Backdoor.Agent returns

ironcomputer · November 22, 2011

Hello, everyone. I created a new post since my old one got lost in the shuffle.

A backdoor agent keeps returning even after Malwarebytes tries to delete on reboot. I have been using malwarebytes for quite some time but recently this one problem hasn't been able to be resolved by malwarebytes. I recently used ESET Online scanner, Superantispyware, and was able to remove 1 or 2 other items however, after running another malwarebytes scan, this thing still popped back up. Below is my most recent log from malwarebytes. What direction should I take next?

Thanks for your help.

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8201

Windows 6.1.7601 Service Pack 1 (Safe Mode)

Internet Explorer 8.0.7601.17514

11/20/2011 8:20:11 PM

mbam-log-2011-11-20 (20-20-11).txt

Scan type: Quick scan

Objects scanned: 171754

Time elapsed: 5 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SHELL (Backdoor.Agent) -> Value: SHELL -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Below is the DDS log:

.

DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK

Internet Explorer: 8.0.7601.17514

Run by Tim at 22:16:24 on 2011-11-20

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3292.2548 [GMT -5:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Windows\explorer.exe

C:\Program Files\Lavasoft\Ad-Aware\AWSC.exe

C:\Windows\system32\ctfmon.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uWinlogon: Shell=c:\users\tim\appdata\local\05e8a635\X

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\client server security agent\bho\1009\TmIEPlg.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: @c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll

uRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

uRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtDCpl.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\client server security agent\pccntmon.exe" -HideWindow

mRun: [stanley-H_XRX_S2P] c:\program files\xerox\xerox workcentre 3220\psu\Scan2pc.exe

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"

mRun: [indexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"

mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\programdata\scansoft\paperport\11\config\ereg\Ereg.ini"

mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup

mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\imager~1.lnk - c:\program files\scansoft\paperport\xdcla.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\intuit~1.lnk - c:\program files\common files\intuit\dataprotect\IntuitDataProtect.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~2.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\intuit\quickbooks 2011\QBW32.EXE

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: DisableCAD = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

LSP: mswsock.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} - hxxps://reports.igrs-ips.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 68.87.64.150 68.87.75.198

TCP: Interfaces\{B7FB17AB-2A55-4CB7-951D-F3A20288AB8F} : DhcpNameServer = 68.87.64.150 68.87.75.198

Handler: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - c:\program files\intuit\quickbooks 2011\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\client server security agent\bho\1009\TmIEPlg.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: igfxcui - igfxdev.dll

Notify: spba - c:\program files\common files\spba\homefus2.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Authentication Packages = msv1_0 wvauth

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-11-20 64512]

R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\drivers\tmlwf.sys [2009-7-15 146448]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-11-3 2152152]

R3 k57nd60x;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60x.sys [2011-5-13 273448]

S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]

S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 59392]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2011-6-30 1248256]

S2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.SYS [2008-10-27 5120]

S2 svcGenericHost;Trend Micro Client/Server Security Agent;c:\program files\trend micro\client server security agent\hostedagent\svcGenericHost.exe [2010-7-5 45056]

S2 Sws.Agent.Service;Sws.Agent.Service;c:\program files\sws\swsagent\Sws.Agent.Service.exe [2011-7-13 45056]

S2 TmFilter;Trend Micro Filter;c:\program files\trend micro\client server security agent\TmXPFlt.sys [2010-5-10 230928]

S2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\client server security agent\tmpreflt.sys [2010-5-10 36368]

S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\drivers\tmwfp.sys [2009-7-15 283152]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 TmPfw;Trend Micro Client/Server Security Agent Personal Firewall;c:\program files\trend micro\client server security agent\TmPfw.exe [2009-7-15 497008]

S3 TmProxy;Trend Micro Client/Server Security Agent Proxy Service;c:\program files\trend micro\client server security agent\TmProxy.exe [2009-7-15 689416]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-20 52224]

S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-5-25 1343400]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

.

=============== Created Last 30 ================

.

