2012-12-01 03:34 . 2012-12-01 03:34 -------- d-----w- c:\program files (x86)\ESET

    2012-12-01 02:50 . 2012-12-01 02:50 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\offreg.dll

    2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- c:\windows\ERUNT

    2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- C:\JRT

    2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----r- c:\program files (x86)\Skype

    2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----w- c:\program files (x86)\Common Files\Skype

    2012-11-30 20:42 . 2012-11-30 20:43 -------- d-----w- c:\programdata\Skype

    2012-11-30 20:41 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\mpengine.dll

    2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\programdata\Malwarebytes

    2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    2012-11-25 00:39 . 2012-09-29 08:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-11-24 06:10 . 2012-11-24 06:10 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

    2012-11-24 06:05 . 2012-11-24 06:05 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

    2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Symantec

    2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Common Files\Symantec Shared

    2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\windows\system32\drivers\NISx64

    2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\program files (x86)\Norton Internet Security

    2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\programdata\Norton

    2012-11-24 06:03 . 2012-11-24 06:03 -------- d-----w- c:\program files (x86)\NortonInstaller

    2012-11-24 04:26 . 2012-11-24 04:26 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

    2012-11-23 23:30 . 2012-11-23 23:30 -------- d-----w- c:\programdata\Browser Manager

    2012-11-23 23:02 . 2012-11-23 23:01 1174993 ----a-w- c:\windows\unins001.exe

    2012-11-23 23:02 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\WIMBLEMS.sys

    2012-11-23 22:57 . 2012-11-23 23:02 -------- d-----w- c:\program files (x86)\Corsair

    2012-11-23 22:57 . 2012-11-23 22:56 1174993 ----a-w- c:\windows\unins000.exe

    2012-11-23 22:57 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\CORSGKB.sys

    2012-11-23 22:33 . 2006-08-20 19:06 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\SSGR1pc.dll

    2012-11-23 22:33 . 2006-11-21 00:40 89600 ----a-w- c:\windows\system32\SSGR1ci.dll

    2012-11-23 22:33 . 2006-11-19 21:22 151552 ----a-w- c:\windows\system32\SSGR1ci.exe

    2012-11-23 22:33 . 2009-03-02 03:12 11576 ------w- c:\windows\system32\drivers\SSPORT.SYS

    2012-11-23 22:33 . 2009-03-02 03:12 53816 ------w- c:\windows\system32\drivers\DGIVECP.SYS

    2012-11-23 22:33 . 2012-11-23 22:33 -------- d-----w- c:\program files (x86)\SAMSUNG

    2012-11-20 11:48 . 2012-11-20 11:49 -------- d-----w- c:\users\Terra-x

    2012-11-20 11:32 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll

    2012-11-20 11:32 . 2012-08-23 13:20 54272 ----a-w- c:\windows\system32\MsRdpWebAccess.dll

    2012-11-20 11:32 . 2012-08-23 11:20 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe

    2012-11-20 11:32 . 2012-08-23 11:14 384000 ----a-w- c:\windows\system32\wksprt.exe

    2012-11-20 11:32 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll

    2012-11-20 11:32 . 2012-08-23 10:39 1048064 ----a-w- c:\windows\SysWow64\mstsc.exe

    2012-11-20 11:32 . 2012-08-23 10:22 1123840 ----a-w- c:\windows\system32\mstsc.exe

    2012-11-20 11:32 . 2012-08-23 09:51 3174912 ----a-w- c:\windows\system32\rdpcorets.dll

    2012-11-20 11:32 . 2012-08-23 08:19 4916224 ----a-w- c:\windows\SysWow64\mstscax.dll

    2012-11-20 11:32 . 2012-08-23 08:13 5773824 ----a-w- c:\windows\system32\mstscax.dll

    2012-11-20 11:24 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys

    2012-11-20 11:24 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll

    2012-11-20 11:24 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

    2012-11-20 11:24 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

    2012-11-20 11:24 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll

    2012-11-20 11:24 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll

    2012-11-20 11:24 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

    2012-11-20 11:24 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

    2012-11-20 11:24 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

    2012-11-20 11:24 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll

    2012-11-20 11:24 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

    2012-11-19 19:03 . 2012-11-19 19:03 -------- d-----w- c:\users\Jeremy\AppData\Local\Macromedia

    2012-11-19 11:34 . 2012-11-19 11:35 -------- d-----w- c:\users\Jeremy\AppData\Roaming\FileZilla

