Jump to content

jefftx

Members
 View Profile  See their activity

  • Posts

    11

  • Joined

  • Last visited

 Content Type 

Everything posted by jefftx

  1. jefftx
    no i do not know, and since i didnt hear anything i deleted it
  2. jefftx
    no it came from my computer
  3. jefftx
    he can still see everything i do
  4. jefftx
    AdwCleaner v2.301 - Logfile created 05/24/2013 at 19:13:46 # Updated 16/05/2013 by Xplode # Operating system : Windows 7 Professional (32 bits) # User : cjb - CJB-PC # Boot Mode : Normal # Running from : C:\Users\cjb\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\END File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\Conduit.xml File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin.xml File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin-1.xml File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin-2.xml Folder Deleted : C:\Program Files\Common Files\Speedbit Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\SearchPredict Folder Deleted : C:\ProgramData\APN Folder Deleted : C:\ProgramData\ICQ\ICQToolbar Folder Deleted : C:\ProgramData\InstallMate Folder Deleted : C:\ProgramData\Premium Folder Deleted : C:\ProgramData\SoftSafe Folder Deleted : C:\ProgramData\Speedbit Folder Deleted : C:\ProgramData\visualbee Folder Deleted : C:\Users\cjb\AppData\Local\Conduit Folder Deleted : C:\Users\cjb\AppData\Local\Ilivid Player Folder Deleted : C:\Users\cjb\AppData\Local\visualbeeexe Folder Deleted : C:\Users\cjb\AppData\LocalLow\Conduit Folder Deleted : C:\Users\cjb\AppData\LocalLow\Download and Sa Folder Deleted : C:\Users\cjb\AppData\LocalLow\Toolbar4 Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\CT3284024 Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\extensions\{7aeae561-714b-45f6-ace3-4a8aed6e227b} Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\Smartbar ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\Smart Suggestor Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Softonic Key Deleted : HKLM\Software\APN Key Deleted : HKLM\Software\AskToolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E Key Deleted : HKLM\Software\SpeedBit Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchpredict@speedbit.com] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16476 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com -\\ Mozilla Firefox v20.0.1 (en-US) File : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\prefs.js C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\user.js ... Deleted ! Deleted : user_pref("CT3284024.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3284024.FF19Solved", "true"); Deleted : user_pref("CT3284024.FirstTime", "true"); Deleted : user_pref("CT3284024.FirstTimeFF3", "true"); Deleted : user_pref("CT3284024.LoginRevertSettingsEnabled", true); Deleted : user_pref("CT3284024.RevertSettingsEnabled", true); Deleted : user_pref("CT3284024.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...] Deleted : user_pref("CT3284024.UserID", "UN35193696604262309"); Deleted : user_pref("CT3284024.addressBarTakeOverEnabledInHidden", "true"); Deleted : user_pref("CT3284024.autoDisableScopes", 0); Deleted : user_pref("CT3284024.browser.search.defaultthis.engineName", "true"); Deleted : user_pref("CT3284024.defaultSearch", "true"); Deleted : user_pref("CT3284024.enableAlerts", "always"); Deleted : user_pref("CT3284024.enableFix404ByUser", "FALSE"); Deleted : user_pref("CT3284024.enableSearchFromAddressBar", "true"); Deleted : user_pref("CT3284024.firstTimeDialogOpened", "true"); Deleted : user_pref("CT3284024.fixPageNotFoundError", "true"); Deleted : user_pref("CT3284024.fixPageNotFoundErrorByUser", "true"); Deleted : user_pref("CT3284024.fixPageNotFoundErrorInHidden", "true"); Deleted : user_pref("CT3284024.fixUrls", true); Deleted : user_pref("CT3284024.installDate", "12/2/2013 7:01:01"); Deleted : user_pref("CT3284024.installId", "120122"); Deleted : user_pref("CT3284024.installType", "conduitnsisintegration"); Deleted : user_pref("CT3284024.isCheckedStartAsHidden", true); Deleted : user_pref("CT3284024.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3284024.isFirstTimeToolbarLoading", "false"); Deleted : user_pref("CT3284024.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Deleted : user_pref("CT3284024.keyword", "true"); Deleted : user_pref("CT3284024.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...] Deleted : user_pref("CT3284024.lastVersion", "10.14.42.7"); Deleted : user_pref("CT3284024.mam_gk_installer_preapproved.enc", "ZmFsc2U="); Deleted : user_pref("CT3284024.migrateAppsAndComponents", true); Deleted : user_pref("CT3284024.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...] Deleted : user_pref("CT3284024.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Deleted : user_pref("CT3284024.openThankYouPage", "false"); Deleted : user_pref("CT3284024.openUninstallPage", "true"); Deleted : user_pref("CT3284024.revertSettingsEnabled", "false"); Deleted : user_pref("CT3284024.searchInNewTabEnabledByUser", "true"); Deleted : user_pref("CT3284024.searchInNewTabEnabledInHidden", "true"); Deleted : user_pref("CT3284024.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Deleted : user_pref("CT3284024.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...] Deleted : user_pref("CT3284024.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...] Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...] Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...] Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...] Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...] Deleted : user_pref("CT3284024.serviceLayer_services_login_10.14.42.7_lastUpdate", "1369110542608"); Deleted : user_pref("CT3284024.serviceLayer_services_serviceMap_lastUpdate", "1369110542223"); Deleted : user_pref("CT3284024.serviceLayer_services_toolbarSettings_lastUpdate", "1369110543562"); Deleted : user_pref("CT3284024.serviceLayer_services_translation_lastUpdate", "1369110542486"); Deleted : user_pref("CT3284024.settingsINI", true); Deleted : user_pref("CT3284024.shouldFirstTimeDialog", "false"); Deleted : user_pref("CT3284024.smartbar.CTID", "CT3284024"); Deleted : user_pref("CT3284024.smartbar.Uninstall", "0"); Deleted : user_pref("CT3284024.smartbar.homepage", "true"); Deleted : user_pref("CT3284024.smartbar.toolbarName", "VisualBee V.1 "); Deleted : user_pref("CT3284024.startPage", "true"); Deleted : user_pref("CT3284024.toolbarBornServerTime", "17-3-2013"); Deleted : user_pref("CT3284024.toolbarCurrentServerTime", "21-5-2013"); Deleted : user_pref("CT3284024_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...] Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=1[...] Deleted : user_pref("Smartbar.ConduitSearchEngineList", "VisualBee V.1 Customized Web Search"); Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024[...] Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results.php?ch_[...] Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3284024"); Deleted : user_pref("browser.search.defaultthis.engineName", "VisualBee V.1 Customized Web Search"); Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&Sea[...] Deleted : user_pref("browser.search.selectedEngine", "VisualBee V.1 Customized Web Search"); Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI[...] Deleted : user_pref("extensions.SmartSuggestor.aid", "20049"); Deleted : user_pref("extensions.SmartSuggestor.ppi", true); Deleted : user_pref("extensions.SmartSuggestor.uid", "a9ac95ce5b21f6be317ac0c4f93d4beb"); Deleted : user_pref("icqtoolbar.allowSendURL", false); Deleted : user_pref("icqtoolbar.engineVerified", false); Deleted : user_pref("icqtoolbar.geolastmodified", 1359628637); Deleted : user_pref("icqtoolbar.hiddenElements", "itb_options"); Deleted : user_pref("icqtoolbar.icqgeo", 1); Deleted : user_pref("icqtoolbar.installTime", "1359628637"); Deleted : user_pref("icqtoolbar.installsource", "1"); Deleted : user_pref("icqtoolbar.newtab_state", "1"); Deleted : user_pref("icqtoolbar.numberOfSearches", 0); Deleted : user_pref("icqtoolbar.previousFFVersion", "17.0.1"); Deleted : user_pref("icqtoolbar.skip_default_search", "no"); Deleted : user_pref("icqtoolbar.uniqueID", "135771786813577166331358233168744"); Deleted : user_pref("icqtoolbar.usageStatstTimestamp", 1359628641); Deleted : user_pref("icqtoolbar.version", "1.4.7"); Deleted : user_pref("icqtoolbar.voucherHideClicks", 0); Deleted : user_pref("icqtoolbar.voucherMoreLinkClicks", 0); Deleted : user_pref("icqtoolbar.voucherRedeemClicks", 0); Deleted : user_pref("icqtoolbar.voucherWasShown", 0); Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CU[...] Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13[...] Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...] Deleted : user_pref("smartbar.machineId", "KDST/BXTNSEFU1MLZ1L3BKKA70KW1PBF7EZKQXSJ71H2029GAGVIURNR8ST987KIFHK[...] Deleted : user_pref("smartbar.originalHomepage", "hxxp://www.yahoo.com/?ilc=8"); Deleted : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.icq.com/search/afe_results.php?ch_id=a[...] Deleted : user_pref("smartbar.originalSearchEngine", "ICQ Search"); -\\ Google Chrome v [unable to get version] File : C:\Users\cjb\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [16737 octets] - [24/05/2013 19:11:53] AdwCleaner[s1].txt - [16876 octets] - [24/05/2013 19:13:46] ########## EOF - C:\AdwCleaner[s1].txt - [16937 octets] ##########
  5. jefftx
    thats where the note came from
  6. jefftx
    ComboFix 13-05-24.01 - cjb 05/24/2013 18:25:19.1.2 - x86 Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3062.1513 [GMT -5:00] Running from: c:\users\cjb\Desktop\ComboFix.exe AV: Kingsoft Antivirus System Defense *Disabled/Updated* {B6A51389-A795-5AC9-13BA-F569D73F3FE8} SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D} SP: Kingsoft Antivirus System Defense *Disabled/Updated* {0DC4F26D-81AF-5547-290A-CE1BACB87555} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Download and Sa c:\programdata\Download and Sa\509e5d4765d0e.ocx c:\programdata\Download and Sa\509e5d4765d47.html c:\programdata\Download and Sa\509e5d4765d7f.js c:\programdata\Download and Sa\bbidfgbpefccaedhclolmacoiifijbbk.crx c:\programdata\Download and Sa\data\509e5d4765d7f.js c:\programdata\Download and Sa\data\jsondb.js c:\programdata\Download and Sa\settings.ini c:\users\cjb\AppData\Roaming\mdinc.dll c:\users\cjb\rgvzyybnxqwnwhlfxugnjqg.exe c:\windows\system32\Temp c:\windows\system32\URTTemp c:\windows\system32\URTTemp\regtlib.exe . . ((((((((((((((((((((((((( Files Created from 2013-04-24 to 2013-05-24 ))))))))))))))))))))))))))))))) . . 2013-05-24 23:08 . 2013-05-24 23:08 -------- d-----w- C:\7509b43c34ba07d9f72f2d10fa08 2013-05-24 22:47 . 2013-05-24 22:47 -------- d-----w- C:\583c598c880622a852 2013-05-24 21:20 . 2013-05-24 21:20 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{30E015FC-2BD1-49F0-8043-0BB31FD7FC89}\offreg.dll 2013-05-24 21:10 . 2013-05-24 21:10 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2013-05-24 08:00 . 2013-05-24 08:00 -------- d-----w- C:\174f3b2bead34a105f6f3266e1361a48 2013-05-23 08:29 . 2012-08-02 16:21 26248 ----a-w- c:\windows\system32\drivers\ElRawDsk.sys 2013-05-23 08:00 . 2013-05-23 08:00 -------- d-----w- C:\900e04d6e6dcfe836b 2013-05-23 04:07 . 2010-09-20 16:36 340480 ---ha-w- C:\Speak Text.exe 2013-05-23 04:07 . 2009-11-04 23:20 83456 ---ha-w- C:\wifv.exe 2013-05-23 04:07 . 2011-02-08 19:58 579576 ----a-w- c:\windows\system32\Codejock.SkinFramework.v15.0.1.ocx 2013-05-23 04:07 . 2010-09-10 21:38 211456 ----a-w- c:\windows\system32\MediaCopeShellM.dll 2013-05-23 04:07 . 2013-05-23 04:07 -------- d-----w- c:\program files\Media Cope 2013-05-23 04:07 . 2010-09-10 21:37 211456 ----a-w- c:\windows\system32\MediaCopeShellS.dll 2013-05-22 08:00 . 2013-05-22 08:01 -------- d-----w- C:\6746e963838c373a8cf822b03ddd3b89 2013-05-22 00:06 . 2013-05-23 08:30 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\CrashDumps 2013-05-22 00:05 . 2013-05-22 00:05 -------- d-----w- C:\105009d7215d76f8fd 2013-05-21 12:17 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{30E015FC-2BD1-49F0-8043-0BB31FD7FC89}\mpengine.dll 2013-05-19 04:42 . 2013-04-12 13:58 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-05-18 03:39 . 2013-05-18 03:39 50 ----a-w- c:\users\cjb\AppData\Roaming\Update.bat 2013-05-18 03:39 . 