2011-11-21 03:11:45 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{8e633bd3-2cd0-4756-907c-8f5a71abc406}\offreg.dll

2011-11-21 00:24:25 -------- d-----w- c:\users\tim\appdata\roaming\SUPERAntiSpyware.com

2011-11-21 00:24:08 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2011-11-21 00:24:08 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-11-20 23:54:45 -------- d-----w- c:\program files\Win 32. Backdoor . Agent Removal Utility [1]

2011-11-20 23:23:48 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-11-20 22:14:30 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-11-20 22:11:51 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-11-20 22:11:45 -------- d-----w- c:\program files\Lavasoft

2011-11-17 02:20:55 -------- d-----w- c:\program files\ESET

2011-11-16 20:19:18 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{8e633bd3-2cd0-4756-907c-8f5a71abc406}\mpengine.dll

2011-11-16 20:18:37 708608 ----a-w- c:\program files\common files\system\wab32.dll

2011-11-16 20:18:37 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-16 20:18:26 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-16 18:05:07 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-11-16 17:47:42 -------- d-sh--w- c:\users\tim\appdata\local\05e8a635

.

==================== Find3M ====================

.

2011-11-20 19:13:15 108544 ----a-w- c:\windows\system32\drivers\cdrom.sys

2011-11-17 02:40:17 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-11-16 17:47:50 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-12 20:14:35 0 ----a-w- C:\VDME1B4.tmp

2011-10-12 20:14:35 0 ----a-w- C:\VDME193.tmp

2011-10-01 02:42:56 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-27 04:26:27 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-08-27 04:26:27 233472 ----a-w- c:\windows\system32\oleacc.dll

.

============= FINISH: 22:16:44.00 ===============

LDTate · November 26, 2011

:welcome:

Lets give this a try

ZeroAccess/Max++ rootkit remover to remove ZeroAccess (Sirefef/MAX++) rootkit.

http://deletemalware.blogspot.com/2011/09/zeroaccesssirefefmax-rootkit-removal.html

1. Download the ZeroAccess/Max++ rootkit remover: http://anywhere.webrootcloudav.com/antizeroaccess.exe

2. Double-click on antizeroaccess icon to run it. It will ask you to verify that you want to perform a System scan. Type Y and press Enter.

Once finished, press Enter or any key to continue.

3. If your computer is infected with Zero Access rootkit, you'll see the following warning: Your system is infected!!

Infected file: mrxsmb.sys. In your case it might be different. Type Y and press Enter to perform system cleanup.

You should know see the notification that ZeroAccess rootkit has been successfully removed from the system. Press any key to exit the utility and restart your computer.

4. Run ZeroAccess/Max++ rootkit remover once again to confirm that ZeroAccess/Sirefef/MAX++ rootkit was successfully removed from your computer.

5. Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

ironcomputer · November 27, 2011

Lets give this a try
ZeroAccess/Max++ rootkit remover to remove ZeroAccess (Sirefef/MAX++) rootkit.
http://deletemalware.blogspot.com/2011/09/zeroaccesssirefefmax-rootkit-removal.html
1. Download the ZeroAccess/Max++ rootkit remover: http://anywhere.webrootcloudav.com/antizeroaccess.exe
2. Double-click on antizeroaccess icon to run it. It will ask you to verify that you want to perform a System scan. Type Y and press Enter.
Once finished, press Enter or any key to continue.
3. If your computer is infected with Zero Access rootkit, you'll see the following warning: Your system is infected!!
Infected file: mrxsmb.sys. In your case it might be different. Type Y and press Enter to perform system cleanup.
You should know see the notification that ZeroAccess rootkit has been successfully removed from the system. Press any key to exit the utility and restart your computer.
4. Run ZeroAccess/Max++ rootkit remover once again to confirm that ZeroAccess/Sirefef/MAX++ rootkit was successfully removed from your computer.
5. Please run a new MBAM scan being sure to update before scanning.
Post the scan results
Also please describe how your computer behaves at the moment.
Please don't attach the scans / logs, use "copy/paste".

I ran the program and received the following: "Your system is not infected by ZeroAccess/Max++ Rootkit!