    2012-11-19 07:56 . 2012-11-19 07:56 -------- d-----w- c:\program files (x86)\FileZilla FTP Client

    2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files\Microsoft Silverlight

    2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files (x86)\Microsoft Silverlight

    2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Common Files\Java

    2012-11-19 07:15 . 2012-11-19 07:15 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-11-19 07:15 . 2012-11-19 07:15 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-11-19 07:15 . 2012-11-19 07:15 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Java

    2012-11-19 06:46 . 2012-08-21 02:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

    2012-11-19 06:45 . 2012-11-19 06:45 -------- d-----w- c:\program files\iPod

    2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files\iTunes

    2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files (x86)\iTunes

    2012-11-18 12:21 . 2012-10-09 18:17 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

    2012-11-18 12:21 . 2012-10-09 17:40 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

    2012-11-18 12:21 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

    2012-11-18 12:21 . 2012-10-09 17:40 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

    2012-11-18 11:33 . 2012-11-20 01:18 -------- d-----w- c:\program files (x86)\Microsoft Works

    2012-11-18 11:32 . 2012-11-18 11:32 -------- d-----w- c:\windows\PCHEALTH

    2012-11-18 11:26 . 2012-11-18 11:26 -------- d-----w- c:\program files\Microsoft Office

    2012-11-18 11:24 . 2012-11-18 11:24 -------- d-----r- C:\MSOCache

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

    2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

    2012-11-18 11:08 . 2012-11-18 11:08 -------- d-----w- c:\program files (x86)\QuickTime

    2012-11-18 10:04 . 2012-11-18 10:04 -------- d-----w- c:\users\Jeremy\AppData\Local\Mozilla

    2012-11-18 09:04 . 2012-11-18 09:04 -------- d-----w- c:\windows\system32\SPReview

    2012-11-18 09:02 . 2012-11-18 09:02 -------- d-----w- c:\windows\system32\EventProviders

    2012-11-18 09:00 . 2012-10-29 10:04 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-11-18 08:57 . 2012-11-18 09:47 -------- d-----w- c:\program files\CPUID

    2012-11-18 08:46 . 2012-11-18 08:46 -------- d--h--w- c:\programdata\.syncID

    2012-11-18 08:45 . 2012-11-29 11:09 -------- d--h--w- c:\programdata\.Syncables

    2012-11-18 08:16 . 2012-05-31 01:25 279656 ------w- c:\windows\system32\MpSigStub.exe

    2012-11-18 07:41 . 2012-11-18 07:41 -------- d-----w- C:\WINSSLog

    2012-11-17 23:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-17 23:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-17 23:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-17 23:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-17 23:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-17 23:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-17 23:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-17 23:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-17 23:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-17 23:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-17 23:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-17 04:56 . 2012-10-18 18:25 3149824 ----a-w- c:\windows\system32\win32k.sys

    2012-11-17 04:55 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll

    2012-11-17 04:55 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-01 01:43 . 2012-04-18 13:15 45056 ----a-w- c:\windows\system32\acovcnt.exe

    2012-11-19 07:22 . 2012-09-07 02:28 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-11-19 07:22 . 2012-09-07 02:28 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-11-18 09:17 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll

    2012-11-18 09:17 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll

    2012-10-24 16:12 . 2012-10-24 16:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

    2012-10-24 16:12 . 2012-10-24 16:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

    2012-10-16 08:38 . 2012-11-28 02:53 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38 . 2012-11-28 02:53 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39 . 2012-11-28 02:53 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

    2012-09-14 19:19 . 2012-10-09 06:12 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-09 06:12 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

    "ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-06 222496]

    "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]

    "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]

    "Syncables"="c:\program files (x86)\syncables\syncables desktop\Syncables.exe" [2010-07-19 370480]

    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-11-09 17877168]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

    "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

    "UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

    "Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

    "FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-01-21 40448]

    "ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

    "HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

    "Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]

    "ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2012-04-18 3058304]

    "THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-01-28 907776]

    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

    "CPMonitor"="c:\program files (x86)\Roxio\CinePlayer\5.0\CPMonitor.exe" [2010-10-15 84464]

    "VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-24 421888]

    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-02 252848]

    "Corsair laver"="c:\program files (x86)\Corsair\K90 Keyboard\K90Hid.exe" [2012-05-21 1780736]