2013-05-18 03:39 112 ----a-w- c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.vbs . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-22 05:08 . 2012-10-31 01:27 41616 ----a-w- c:\windows\system32\iolobtdfg.exe 2013-05-22 05:08 . 2012-10-31 01:27 23568 ----a-w- c:\windows\system32\smrgdf.exe 2013-05-22 04:48 . 2012-10-31 01:27 2097472 ----a-w- c:\windows\system32\Incinerator32.dll 2013-05-02 07:06 . 2012-08-30 06:06 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-04-21 23:39 . 2013-04-21 23:39 48640 ----a-w- c:\windows\system32\drivers\KSafeDISK.sys 2013-04-21 23:39 . 2013-04-21 23:39 27648 ----a-w- c:\windows\system32\drivers\BTOWSFF.sys 2013-04-21 23:39 . 2013-04-21 23:39 44928 ----a-w- c:\windows\system32\drivers\BTOWSVF.sys 2013-04-21 20:42 . 2012-08-30 05:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-04-21 20:42 . 2012-08-30 05:49 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-04-07 03:52 . 2013-04-07 03:52 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-04-07 03:52 . 2012-09-25 08:54 861088 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-04-07 03:52 . 2012-09-25 08:54 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-04-04 19:50 . 2012-11-18 10:45 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-03-19 05:06 . 2013-04-19 10:38 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-19 05:06 . 2013-04-19 10:38 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-19 04:54 . 2013-04-19 10:38 38912 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-19 02:50 . 2013-04-19 10:38 69632 ----a-w- c:\windows\system32\smss.exe 2013-03-01 03:11 . 2013-04-19 10:38 2345984 ----a-w- c:\windows\system32\win32k.sys 2013-04-17 08:12 . 2013-04-17 08:11 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-06-11 1524056] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Spotify Web Helper"="c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-07 1105408] "CleanGeniusTray"="c:\program files\CleanGenius 3\CleanGeniusTray.exe" [2012-11-05 505768] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kxesc"="c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" [2012-10-10 1595056] . c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Update.vbs [2013-5-17 112] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "SynchronousMachineGroupPolicy"= 1 (0x1) "SynchronousUserGroupPolicy"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0iolobtdfg c:\windows\system32\0autocheck turegopt . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk] backup=c:\windows\pss\Event Reminder.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup backupExtension=.CommonStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxAutoRun . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-12-19 14:39 41208 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service] 2010-10-28 00:17 207424 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanGeniusTray] 2012-11-05 15:50 505768 ----a-w- c:\program files\CleanGenius 3\CleanGeniusTray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2012-05-25 10:25 6595928 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify] 2013-05-07 04:38 4573184 ----a-w- c:\users\cjb\AppData\Roaming\Spotify\spotify.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper] 2013-05-07 04:38 1105408 ----a-w- c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Spotify Web Helper"="c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QlbCtrl.exe"=c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start "Persistence"=c:\windows\system32\igfxpers.exe "HotKeysCmds"=c:\windows\system32\hkcmd.exe "IgfxTray"=c:\windows\system32\igfxtray.exe . R2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam.sys [x] R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x32.sys [x] R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x] R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x] R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x] R3 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [x] R3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28u.sys [x] R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x] R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [x] R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [x] R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [x] R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynasUSB.sys [x] R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x] R3 VASDeviceDrm;Virtual Audio Streaming with Drm (WDM);c:\windows\system32\drivers\vasdDev.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [x] R4 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x] R4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [x] R4 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x] R4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] S0 BTOWSVF;BTOWSVF;c:\windows\system32\Drivers\BTOWSVF.sys [x] S0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc.sys [x] S0 KSafeDISK;KSafeDISK;c:\windows\system32\Drivers\KSafeDISK.sys [x] S1 BTOWSFF;BTOWSFF;c:\windows\system32\Drivers\BTOWSFF.sys [x] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [x] S1 KDHacker;KDHacker;c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys [x] S2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [x] S2 kxescore;Kingsoft Core Service;c:\program files\kingsoft\kingsoft antivirus\kxescore.exe [x] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x] S2 PDFsFilter;PDFsFilter;c:\windows\system32\DRIVERS\PDFsFilter.sys [x] S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [x] S3 ksapi;ksapi;c:\windows\system32\drivers\ksapi.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x] S3 voxaldriver;Voxal Filter Driver 2.10.00;c:\windows\system32\DRIVERS\voxaldriverx86.sys [x] S4 KUsbGuard;KUsbGuard;c:\program files\kingsoft\kingsoft antivirus\kusbquery.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2013-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-30 20:42] . 