Symptoms include: normal use for a short period of time - it varies: few hours to a day. Then google redirects. I then run mbam and it removes everything but the backdoor.agent and everything runs fine until the redirects start. I can usually tell the when the redirects are about to start because User Account Control will pop up asking if java can run. I have been pressing yes nothing thinking anything of it, but started to press no because problems start after doing so. I haven't even turn on my computer since posting. This is the first time I've done anything on here for fear of other problems.

ironcomputer · November 27, 2011

I ran the program and received the following: "Your system is not infected by ZeroAccess/Max++ Rootkit!
Symptoms include: normal use for a short period of time - it varies: few hours to a day. Then google redirects. I then run mbam and it removes everything but the backdoor.agent and everything runs fine until the redirects start. I can usually tell the when the redirects are about to start because User Account Control will pop up asking if java can run. I have been pressing yes nothing thinking anything of it, but started to press no because problems start after doing so. I haven't even turn on my computer since posting. This is the first time I've done anything on here for fear of other problems.

Below is the mbam log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8251

Windows 6.1.7601 Service Pack 1

Internet Explorer 8.0.7601.17514

11/26/2011 10:39:08 PM

mbam-log-2011-11-26 (22-39-08).txt

Scan type: Quick scan

Objects scanned: 177336

Time elapsed: 6 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Backdoor.Agent) -> Value: Shell -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

LDTate · November 27, 2011

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

ironcomputer · November 27, 2011

Only the symptoms I described in the previous post.

The user account control popped up asking if I wanted to grant permission and I clicked no and everything seemed to work ok for the moment.

After combo fix restarted the computer, I clicked the Internet Explorer icon and I received this:

C:Program Files\Internet Explorer\iexplore.exe

Illegal operation attempted on a registry key that has been marked for deletion.

I clicked ok.

Then this:

Can't open this item.

It might have been removed, renamed, or deleted. Do you want to remove it

Yes or no? I clicked no.

I had to copy the combo fix log to a usb drive and I'm now on a different computer. Below is the log:

ComboFix 11-11-26.04 - Tim 11/27/2011 9:20.1.2 - x86

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3292.2352 [GMT -5:00]

Running from: c:\users\Tim\Desktop\ComboFix.exe

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}

SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\users\Tim\AppData\Local\05e8a635\U

c:\users\Tim\AppData\Local\05e8a635\U\80000000.@

c:\users\Tim\AppData\Local\05e8a635\U\800000cb.@

c:\users\Tim\AppData\Local\05e8a635\U\800000cf.@

c:\users\Tim\AppData\Local\05e8a635\X

C:\VDME193.tmp

C:\VDME1B4.tmp

c:\windows\$NtUninstallKB23586$

c:\windows\$NtUninstallKB23586$\4170501435

c:\windows\$NtUninstallKB23586$\99132981\@

c:\windows\$NtUninstallKB23586$\99132981\L\xadqgnnk

c:\windows\$NtUninstallKB23586$\99132981\loader.tlb

c:\windows\$NtUninstallKB23586$\99132981\U\@00000001

c:\windows\$NtUninstallKB23586$\99132981\U\@000000c0

c:\windows\$NtUninstallKB23586$\99132981\U\@000000cb

c:\windows\$NtUninstallKB23586$\99132981\U\@000000cf

c:\windows\$NtUninstallKB23586$\99132981\U\@80000000

c:\windows\$NtUninstallKB23586$\99132981\U\@800000c0

c:\windows\$NtUninstallKB23586$\99132981\U\@800000cb

c:\windows\$NtUninstallKB23586$\99132981\U\@800000cf

.

((((((((((((((((((((((((( Files Created from 2011-10-27 to 2011-11-27 )))))))))))))))))))))))))))))))

.

