Jump to content

Zeroaccess desktop.ini infection

iambecoming
 Share

Recommended Posts

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Before we proceed further, please uninstall or disable uTorrent and any other peer-to-peer filesharing app.

Continued use of filesharing or ill-advised downloads will surely re-infect your system.

Risks of File-Sharing Technology.

P2P file sharing: Know the risks

It's also against our policy:

http://forums.malwar...showtopic=97700

------------------------------

Then..............

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:



    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

    [*]Select Command Prompt

    [*]In the command window type in notepad and press Enter.

    [*]The notepad opens. Under File menu select Open.

    [*]Select "Computer" and find your flash drive letter and close the notepad.

    [*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

    [*]The tool will start to run.

    [*]When the tool opens click Yes to disclaimer.

    [*]Press Scan button.

    [*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

Link to post
Share on other sites
iambecoming

iambecoming

Posted
  • Author
Posted

Thanks for the help. Here is the log.

Scan result of Farbar Recovery Scan Tool Version: 16-07-2012 02

Ran by SYSTEM at 16-07-2012 17:42:17

Running from E:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [525312 2011-01-24] (IDT, Inc.)

HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [168216 2011-04-19] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-04-19] (Intel Corporation)

HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-04-19] (Intel Corporation)

HKLM\...\Run: [QuickSet] c:\Program Files\Dell\QuickSet\QuickSet.exe [3666800 2011-01-21] (Dell Inc.)

HKLM\...\Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-12-17] (Intel® Corporation)

HKLM\...\Run: [bTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10365952 2011-05-19] (Intel Corporation)

HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [207845 2011-04-29] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-06-16] (Adobe Systems Incorporated)

HKLM\...\Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [112512 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [503942 2011-04-13] (Creative Technology Ltd)

HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2012-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] [x]

HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions)

HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] ()

HKLM-x32\...\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup [2825741 2011-04-29] ()

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-11-13] (Apple Inc.)

HKLM-x32\...\Run: [Memeo Instant Backup] C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui [136416 2011-05-04] (Memeo Inc.)

HKLM-x32\...\Run: [seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui [79112 2011-06-01] ()

HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1675160 2012-03-21] (McAfee, Inc.)

HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462920 2012-07-03] (Malwarebytes Corporation)

HKU\JB\...\Run: [Google Update] "C:\Users\JB\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-11-02] (Google Inc.)

HKU\JB\...\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5661056 2012-07-09] (SUPERAntiSpyware.com)

HKLM\...\RunOnce: [EDocs] C:\Program Files\Dell Inc\Dell Edoc Viewer\EDocs.exe /s [1499648 2010-04-28] (Dell Inc.)

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]

Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

==================== Services (Whitelisted) ======

2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2011-08-11] (SUPERAntiSpyware.com)

2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-14] (Adobe Systems Incorporated)

2 Bluetooth Device Monitor; "C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe" [921664 2011-05-19] (Intel Corporation)

3 Bluetooth Media Service; "C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe" [1335360 2011-05-19] (Intel Corporation)

2 Bluetooth OBEX Service; "C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe" [995392 2011-05-19] (Intel Corporation)

2 DellDigitalDelivery; "C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe" [150920 2011-07-13] (Dell Products, LP.)

2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)

2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

2 mcmscsvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

2 McNaiAnn; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

2 McNASvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

3 McODS; "C:\Program Files\McAfee\VirusScan\mcods.exe" [502032 2012-04-19] (McAfee, Inc.)

2 McProxy; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.)

2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [199272 2012-03-20] (McAfee, Inc.)

2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [210584 2012-03-20] (McAfee, Inc.)

2 mfevtp; "C:\Windows\system32\mfevtps.exe" [162192 2012-03-20] (McAfee, Inc.)

2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [116632 2012-05-18] ()

3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()

2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola)

2 RoxWatch12; "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe" [219632 2010-11-25] (Sonic Solutions)

3 stllssvr; "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe" [74392 2010-11-08] (MicroVision Development, Inc.)