2013-02-26 c:\windows\Tasks\Wise Care 365.job - c:\program files\Wise\Wise Care 365\WiseTray.exe [2012-09-03 00:49] . . ------- Supplementary Scan ------- . uStart Page = www.yahoo.com mStart Page = www.yahoo.com IE: Speak Text - c:\program files\Media Cope\Extensions\Speak Text\7.html IE: Upload to Facebook IE: View Full Screen - Best Fit - c:\program files\Media Cope\Extensions\wifv\0.html IE: View Full Screen - Cut Fit Bottom Right - c:\program files\Media Cope\Extensions\wifv\2.html IE: View Full Screen - Cut Fit Equal - c:\program files\Media Cope\Extensions\wifv\3.html IE: View Full Screen - Cut Fit Top Left - c:\program files\Media Cope\Extensions\wifv\1.html IE: View Full Screen - Stretch Fit - c:\program files\Media Cope\Extensions\wifv\4.html TCP: DhcpNameServer = 207.243.120.10 207.243.120.20 192.168.1.1 FF - ProfilePath - c:\users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=3&q={searchTerms}&CUI=UN35193696604262309 FF - prefs.js: browser.search.selectedEngine - VisualBee V.1 Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI=UN35193696604262309 FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CUI=UN35193696604262309&UM=UM_ID&q= FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . - - - - ORPHANS REMOVED - - - - . HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_271_ActiveX.exe SafeBoot-Wdf01000.sys MSConfigStartUp-ICQ - c:\program files\ICQ7.5\ICQ.exe AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a, eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c "{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9, 0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b "{0055C089-8582-441B-A0BF-17B458C2A3A8}"=hex:51,66,7a,6c,4c,1d,38,12,e7,c3,46, 04,b0,cb,75,01,df,a9,54,f4,5d,9c,e7,bc . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:b0,4d,78,00,67,d0,cd,01 . [HKEY_USERS\S-1-5-21-1280333628-3599997341-138837843-1001_Classes\CLSID\{5992bcb3-e29b-42ec-99ce-d895f358dffe}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:00000163 "Therad"=dword:00000022 "MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26, 38,95,44,75,07,18,dd,fb,11,42,94,27,b7,99,0d,2a,ba,05,1a,a2,02,c9,3e,9b,f9,\ . [HKEY_USERS\S-1-5-21-1280333628-3599997341-138837843-1001_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "scansk"=hex(0):2a,8f,a1,54,7f,43,40,52,49,1f,8b,5b,ff,9c,7d,75,60,79,94,1d,e3, ec,c4,47,a6,52,31,ae,5f,35,7f,79,27,3a,3b,40,28,31,6b,3b,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(8188) c:\program files\kingsoft\kingsoft antivirus\kwsui.dll c:\program files\kingsoft\kingsoft antivirus\kswebshield.dll c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll c:\program files\kingsoft\kingsoft antivirus\ktaskbar.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\taskhost.exe c:\windows\System32\rundll32.exe c:\windows\System32\WUDFHost.exe c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe c:\windows\system32\conhost.exe c:\windows\system32\conhost.exe c:\windows\system32\javaw.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Completion time: 2013-05-24 18:45:11 - machine was rebooted ComboFix-quarantined-files.txt 2013-05-24 23:45 . Pre-Run: 78,351,626,240 bytes free Post-Run: 79,465,877,504 bytes free . - - End Of File - - 53B0AA9250212DBB6DAEE332E8022C57 i just recvd a note from this hacker threatening me if i remove the virus
  7. jefftx
    used fixdamge hasnt quit but still shows 0% downloaded
  8. jefftx
    WindowsUpdate_C0000135" "WindowsUpdate_dt000" when i try to install the windows 7 service pack
  9. jefftx
    Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7600 Windows 7 x86 Account is Administrative Internet Explorer version: 9.0.8112.16421 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 1.862000 GHz Memory total: 3210756096, free: 1941180416 ------------ Kernel report ------------ 05/24/2013 16:39:58 ------------ Loaded modules ----------- \SystemRoot\system32\ntkrnlpa.exe \SystemRoot\system32\halmacpi.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\BOOTVID.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\System32\drivers\tflq.sys \SystemRoot\System32\drivers\hxddpw.sys \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\DRIVERS\ACPI.sys \SystemRoot\system32\DRIVERS\WMILIB.SYS \SystemRoot\system32\DRIVERS\msisadrv.sys \SystemRoot\system32\DRIVERS\pci.sys \SystemRoot\system32\DRIVERS\vdrvroot.sys \SystemRoot\system32\drivers\kavbootc.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\DRIVERS\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\DRIVERS\intelide.sys \SystemRoot\system32\DRIVERS\PCIIDEX.SYS \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\DRIVERS\atapi.sys \SystemRoot\system32\DRIVERS\ataport.SYS \SystemRoot\system32\DRIVERS\msahci.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\vmstorfl.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\system32\Drivers\KSafeDISK.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\CLASSPNP.SYS \SystemRoot\system32\Drivers\BTOWSVF.sys \SystemRoot\system32\DRIVERS\cdrom.sys \??\C:\Windows\system32\Drivers\BTOWSFF.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\drivers\afd.sys \??\c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \??\C:\Windows\system32\drivers\ElRawDsk.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\system32\drivers\csc.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\cpqbttn.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\wmiacpi.sys \SystemRoot\system32\DRIVERS\igdkmd32.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\athr.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\usbuhci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\Rtnicxp.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\CompositeBus.sys \SystemRoot\system32\DRIVERS\msiscsi.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\rdpbus.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\umbus.sys \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT32.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\DRIVERS\voxaldriverx86.sys \SystemRoot\system32\DRIVERS\VSTAZL3.SYS \SystemRoot\system32\DRIVERS\VSTDPV3.SYS \SystemRoot\system32\DRIVERS\VSTCNXT3.SYS \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\snp2uvc.sys \SystemRoot\system32\DRIVERS\STREAM.SYS \SystemRoot\system32\DRIVERS\sncduvc.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \??\C:\Windows\system32\drivers\kisknl.sys \??\C:\Windows\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\PDFsFilter.