2011-11-27 14:26 . 2011-11-27 14:28 -------- d-----w- c:\users\Tim\AppData\Local\temp

2011-11-27 14:26 . 2011-11-27 14:26 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-27 14:22 . 2011-11-27 14:22 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E633BD3-2CD0-4756-907C-8F5A71ABC406}\offreg.dll

2011-11-27 14:18 . 2009-07-13 23:11 53760 ----a-w- c:\windows\system32\drivers\intelppm.sys

2011-11-21 00:24 . 2011-11-21 00:24 -------- d-----w- c:\users\Tim\AppData\Roaming\SUPERAntiSpyware.com

2011-11-21 00:24 . 2011-11-21 00:24 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-11-21 00:24 . 2011-11-21 00:24 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2011-11-20 23:54 . 2011-11-21 00:15 -------- d-----w- c:\program files\Win 32. Backdoor . Agent Removal Utility [1]

2011-11-20 23:23 . 2011-11-20 22:14 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-11-20 22:14 . 2011-11-20 22:14 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-11-20 22:11 . 2011-11-03 17:06 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-11-20 22:11 . 2011-11-20 22:11 -------- d-----w- c:\programdata\Lavasoft

2011-11-20 22:11 . 2011-11-20 22:11 -------- d-----w- c:\program files\Lavasoft

2011-11-17 02:20 . 2011-11-17 02:20 -------- d-----w- c:\program files\ESET

2011-11-16 20:19 . 2011-10-18 06:28 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E633BD3-2CD0-4756-907C-8F5A71ABC406}\mpengine.dll

2011-11-16 20:18 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-16 20:18 . 2011-09-29 16:03 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-16 20:18 . 2011-09-29 03:37 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-16 18:05 . 2011-11-16 18:05 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-11-16 17:47 . 2011-11-27 14:26 -------- d-sh--w- c:\users\Tim\AppData\Local\05e8a635

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-20 19:13 . 2010-11-20 21:29 108544 ----a-w- c:\windows\system32\drivers\cdrom.sys

2011-11-17 02:40 . 2010-11-20 21:29 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-11-16 17:47 . 2011-06-13 23:55 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-01 02:42 . 2011-10-12 20:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-31 22:00 . 2011-05-24 13:59 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"

[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]

2010-10-16 21:10 119664 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"

[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]

2010-10-16 21:10 119664 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2008-10-24 79136]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtDCpl.exe" [2009-08-26 2691072]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-28 136216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-28 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-28 170520]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"OfficeScanNT Monitor"="c:\program files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2010-06-25 1099088]

"Stanley-H_XRX_S2P"="c:\program files\Xerox\Xerox WorkCentre 3220\PSU\Scan2pc.exe" [2010-01-26 253952]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2009-02-20 24576]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2009-02-20 40960]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2008-11-03 54560]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-06-14 1527128]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Image Retriever.lnk - c:\program files\ScanSoft\PaperPort\xdcla.exe [2009-2-19 679936]

Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2011-3-1 5828952]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-7-6 1156968]

QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2011\QBW32.EXE [2011-7-6 1178984]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"DisableCAD"= 1 (0x1)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]

2010-09-15 16:11 1971536 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

Authentication Packages REG_MULTI_SZ msv1_0 wvauth

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-11-03 15232]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 TmPfw;Trend Micro Client/Server Security Agent Personal Firewall;c:\program files\Trend Micro\Client Server Security Agent\TmPfw.exe [2009-07-15 497008]

R3 TmProxy;Trend Micro Client/Server Security Agent Proxy Service;c:\program files\Trend Micro\Client Server Security Agent\TmProxy.exe [2009-07-15 689416]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-25 1343400]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-11-03 64512]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]

S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2009-07-15 146448]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 59392]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-11-03 2152152]

S2 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe [2011-06-30 1248256]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2008-10-28 5120]

S2 svcGenericHost;Trend Micro Client/Server Security Agent;c:\program files\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe [2010-07-05 45056]

S2 Sws.Agent.Service;Sws.Agent.Service;c:\program files\SWS\SWSAgent\Sws.Agent.Service.exe [2011-07-14 45056]

S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\Client Server Security Agent\TmXPFlt.sys [2010-05-11 230928]

S2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\Client Server Security Agent\TmPreFlt.sys [2010-05-11 36368]

S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2009-07-15 283152]

S3 k57nd60x;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-06-20 273448]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 68.87.64.150 68.87.75.198

DPF: {A1B8A30B-8AAA-4A3E-8869-1DA509E8A011} - hxxps://reports.igrs-ips.com/crystalreportviewers10/ActiveXControls/ActiveXViewer.cab

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

SafeBoot-57202875.sys

SafeBoot-79693739.sys

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'lsass.exe'(596)

c:\windows\system32\wvauth.DLL

.