========================== Drivers (Whitelisted) =============

3 cfwids; C:\Windows\System32\Drivers\cfwids.sys [65264 2012-02-22] (McAfee, Inc.)

3 iBtFltCoex; C:\Windows\System32\Drivers\iBtFltCoex.sys [59904 2011-07-19] (Intel Corporation)

3 ivusb; C:\Windows\System32\Drivers\ivusb.sys [29720 2010-07-29] (Initio Corporation)

3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24904 2012-07-03] (Malwarebytes Corporation)

3 mfeapfk; C:\Windows\System32\Drivers\mfeapfk.sys [160792 2012-02-22] (McAfee, Inc.)

3 mfeavfk; C:\Windows\System32\Drivers\mfeavfk.sys [229528 2012-02-22] (McAfee, Inc.)

3 mfefirek; C:\Windows\System32\Drivers\mfefirek.sys [487296 2012-02-22] (McAfee, Inc.)

0 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.)

1 mfenlfk; C:\Windows\System32\Drivers\mfenlfk.sys [75936 2012-02-22] (McAfee, Inc.)

3 mferkdet; C:\Windows\System32\Drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.)

0 mfewfpk; C:\Windows\System32\Drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.)

3 pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()

1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

3 mfeavfk01; [x]

3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-07-16 17:33 - 2012-07-16 17:33 - 01437107 ____A (Farbar) C:\Users\JB\Downloads\FRST64.exe

2012-07-16 14:24 - 2012-07-16 14:24 - 00029482 ____A C:\Users\JB\Desktop\DDS.txt

2012-07-16 14:24 - 2012-07-16 14:24 - 00007323 ____A C:\Users\JB\Desktop\Attach.txt

2012-07-16 13:57 - 2012-07-16 13:56 - 00607260 ____R (Swearware) C:\Users\JB\Desktop\dds.scr

2012-07-16 10:30 - 2012-07-16 10:32 - 00032055 ____A C:\Users\JB\Downloads\Result.txt

2012-07-16 09:55 - 2012-07-16 09:55 - 00403395 ____A (Farbar) C:\Users\JB\Downloads\MiniToolBox.exe

2012-07-16 09:23 - 2012-07-16 09:23 - 00000779 ____A C:\rkill.log

2012-07-16 09:18 - 2012-07-16 09:18 - 01012656 ____A C:\Users\JB\Downloads\rkill.com

2012-07-16 08:35 - 2012-07-16 08:35 - 04731392 ____A (AVAST Software) C:\Users\JB\Downloads\aswMBR.exe

2012-07-16 08:32 - 2012-07-16 08:32 - 00000000 ____D C:\Users\JB\Downloads\tdsskiller

2012-07-16 08:30 - 2012-07-16 08:31 - 02115791 ____A C:\Users\JB\Downloads\tdsskiller.zip

2012-07-16 08:22 - 2012-07-16 08:22 - 00001115 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 08:22 - 2012-07-16 08:22 - 00001115 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 08:22 - 2012-07-16 08:22 - 00000000 ____D C:\Users\JB\Application Data\Malwarebytes

2012-07-16 08:22 - 2012-07-16 08:22 - 00000000 ____D C:\Users\JB\AppData\Roaming\Malwarebytes

2012-07-16 08:22 - 2012-07-16 08:22 - 00000000 ____D C:\Users\All Users\Malwarebytes

2012-07-16 08:22 - 2012-07-16 08:22 - 00000000 ____D C:\Users\All Users\Application Data\Malwarebytes

2012-07-16 08:22 - 2012-07-16 08:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-07-16 08:22 - 2012-07-03 13:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-07-16 08:20 - 2012-07-16 08:20 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\JB\Downloads\mbam-setup-1.62.0.1300.exe

2012-07-15 23:58 - 2012-07-16 17:31 - 00000504 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e89d2894-f9e0-4a8c-a136-28daa3bcf68b.job

2012-07-15 23:58 - 2012-07-16 02:00 - 00000504 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61ae910b-6303-4deb-b4a9-e92cb1fa712f.job