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\DRIVERS\vwifimp.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\System32\drivers\ipnat.sys \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \??\C:\Windows\system32\drivers\ksapi.sys \SystemRoot\system32\DRIVERS\asyncmac.sys \??\C:\Program Files\kingsoft\kingsoft antivirus\kusbquery.sys \??\C:\Windows\system32\drivers\TrueSight.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xffffffff86bd6030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000082\ Lower Device Object: 0xffffffff86c14030 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8638d030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\ Lower Device Object: 0xffffffff8627d030 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0) Load Function returned 0x0 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8638c1a0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff855e8aa8, DeviceName: Unknown, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8627d030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xffffffffb2930fa8, 0xffffffff8638d030, 0xffffffff85fb4048 Lower DeviceData: 0xffffffffc2458c20, 0xffffffff8627d030, 0xffffffff85c1e9c8 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: FD02FD02 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 366603237 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 366603300 Numsec = 24113565 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 200049647616 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-390701968-390721968)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff86bd6968, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff86c14030, DeviceName: \Device\00000082\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Done! Performing system, memory and registry scan... Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C] Infected: c:\$Recycle.Bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4 --> [Trojan.Siredef.C] Done! Scan finished Creating System Restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Executing an action fixdamage.exe... Success! Removal successful. No system shutdown is required. ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7600 Windows 7 x86 Account is Administrative Internet Explorer version: 9.0.8112.16421 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 1.862000 GHz Memory total: 3210756096, free: 1888563200 ------------ Kernel report ------------ 05/24/2013 17:12:58 ------------ Loaded modules ----------- \SystemRoot\system32\ntkrnlpa.exe \SystemRoot\system32\halmacpi.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\BOOTVID.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\System32\drivers\tflq.sys \SystemRoot\System32\drivers\hxddpw.sys \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\DRIVERS\ACPI.sys \SystemRoot\system32\DRIVERS\WMILIB.SYS \SystemRoot\system32\DRIVERS\msisadrv.sys \SystemRoot\system32\DRIVERS\pci.sys \SystemRoot\system32\DRIVERS\vdrvroot.sys \SystemRoot\system32\drivers\kavbootc.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\DRIVERS\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\DRIVERS\intelide.sys \SystemRoot\system32\DRIVERS\PCIIDEX.SYS \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\DRIVERS\atapi.sys \SystemRoot\system32\DRIVERS\ataport.SYS \SystemRoot\system32\DRIVERS\msahci.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\vmstorfl.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\system32\Drivers\KSafeDISK.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\CLASSPNP.SYS \SystemRoot\system32\Drivers\BTOWSVF.sys \SystemRoot\system32\DRIVERS\cdrom.sys \??\C:\Windows\system32\Drivers\BTOWSFF.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\drivers\afd.sys \??\c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \??\C:\Windows\system32\drivers\ElRawDsk.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\system32\drivers\csc.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\cpqbttn.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\wmiacpi.sys \SystemRoot\system32\DRIVERS\igdkmd32.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\athr.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\usbuhci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\Rtnicxp.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\CompositeBus.sys \SystemRoot\system32\DRIVERS\msiscsi.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\rdpbus.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\umbus.sys \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT32.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\DRIVERS\voxaldriverx86.sys \SystemRoot\system32\DRIVERS\VSTAZL3.SYS \SystemRoot\system32\DRIVERS\VSTDPV3.SYS \SystemRoot\system32\DRIVERS\VSTCNXT3.SYS \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\snp2uvc.sys \SystemRoot\system32\DRIVERS\STREAM.SYS \SystemRoot\system32\DRIVERS\sncduvc.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \??\C:\Windows\system32\drivers\kisknl.sys \??\C:\Windows\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\PDFsFilter.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\DRIVERS\vwifimp.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\System32\drivers\ipnat.sys \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \??\C:\Windows\system32\drivers\ksapi.sys \SystemRoot\system32\DRIVERS\asyncmac.sys \??\C:\Program Files\kingsoft\kingsoft antivirus\kusbquery.sys \??\C:\Windows\system32\drivers\TrueSight.