- - - - - - - > 'Explorer.exe'(3724)

c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\SPBA\upeksvr.exe

c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

c:\program files\Trend Micro\Client Server Security Agent\ntrtscan.exe

c:\windows\system32\taskhost.exe

c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Trend Micro\Client Server Security Agent\HostedAgent\HostedAgent.exe

c:\windows\system32\conhost.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\WUDFHost.exe

c:\windows\system32\conhost.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Completion time: 2011-11-27 09:30:45 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-27 14:30

.

Pre-Run: 269,723,938,816 bytes free

Post-Run: 269,288,697,856 bytes free

.

- - End Of File - - 37EE05821515A35A778E7A45CDCC69BC

LDTate · November 27, 2011

I can see what CF removed and it is/was a BackDoor.

Will the PC run and connect to the internet now?

Do you know what this program is?

c:\program files\Win 32. Backdoor . Agent Removal Utility [1]

It might have been removed, renamed, or deleted. Do you want to remove it
Yes or no? I clicked no.

Select Yes

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

Folder::
c:\users\Tim\AppData\Local\05e8a635

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

ironcomputer · November 27, 2011

Do you know what this program is?
c:\program files\Win 32. Backdoor . Agent Removal Utility [1]

I have no idea.

Perhaps something from mbam? After each scan it will ask to remove backdoor.agent upon restart but it is never successful. If not that, then I don't know what it is?

ironcomputer · November 27, 2011

By clicking yes, the ie shortcut icon in the toolbar was removed. Presently I cannot connect to the internet.

I will perform the actions you suggested in the previous post then report back.

LDTate · November 27, 2011

c:\program files\Win 32. Backdoor

If that's listed in Add/Remove Programs, uninstall it. It's not from MBAM

This RootKit disables internet access when trying to remove it.

LDTate · November 27, 2011

Lets give this a try.

Download it to your USB and transfer it to the infected pc.

Move down to: Remove Zero.Access

Follow the directions from #1 - #4 only

http://kb.eset.com/esetkb/index?page=content&id=SOLN2895

ironcomputer · November 27, 2011

c:\program files\Win 32. Backdoor
If that's listed in Add/Remove Programs, uninstall it. It's not from MBAM
This RootKit disables internet access when trying to remove it.

It was not listed in the list of programs that I could delete.

I'm back on the internet. A restart resolved it. Everything on the desktop wasn't working actually, including trying to drag the cfs file into CF.

ironcomputer · November 27, 2011

Ran CF again after moving the cfs file into CF. Below is the log. Is it normal that nothing will work after CF runs? Programs on the desktop, in the start menu? Basically everything gives the notification I mentioned earlier - Illegal operation attempted on a registry key that has been marked for deletion. Click ok to continue.

ComboFix 11-11-27.01 - Tim 11/27/2011 10:19:48.2.2 - x86

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3292.1983 [GMT -5:00]

Running from: c:\users\Tim\Desktop\ComboFix.exe

Command switches used :: c:\users\Tim\Desktop\CFScript.txt

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}

SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Tim\AppData\Local\05e8a635

c:\users\Tim\AppData\Local\05e8a635\@

c:\users\Tim\AppData\Local\05e8a635\loader.tlb

.

((((((((((((((((((((((((( Files Created from 2011-10-27 to 2011-11-27 )))))))))))))))))))))))))))))))

.

2011-11-27 15:23 . 2011-11-27 15:24 -------- d-----w- c:\users\Tim\AppData\Local\temp

2011-11-27 15:23 . 2011-11-27 15:23 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-27 15:16 . 2011-11-27 15:16 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E633BD3-2CD0-4756-907C-8F5A71ABC406}\offreg.dll