2012-07-15 23:58 - 2012-07-15 23:58 - 00000000 ____D C:\Users\JB\Application Data\SUPERAntiSpyware.com

2012-07-15 23:58 - 2012-07-15 23:58 - 00000000 ____D C:\Users\JB\AppData\Roaming\SUPERAntiSpyware.com

2012-07-15 23:57 - 2012-07-15 23:58 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2012-07-15 23:57 - 2012-07-15 23:57 - 00001770 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-07-15 23:57 - 2012-07-15 23:57 - 00001770 ____A C:\Users\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-07-15 23:57 - 2012-07-15 23:57 - 00000000 ____D C:\Users\All Users\SUPERAntiSpyware.com

2012-07-15 23:57 - 2012-07-15 23:57 - 00000000 ____D C:\Users\All Users\Application Data\SUPERAntiSpyware.com

2012-07-15 23:56 - 2012-07-15 23:57 - 18574800 ____A (SUPERAntiSpyware.com) C:\Users\JB\Downloads\SAS_18149.EXE

2012-07-15 23:40 - 2012-06-11 22:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-07-15 21:57 - 2012-07-15 21:57 - 00264966 ____A C:\Windows\msxml4-KB2721691-enu.LOG

2012-07-15 20:56 - 2012-06-02 07:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-07-15 20:56 - 2012-06-02 07:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-07-15 20:56 - 2012-06-02 07:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-07-15 20:56 - 2012-06-02 07:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-07-15 20:56 - 2012-06-02 07:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-07-15 20:56 - 2012-06-02 07:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-07-15 20:56 - 2012-06-02 07:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-07-15 20:56 - 2012-06-02 07:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-07-15 20:56 - 2012-06-02 07:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-07-15 20:56 - 2012-06-02 07:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-07-15 20:56 - 2012-06-02 06:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-07-15 20:56 - 2012-06-02 06:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-07-15 20:56 - 2012-06-02 06:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-07-15 20:56 - 2012-06-02 06:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-07-15 20:56 - 2012-06-02 04:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-07-15 20:56 - 2012-06-02 03:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-07-15 20:56 - 2012-06-02 03:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-07-15 20:56 - 2012-06-02 03:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-07-15 20:56 - 2012-06-02 03:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-07-15 20:56 - 2012-06-02 03:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-07-15 20:56 - 2012-06-02 03:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-07-15 20:56 - 2012-06-02 03:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-07-15 20:56 - 2012-06-02 03:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-07-15 20:56 - 2012-06-02 03:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-07-15 20:56 - 2012-06-02 03:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-07-15 20:56 - 2012-06-02 03:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-07-15 20:56 - 2012-06-02 03:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-07-15 20:56 - 2012-06-02 03:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-07-13 16:44 - 2012-07-13 16:44 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%

2012-07-11 18:31 - 2012-07-11 18:31 - 00000000 ____D C:\Users\JB\My Documents\Disc Images

2012-07-11 18:31 - 2012-07-11 18:31 - 00000000 ____D C:\Users\JB\Documents\Disc Images

2012-07-11 18:30 - 2012-07-11 18:30 - 00000000 ____D C:\Users\JB\Application Data\Macrovision

2012-07-11 18:30 - 2012-07-11 18:30 - 00000000 ____D C:\Users\JB\AppData\Roaming\Macrovision

2012-07-11 18:27 - 2012-07-11 18:47 - 04474022 ____A (GuinpinSoft inc) C:\Users\JB\Downloads\Setup_MakeMKV_v1.7.6.exe

2012-07-11 15:49 - 2012-07-16 17:31 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-07-11 15:49 - 2012-07-11 16:20 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-07-11 15:49 - 2012-07-11 15:49 - 00000000 ____D C:\Windows\System32\Macromed

2012-07-11 12:28 - 2012-07-11 12:28 - 00000000 ____D C:\Users\JB\My Documents\Outlook Files

2012-07-11 12:28 - 2012-07-11 12:28 - 00000000 ____D C:\Users\JB\Documents\Outlook Files