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xffffffff86bd6030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000082\ Lower Device Object: 0xffffffff86c14030 Lower Device Driver Name: \Driver\USBSTOR\ Device already Exists: 0xffffffff85cc5290 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8638d030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\ Lower Device Object: 0xffffffff8627d030 Lower Device Driver Name: \Driver\atapi\ Device already Exists: 0xffffffff85c1e9c8 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8638c1a0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff855e8aa8, DeviceName: Unknown, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8627d030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xffffffff8af32478, 0xffffffff8638d030, 0xffffffff85fb4048 Lower DeviceData: 0xffffffff97777778, 0xffffffff8627d030, 0xffffffff85c1e9c8 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: FD02FD02 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 366603237 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 366603300 Numsec = 24113565 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 200049647616 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-390701968-390721968)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff86bd6968, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff86c14030, DeviceName: \Device\00000082\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Done! Performing system, memory and registry scan... Done! Scan finished ======================================= Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.03.22.01 Windows 7 x86 NTFS Internet Explorer 9.0.8112.16421 cjb :: CJB-PC [administrator] 5/24/2013 4:57:59 PM mbar-log-2013-05-24 (16-57-59).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 26833 Time elapsed: 17 minute(s), 47 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 1 c:\$Recycle.Bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4 (Trojan.Siredef.C) -> Delete on reboot. Files Detected: 0 (No malicious items detected) (end) Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.03.22.01 Windows 7 x86 NTFS Internet Explorer 9.0.8112.16421 cjb :: CJB-PC [administrator] 5/24/2013 5:29:43 PM mbar-log-2013-05-24 (17-29-43).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 26842 Time elapsed: 16 minute(s), 34 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) I am checking functionality now looking good so far, i truly appreciate your help
  10. jefftx
    RogueKiller V8.5.4 [Mar 18 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7600 ) 32 bits version Started in : Normal mode User : cjb [Admin rights] Mode : Scan -- Date : 05/24/2013 16:12:07 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 6 ¤¤¤ [TASK][sUSP PATH] EasyShare Registration Task.job : C:\Windows\System32\rundll32.exe C:\ProgramData\Kodak\EasyShareSetup\$Registration\Registration_7.9.20.1.sxt _RegistrationOffer@16 [7] -> FOUND [TASK][sUSP PATH] EasyShare Registration Task : C:\Windows\System32\rundll32.exe C:\ProgramData\Kodak\EasyShareSetup\$Registration\Registration_7.9.20.1.sxt _RegistrationOffer@16 [7] -> FOUND [TASK][sUSP PATH] Test TimeTrigger : C:\Users\cjb\AppData\Local\Temp\Runner.exe C:\Users\cjb\AppData\Local\Temp\DNS.exe [x] -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\@ [-] --> FOUND [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\U --> FOUND [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\L --> FOUND ¤¤¤ Driver : [LOADED] ¤¤¤ SSDT[93] : NtCreateUserProcess @ 0x82E605B3 -> HOOKED (\??\C:\Windows\system32\drivers\kisknl.sys @ 0x96E368DA) ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: ST9200827AS ATA Device +++++ --- User --- [MBR] 06aac3649d40f3ad19918d2021715ee8 [bSP] 8a595458ebe0c10a2eced05f7200374b : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 179005 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 366603300 | Size: 11774 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_05242013_02d1612.txt >> RKreport[1]_S_05242013_02d1612.txt
  11. jefftx
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Professional Boot Device: \Device\HarddiskVolume1 Install Date: 8/30/2012 12:12:32 AM System Uptime: 5/23/2013 3:47:03 AM (32 hours ago) . Motherboard: Hewlett-Packard | | 30ED Processor: Intel® Pentium® Dual CPU T2390 @ 1.86GHz | CPU | 1867/533mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 175 GiB total, 74.571 GiB free. D: is FIXED (NTFS) - 11 GiB total, 1.982 GiB free. E: is CDROM () F: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1} Description: ElRawDisk Device ID: ROOT\LEGACY_ELRAWDISK\0000 Manufacturer: Name: ElRawDisk PNP Device ID: ROOT\LEGACY_ELRAWDISK\0000 Service: ElRawDisk . ==== System Restore Points =================== . RP214: 5/19/2013 1:24:56 AM - Windows Update RP216: 5/19/2013 3:00:19 AM - Windows Update RP218: 5/21/2013 7:05:38 PM - Windows Update RP220: 5/22/2013 3:00:52 AM - Windows Update RP222: 5/23/2013 3:00:12 AM - Windows Update RP224: 5/24/2013 3:00:35 AM - Windows Update RP226: 5/24/2013 5:38:24 AM - Windows Defender Checkpoint . ==== Installed Programs ====================== . 7-Zip 9.22beta Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 9.5.4 ArcSoft Print Creations ArcSoft Print Creations - Album Page ArcSoft Print Creations - Funhouse ArcSoft Print Creations - Greeting Card ArcSoft Print Creations - Photo Book ArcSoft Print Creations - Photo Calendar ArcSoft Print Creations - Scrapbook ArcSoft Print Creations - Slimline Card Audacity 2.0.2 Bing Bar Canon MP495 series MP Drivers CCleaner CCScore Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module CleanGenius 3.0.6 Conexant HD Audio D3DX10 Dropbox ESSBrwr ESSCDBK ESScore ESSgui ESSini ESSPCD ESSPDock ESSTOOLS essvatgt EVEREST Ultimate Edition v5.50 fflink Freenet_2 GCH Guitar academy GigaTribe 3.04.009 GuitarCourses.ws Fretboard Trainer 1.2 GuitarCourses.ws Fretboard Trainer Bonus Lesson HP Quick Launch Buttons Intel® Graphics Media Accelerator Driver IObit Malware Fighter iolo technologies' System Mechanic JamVOX Java 7 Update 17 Kingsoft Antivirus 2012 Kodak EasyShare software LADSPA_plugins-win-0.4.15 Malwarebytes Anti-Malware version 1.75.0.1300 Media Cope 3.4 Microsoft .NET Framework 1.1 Microsoft .NET Framework 4 Client Profile Microsoft Choice Guard Microsoft Mouse and Keyboard Center Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Web Publishing Wizard 1.52 Microsoft XNA Framework Redistributable 4.0 Mozilla Firefox 20.0.1 (x86 en-US) Mozilla Maintenance Service MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MusicBee 2.0 netbrdg OfotoXMI PokerStars.net PrintMaster Platinum 18 QLBCASL QuickTime Ralink RT2870 Wireless LAN Card RealDownloader Samsung New PC Studio SAMSUNG USB Driver for Mobile Phones SFR SHASTA skin0001 SKINXSDK Spotify staticcr Strongvault Online Backup Sweet Home 3D version 3.7 Syncrosoft License Control ToneLabSE SoundEditor for Windows ToneLabST USB-MIDI Driver Setup for Windows tooltips Toolwiz Care TuneUp Utilities Language Pack (en-US) VLC media player 2.0.5 Voxal Voice Changer VPRINTOL Windows Live Communications Platform Windows Live Essentials Windows Live Movie Maker Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Toolbar Windows Live Upload Tool WIRELESS Wise Care 365 version 2.14 Wise Disk Cleaner 7.71 Wise Registry Cleaner 7.68 Yahoo! Messenger Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 5/24/2013 3:41:10 AM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107. 