    "Corsair M60 Mouse"="c:\program files (x86)\Corsair\M60 Mouse\M60Hid.exe" [2012-05-21 1766400]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-2-4 548528]

    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1083680]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

    "LoadAppInit_DLLs"=1 (0x1)

    "AppInit_DLLs"=c:\progra~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-11-21 3290304]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

    R2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312]

    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]

    R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-04-18 79360]

    R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-04-18 79360]

    R3 DIRECTIO;DIRECTIO;E:\DirectIo.sys [x]

    R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]

    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

    R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920]

    R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-17 1255736]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]

    S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1300000.080\SYMDS64.SYS [2011-05-16 451192]

    S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1300000.080\SYMEFA64.SYS [2011-05-16 1083512]

    S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]

    S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20121106.001\BHDrvx64.sys [2012-11-06 1384608]

    S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1300000.080\ccSetx64.sys [2011-05-23 165512]

    S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20121130.001\IDSvia64.sys [2012-11-23 513184]

    S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1300000.080\Ironx64.SYS [2011-05-16 189560]

    S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1300000.080\SYMNETS.SYS [2011-05-09 396408]

    S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]

    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]

    S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe [2011-05-24 138760]

    S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-03-02 11576]

    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-28 378984]

    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832]

    S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]

    S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-12-14 53800]

    S3 CORSGKB;Corsair Gaming Keyboard;c:\windows\system32\drivers\CORSGKB.sys [2012-03-26 25600]

    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-11-25 138912]

    S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2011-01-21 161280]

    S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2011-01-21 50176]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]

    S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]

    S3 WIMBLEMS;Corsair M60 Gaming Mouse;c:\windows\system32\drivers\WIMBLEMS.sys [2012-03-26 25600]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-07 07:22]

    .

    2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15]

    .

    2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

    @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

    [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

    2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

    @="{64174815-8D98-4CE6-8646-4C039977D808}"

    [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

    2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]

    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-22 11075176]

    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

    "IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

    "SynAsusAcpi"="c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe" [bU]

    "THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920]

    "Setwallpaper"="c:\programdata\SetWallpaper.cmd" [bU]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://www.google.com.au/

    mStart Page = hxxp://asus.msn.com

    mLocal Page = c:\windows\SysWOW64\blank.htm

    TCP: DhcpNameServer = 10.0.0.138

    FF - ProfilePath - c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\

    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/

    FF - ExtSQL: 2012-11-24 17:05; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn

    FF - ExtSQL: 2012-11-27 21:11; support@lastpass.com; c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\extensions\support@lastpass.com

    FF - ExtSQL: 2012-12-01 07:43; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

    FF - ExtSQL: 2012-12-01 11:53; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-Locked - (no file)

    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

    ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)

    .

    .

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]

    "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\diMaster.dll\" /prefetch:1"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

    @Denied: (A) (Everyone)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2012-12-02 08:15:44

    ComboFix-quarantined-files.txt 2012-12-01 21:15

    ComboFix2.txt 2012-12-01 02:59

    .

    Pre-Run: 209,456,168,960 bytes free

    Post-Run: 207,496,204,288 bytes free

    .

    - - End Of File - - F820C63A7DC3F7DCC4E562234C308671

    remove a Babylon infection

    in Resolved Malware Removal Logs

    Posted

    Hi CatByte

    I ran malware bytes no threats found, so I couldn't select and click remove selected. log pasted below:

    Malwarebytes Anti-Malware (Trial) 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.12.01.03

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Terra-x :: ASUS-LAPTOP [administrator]

    Protection: Enabled

    1/12/2012 2:24:42 PM

    mbam-log-2012-12-01 (14-24-42).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 234295

    Time elapsed: 1 minute(s), 34 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    And Eset scan attached.

    ESETSCAN.txt

    remove a Babylon infection

    in Resolved Malware Removal Logs

    Posted

    Hello

    I need to remove a Babylon infection, pretty sure I got it from a Cnet installer and I exited as soon as I saw the word toolbar, I definately didn't authorize anything to install.

    I can keep it at bay in browser search and homepage but its still there when I use the actual address bar.

    Its driving me mad, and I want to add this PC to my network but I am woried it might transfer to the other computers. (this computer has never been on the network before).

    I ran malwarebytes full scan and it came out with no threats found.

    I was also running MS security essentials when it got in, I since changed that to Norton internet security.

    Can anyone help please.

    Cheers

    Keith

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.