2012-07-10 22:28 - 2012-06-09 00:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-07-10 22:28 - 2012-06-08 23:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-07-10 22:28 - 2012-06-06 01:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-07-10 22:28 - 2012-06-06 01:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-07-10 22:28 - 2012-06-06 01:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-07-10 22:28 - 2012-06-06 00:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-07-10 22:28 - 2012-06-06 00:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-07-10 22:28 - 2012-06-06 00:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-07-10 22:28 - 2012-06-02 00:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-07-10 22:28 - 2012-06-02 00:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-07-10 22:28 - 2012-06-02 00:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-07-10 22:28 - 2012-06-02 00:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-07-10 22:28 - 2012-06-02 00:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-07-10 22:28 - 2012-06-01 23:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-07-10 22:28 - 2012-06-01 23:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-07-10 22:28 - 2012-06-01 23:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-07-10 22:28 - 2012-06-01 23:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-07-10 22:28 - 2010-06-25 22:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll

2012-07-10 22:28 - 2010-06-25 22:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2012-07-08 18:34 - 2012-07-08 18:36 - 00000000 ____D C:\Users\JB\Desktop\SamuriHL_HouseOfBionic_v2.w6.7.232

2012-07-08 03:00 - 2012-07-08 03:01 - 00263392 ____A C:\Windows\msxml4-KB973685-enu.LOG

2012-07-07 11:27 - 2012-07-07 11:27 - 00000000 ____D C:\Users\JB\Downloads\SamuriHL_HouseOfBionic_v2(TORRENT)

2012-07-07 11:26 - 2012-07-07 11:26 - 00011019 ____A C:\Users\JB\Downloads\SamuriHL_HouseOfBionic_v2(TORRENT).zip

2012-07-04 15:38 - 2012-07-04 15:38 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf

2012-07-04 15:38 - 2012-07-04 15:38 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motmodem_01007.Wdf

2012-07-04 15:24 - 2012-07-04 15:24 - 00000000 ____D C:\Users\JB\Local Settings\Motorola

2012-07-04 15:24 - 2012-07-04 15:24 - 00000000 ____D C:\Users\JB\Local Settings\Application Data\Motorola

2012-07-04 15:24 - 2012-07-04 15:24 - 00000000 ____D C:\Users\JB\AppData\Local\Motorola

2012-07-04 15:13 - 2012-07-04 15:13 - 00000000 ____D C:\Users\JB\Downloads\RSDLite57

2012-07-04 11:57 - 2012-07-04 11:59 - 44551897 ____A C:\Users\JB\Downloads\Blur_Version.5.9.902.XT875.Verizon.en.US.zip

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motfilt_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgp_01007.Wdf

2012-07-04 09:40 - 2012-07-04 09:40 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motoandroid_01007.Wdf

2012-07-04 09:28 - 2012-07-04 09:29 - 04614205 ____A C:\Users\JB\Downloads\RSDLite5.6.rar

2012-07-04 09:20 - 2012-07-04 09:20 - 00000000 ____D C:\Users\All Users\Motorola

2012-07-04 09:20 - 2012-07-04 09:20 - 00000000 ____D C:\Users\All Users\Application Data\Motorola

2012-07-04 09:07 - 2012-07-04 09:08 - 00000000 ____D C:\Users\JB\Application Data\WinRAR

2012-07-04 09:07 - 2012-07-04 09:08 - 00000000 ____D C:\Users\JB\AppData\Roaming\WinRAR

2012-07-04 09:07 - 2012-07-04 09:07 - 00000000 ____D C:\Program Files\WinRAR

2012-07-04 09:05 - 2012-07-04 09:05 - 01656459 ____A C:\Users\JB\Downloads\winrar-x64-420.exe

2012-07-04 09:03 - 2012-07-04 09:03 - 00000000 ____D C:\Users\JB\Application Data\Motorola Mobility

2012-07-04 09:03 - 2012-07-04 09:03 - 00000000 ____D C:\Users\JB\AppData\Roaming\Motorola Mobility

2012-07-04 09:02 - 2012-07-04 15:15 - 00000000 ____D C:\Program Files (x86)\Motorola