5/24/2013 3:41:10 AM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed. 5/24/2013 3:01:10 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Windows 7 Service Pack 1 (KB976932). 5/24/2013 11:14:00 AM, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error. 5/24/2013 10:52:08 AM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power transition. Please check for updated firmware for your system. 5/23/2013 3:27:57 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ElRawDisk 5/23/2013 3:27:56 AM, Error: Service Control Manager [7000] - The WebcamMax, WDM Video Capture service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 5/23/2013 3:22:07 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control. . ==== End Of File =========================== Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.17.2 Run by cjb at 11:17:26 on 2013-05-24 Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3062.1524 [GMT -5:00] . AV: Kingsoft Antivirus System Defense *Enabled/Updated* {B6A51389-A795-5AC9-13BA-F569D73F3FE8} SP: Kingsoft Antivirus System Defense *Enabled/Updated* {0DC4F26D-81AF-5547-290A-CE1BACB87555} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe c:\program files\kingsoft\kingsoft antivirus\kxescore.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe C:\Windows\System32\alg.exe C:\Windows\System32\WUDFHost.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\taskhost.exe C:\Program Files\kingsoft\kingsoft antivirus\kxetray.exe C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe C:\Windows\system32\wuauclt.exe C:\Program Files\ToolwizCareFree\ToolwizCares.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\ToolwizCareFree\ToolwizTools.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\explorer.exe C:\Windows\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\System32\svchost.exe -k secsvcs . ============== Pseudo HJT Report =============== . uStart Page = www.yahoo.com mStart Page = www.yahoo.com mDefault_Page_URL = hxxp://www.yahoo.com/?ilc=8 uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll uURLSearchHooks: <No Name>: - LocalServer32 - <no file> mURLSearchHooks: {855F3B16-6D32-4fe6-8A56-BBB695989046} - <orphaned> mURLSearchHooks: <No Name>: - LocalServer32 - <no file> BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\realnetworks \realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Advanced SystemCare Browser Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - <no file> TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll uRun: [spotify Web Helper] "c:\users\cjb\appdata\roaming\spotify\data\SpotifyWebHelper.exe" uRun: [CleanGeniusTray] "c:\program files\cleangenius 3\CleanGeniusTray.exe" -startup mRun: [kxesc] "c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" -autorun mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "c:\programdata\malwarebytes\malwarebytes' anti-malware \cleanup.dll",ProcessCleanupScript dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_3_300_271_ActiveX.exe -update activex StartupFolder: c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs uPolicies-Explorer: NoDriveTypeAutoRun = dword:221 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: SynchronousMachineGroupPolicy = dword:1 mPolicies-System: SynchronousUserGroupPolicy = dword:1 mPolicies-Windows\System: AllowBlockingAppsAtShutdown = dword:1 IE: Speak Text - c:\program files\media cope\extensions\speak text\7.html IE: Upload to Facebook - <no file> IE: View Full Screen - Best Fit - c:\program files\media cope\extensions\wifv\0.html IE: View Full Screen - Cut Fit Bottom Right - c:\program files\media cope\extensions\wifv\2.html IE: View Full Screen - Cut Fit Equal - c:\program files\media cope\extensions\wifv\3.html IE: View Full Screen - Cut Fit Top Left - c:\program files\media cope\extensions\wifv\1.html IE: View Full Screen - Stretch Fit - c:\program files\media cope\extensions\wifv\4.html . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab TCP: NameServer = 207.243.120.10 207.243.120.20 192.168.1.1 TCP: Interfaces\{19CC927B-D97D-4A9E-A573-4C71AC6D1E96} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1 TCP: Interfaces\{19CC927B-D97D-4A9E-A573-4C71AC6D1E96}\8496C656D616E6 : DHCPNameServer = 207.243.120.10 207.243.120.20 TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1 TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\36F62616C647D2F636F6E6E65627 : DHCPNameServer = 4.2.2.2 8.8.8.8 TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\8496C656D616E6 : DHCPNameServer = 207.243.120.10 207.243.120.20 TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\E4544574541425 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{AEF844BA-36D1-4C6F-B0DA-E351E7DF99D5} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1 TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1 TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\4414E4E495D20534F5E4564777F627B6 : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\45D2D4F62696C65602D69745F657368615020353 : DHCPNameServer = 192.168.43.1 TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\94E44554C4C494E45445 : DHCPNameServer = 192.168.2.1 TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\E4544574541425 : DHCPNameServer = 192.168.1.1 Notify: igfxcui - igfxdev.dll SSODL: WebCheck - <orphaned> SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\cjb\appdata\roaming\mozilla\firefox\profiles\pf3w9cnm.default-1353658392495\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=3&q={searchTerms} &CUI=UN35193696604262309 FF - prefs.js: browser.search.selectedEngine - VisualBee V.1 Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI=UN35193696604262309 FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CUI=UN35193696604262309&UM=UM_ID&q= FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\npdlplugin.