2012-07-04 09:02 - 2012-07-04 09:03 - 00000000 ____D C:\Program Files (x86)\Motorola Mobility

2012-07-04 09:01 - 2012-07-04 09:01 - 00000000 ____D C:\Users\JB\Application Data\Motorola

2012-07-04 09:01 - 2012-07-04 09:01 - 00000000 ____D C:\Users\JB\AppData\Roaming\Motorola

2012-07-04 09:01 - 2012-07-04 09:01 - 00000000 ____D C:\Program Files\Motorola Inc

2012-07-04 09:01 - 2012-07-04 09:01 - 00000000 ____D C:\Program Files\Common Files\Motorola Shared

2012-07-04 08:58 - 2012-07-04 09:00 - 32655232 ____A (Motorola Mobility) C:\Users\JB\Downloads\MotorolaDeviceManager_2.2.17.exe

2012-06-25 16:04 - 2012-06-25 16:04 - 01394248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml4.dll

2012-06-23 20:03 - 2012-06-23 20:03 - 00907735 ____A ( ) C:\Users\JB\Downloads\DVD43_Plugin_Setup_1.0.0.5 (1).exe

2012-06-23 20:01 - 2012-06-23 20:03 - 00000000 ____D C:\Program Files (x86)\DVD43 Plug-in

2012-06-23 20:01 - 2010-05-25 15:26 - 00611840 ____A () C:\Windows\SysWOW64\DVD43.dll

2012-06-23 20:00 - 2012-06-23 20:00 - 00907735 ____A ( ) C:\Users\JB\Downloads\DVD43_Plugin_Setup_1.0.0.5.exe

2012-06-23 19:59 - 2012-06-23 19:59 - 00568900 ____A ( ) C:\Users\JB\Downloads\DVD43_4-6-0_Setup.exe

2012-06-23 19:51 - 2012-06-23 19:51 - 00000000 ____D C:\Users\JB\Application Data\HandBrake

2012-06-23 19:51 - 2012-06-23 19:51 - 00000000 ____D C:\Users\JB\AppData\Roaming\HandBrake

2012-06-23 19:49 - 2012-06-23 19:49 - 00000786 ____A C:\Users\Jessica\Desktop\Handbrake.lnk

2012-06-23 19:49 - 2012-06-23 19:49 - 00000786 ____A C:\Users\JB\Desktop\Handbrake.lnk

2012-06-23 19:49 - 2012-06-23 19:49 - 00000000 ____D C:\Program Files\Handbrake

2012-06-23 19:46 - 2012-06-23 19:48 - 07205327 ____A C:\Users\JB\Downloads\HandBrake-0.9.6-x86_64-Win_GUI.exe

2012-06-22 05:33 - 2012-07-11 18:22 - 00000000 ____D C:\Users\JB\Desktop\Jeff

2012-06-21 22:28 - 2012-06-21 22:28 - 00000000 ____D C:\Users\All Users\dvdfab

2012-06-21 22:28 - 2012-06-21 22:28 - 00000000 ____D C:\Users\All Users\Application Data\dvdfab

2012-06-21 22:23 - 2012-06-21 22:31 - 00000000 ____D C:\Users\JB\My Documents\DVDFab

2012-06-21 22:23 - 2012-06-21 22:31 - 00000000 ____D C:\Users\JB\Documents\DVDFab

2012-06-21 22:21 - 2012-06-21 22:22 - 20851656 ____A (Fengtao Software Inc. ) C:\Users\JB\Downloads\DVDFab8185Qt.exe

2012-06-21 18:06 - 2012-06-15 20:20 - 102587148 ____N C:\Users\JB\Desktop\IMG_1291.MOV

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\Windows Live

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\Application Data\Windows Live

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\Application Data\{B2DF377F-0B26-469A-9DCA-02B4D8628A65}

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\Application Data\{2E916004-C703-4009-B8A9-2C317A27F113}

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\{B2DF377F-0B26-469A-9DCA-02B4D8628A65}

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\Local Settings\{2E916004-C703-4009-B8A9-2C317A27F113}

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\AppData\Local\Windows Live

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\AppData\Local\{B2DF377F-0B26-469A-9DCA-02B4D8628A65}

2012-06-21 18:02 - 2012-06-21 18:02 - 00000000 ____D C:\Users\JB\AppData\Local\{2E916004-C703-4009-B8A9-2C317A27F113}

2012-06-21 16:04 - 2012-06-21 16:24 - 319161945 ____A C:\Users\JB\Downloads\Blur_Version.5.9.905.XT875.Verizon.en.US.zip

2012-06-17 23:01 - 2012-06-21 21:59 - 00000000 ____D C:\Users\JB\Application Data\dvdcss

2012-06-17 23:01 - 2012-06-21 21:59 - 00000000 ____D C:\Users\JB\AppData\Roaming\dvdcss

2012-06-17 22:59 - 2012-06-17 22:59 - 00000000 ____D C:\Users\JB\Application Data\Digiarty

2012-06-17 22:59 - 2012-06-17 22:59 - 00000000 ____D C:\Users\JB\AppData\Roaming\Digiarty

2012-06-17 22:52 - 2012-06-21 22:04 - 00000000 ____D C:\Users\All Users\DVD Shrink

2012-06-17 22:52 - 2012-06-21 22:04 - 00000000 ____D C:\Users\All Users\Application Data\DVD Shrink

2012-06-17 22:52 - 2012-06-17 22:52 - 00000989 ____A C:\Users\Jessica\Desktop\DVD Shrink 3.2.lnk

2012-06-17 22:52 - 2012-06-17 22:52 - 00000159 ____A C:\Users\JB\Downloads\dvdrip.ini

2012-06-17 22:52 - 2012-06-17 22:52 - 00000000 ____D C:\Program Files (x86)\DVD Shrink

2012-06-17 22:50 - 2012-06-17 22:50 - 01094021 ____A C:\Users\JB\Downloads\dvdshrink32setup.zip

2012-06-17 22:50 - 2012-06-17 22:50 - 00305139 ____A C:\Users\JB\Downloads\DVD Rip 0.2.exe

2012-06-17 22:47 - 2012-06-17 22:48 - 12366024 ____A (Digiarty Software, Inc. ) C:\Users\JB\Downloads\winx-dvd-ripper.exe

============ 3 Months Modified Files ========================

2012-07-16 17:37 - 2012-04-17 22:17 - 00000506 ____A C:\Windows\Tasks\SystemToolsDailyTest.job

2012-07-16 17:37 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-07-16 17:37 - 2009-07-13 23:51 - 00071194 ____A C:\Windows\setupact.log

2012-07-16 17:36 - 2011-11-01 19:10 - 01477618 ____A C:\Windows\WindowsUpdate.log

2012-07-16 17:33 - 2012-07-16 17:33 - 01437107 ____A (Farbar) C:\Users\JB\Downloads\FRST64.exe

2012-07-16 17:33 - 2011-11-02 15:45 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1336452609-2486671542-1175796360-1000UA.job

2012-07-16 17:33 - 2009-07-14 00:13 - 00778834 ____A C:\Windows\System32\PerfStringBackup.INI

2012-07-16 17:31 - 2012-07-15 23:58 - 00000504 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e89d2894-f9e0-4a8c-a136-28daa3bcf68b.job

2012-07-16 17:31 - 2012-07-11 15:49 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-07-16 14:24 - 2012-07-16 14:24 - 00029482 ____A C:\Users\JB\Desktop\DDS.txt

2012-07-16 14:24 - 2012-07-16 14:24 - 00007323 ____A C:\Users\JB\Desktop\Attach.txt

2012-07-16 13:56 - 2012-07-16 13:57 - 00607260 ____R (Swearware) C:\Users\JB\Desktop\dds.scr

2012-07-16 10:32 - 2012-07-16 10:30 - 00032055 ____A C:\Users\JB\Downloads\Result.txt

2012-07-16 09:55 - 2012-07-16 09:55 - 00403395 ____A (Farbar) C:\Users\JB\Downloads\MiniToolBox.exe