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npmproxy.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 . ============= SERVICES / DRIVERS =============== . R0 BTOWSVF;BTOWSVF;c:\windows\system32\drivers\BTOWSVF.sys [2013-4-21 44928] R0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc.sys [2012-8-30 27240] R0 KSafeDISK;KSafeDISK;c:\windows\system32\drivers\KSafeDISK.sys [2013-4-21 48640] R1 BTOWSFF;BTOWSFF;c:\windows\system32\drivers\BTOWSFF.sys [2013-4-21 27648] R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2013-5-23 26248] R1 KDHacker;KDHacker;c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys [2012-8-30 125784] R2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [2012-8-30 164728] R2 kxescore;Kingsoft Core Service;c:\program files\kingsoft\kingsoft antivirus\kxescore.exe [2012-8-30 123992] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-11-18 701512] R2 PDFsFilter;PDFsFilter;c:\windows\system32\drivers\PDFsFilter.sys [2012-10-30 68464] R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader \rndlresolversvc.exe [2012-8-9 38608] R2 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992] R3 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2013-5-22 1072664] R3 ksapi;ksapi;c:\windows\system32\drivers\ksapi.sys [2012-8-30 82264] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-11-18 22856] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-5-24 40776] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504] R3 voxaldriver;Voxal Filter Driver 2.10.00;c:\windows\system32\drivers\voxaldriverx86.sys [2013-2-14 42576] R4 KUsbGuard;KUsbGuard;c:\program files\kingsoft\kingsoft antivirus\kusbquery.sys [2012-9-11 14200] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [2012-4-15 1068216] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\FileMonitor.sys [2013-2-12 20336] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2012-11-3 36608] S3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\drivers\netr28u.sys [2012-12-4 856928] S3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\RegFilter.sys [2013-2-12 30640] S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2012-11-3 98560] S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2012-11-3 14848] S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2012-11-3 123648] S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [2013-3-12 23288] S3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\UrlFilter.sys [2013-2-12 19832] S3 VASDeviceDrm;Virtual Audio Streaming with Drm (WDM);c:\windows\system32\drivers\vasdDev.sys [2012-12-8 1451312] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-9-4 1343400] S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2012-9-7 16640] S4 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2012-9-3 227896] S4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2012-11-3 238952] S4 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2012-10-11 821592] S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-11-18 418376] S4 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RaRegistry.exe [2012-12-4 193888] . =============== Created Last 30 ================ . 2013-05-24 13:05:17 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2013-05-24 11:22:33 54016 ----a-w- c:\windows\system32\drivers\tflq.sys 2013-05-24 08:00:42 -------- d-----w- C:\174f3b2bead34a105f6f3266e1361a48 2013-05-23 10:18:57 60872 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{30e015fc-2bd1-49f0-8043- 0bb31fd7fc89}\offreg.dll 2013-05-23 08:29:55 26248 ----a-w- c:\windows\system32\drivers\ElRawDsk.sys 2013-05-23 08:00:24 -------- d-----w- C:\900e04d6e6dcfe836b 2013-05-23 04:07:08 83456 ---ha-w- C:\wifv.exe 2013-05-23 04:07:08 340480 ---ha-w- C:\Speak Text.exe 2013-05-23 04:07:04 579576 ----a-w- c:\windows\system32\Codejock.SkinFramework.v15.0.1.ocx 2013-05-23 04:07:03 211456 ----a-w- c:\windows\system32\MediaCopeShellM.dll 2013-05-23 04:07:01 211456 ----a-w- c:\windows\system32\MediaCopeShellS.dll 2013-05-23 04:07:01 -------- d-----w- c:\program files\Media Cope 2013-05-22 08:00:59 -------- d-----w- C:\6746e963838c373a8cf822b03ddd3b89 2013-05-22 00:05:49 -------- d-----w- C:\105009d7215d76f8fd 2013-05-21 12:17:11 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{30e015fc-2bd1-49f0-8043- 0bb31fd7fc89}\mpengine.dll 2013-05-19 04:42:25 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-05-18 03:39:48 50 ----a-w- c:\users\cjb\appdata\roaming\Update.bat 2013-05-18 03:39:48 112 ----a-w- c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs . ==================== Find3M ==================== . 2013-05-22 05:08:38 41616 ----a-w- c:\windows\system32\iolobtdfg.exe 2013-05-22 05:08:30 23568 ----a-w- c:\windows\system32\smrgdf.exe 2013-05-22 04:48:08 2097472 ----a-w- c:\windows\system32\Incinerator32.dll 2013-05-02 07:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-04-21 23:39:06 48640 ----a-w- c:\windows\system32\drivers\KSafeDISK.sys 2013-04-21 23:39:05 27648 ----a-w- c:\windows\system32\drivers\BTOWSFF.sys 2013-04-21 23:39:04 44928 ----a-w- c:\windows\system32\drivers\BTOWSVF.sys 2013-04-21 20:42:07 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-04-21 20:42:07 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-04-07 03:52:11 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-04-07 03:52:09 861088 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-04-07 03:52:09 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-04-04 19:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-03-19 05:06:09 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-19 05:06:09 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-19 04:54:22 38912 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-19 02:50:03 69632 ----a-w- c:\windows\system32\smss.exe 2013-03-01 03:11:14 2345984 ----a-w- c:\windows\system32\win32k.sys . ============= FINISH: 11:18:20.92 ===============
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.