2012-07-16 09:23 - 2012-07-16 09:23 - 00000779 ____A C:\rkill.log

2012-07-16 09:18 - 2012-07-16 09:18 - 01012656 ____A C:\Users\JB\Downloads\rkill.com

2012-07-16 08:35 - 2012-07-16 08:35 - 04731392 ____A (AVAST Software) C:\Users\JB\Downloads\aswMBR.exe

2012-07-16 08:31 - 2012-07-16 08:30 - 02115791 ____A C:\Users\JB\Downloads\tdsskiller.zip

2012-07-16 08:22 - 2012-07-16 08:22 - 00001115 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 08:22 - 2012-07-16 08:22 - 00001115 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 08:20 - 2012-07-16 08:20 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\JB\Downloads\mbam-setup-1.62.0.1300.exe

2012-07-16 08:11 - 2012-02-25 18:18 - 00001790 ____A C:\Users\Public\Desktop\McAfee Security Center.lnk

2012-07-16 08:11 - 2012-02-25 18:18 - 00001790 ____A C:\Users\All Users\Desktop\McAfee Security Center.lnk

2012-07-16 06:53 - 2009-07-13 23:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-07-16 06:53 - 2009-07-13 23:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-07-16 06:43 - 2010-11-20 22:47 - 00038756 ____A C:\Windows\PFRO.log

2012-07-16 02:00 - 2012-07-15 23:58 - 00000504 ____A C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 61ae910b-6303-4deb-b4a9-e92cb1fa712f.job

2012-07-15 23:57 - 2012-07-15 23:57 - 00001770 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-07-15 23:57 - 2012-07-15 23:57 - 00001770 ____A C:\Users\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk

2012-07-15 23:57 - 2012-07-15 23:56 - 18574800 ____A (SUPERAntiSpyware.com) C:\Users\JB\Downloads\SAS_18149.EXE

2012-07-15 23:43 - 2009-07-13 23:45 - 00464552 ____A C:\Windows\System32\FNTCACHE.DAT

2012-07-15 22:33 - 2011-11-02 15:45 - 00000844 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1336452609-2486671542-1175796360-1000Core.job

2012-07-15 21:57 - 2012-07-15 21:57 - 00264966 ____A C:\Windows\msxml4-KB2721691-enu.LOG

2012-07-15 20:58 - 2011-11-03 15:47 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-07-13 17:09 - 2011-11-02 15:44 - 00252487 ____A C:\Users\JB\My Documents\Beam Money.mmw

2012-07-13 17:09 - 2011-11-02 15:44 - 00252487 ____A C:\Users\JB\Documents\Beam Money.mmw

2012-07-11 18:47 - 2012-07-11 18:27 - 04474022 ____A (GuinpinSoft inc) C:\Users\JB\Downloads\Setup_MakeMKV_v1.7.6.exe

2012-07-11 16:20 - 2012-07-11 15:49 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2012-07-11 16:20 - 2011-11-01 17:16 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2012-07-08 03:01 - 2012-07-08 03:00 - 00263392 ____A C:\Windows\msxml4-KB973685-enu.LOG

2012-07-07 11:26 - 2012-07-07 11:26 - 00011019 ____A C:\Users\JB\Downloads\SamuriHL_HouseOfBionic_v2(TORRENT).zip

2012-07-04 15:38 - 2012-07-04 15:38 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motusbdevice_01007.Wdf

2012-07-04 15:38 - 2012-07-04 15:38 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motmodem_01007.Wdf

2012-07-04 11:59 - 2012-07-04 11:57 - 44551897 ____A C:\Users\JB\Downloads\Blur_Version.5.9.902.XT875.Verizon.en.US.zip

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_Motousbnet_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motfilt_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgpfl_01007.Wdf

2012-07-04 10:22 - 2012-07-04 10:22 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motccgp_01007.Wdf

2012-07-04 09:59 - 2012-04-17 22:17 - 00000564 ____A C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job

2012-07-04 09:40 - 2012-07-04 09:40 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_motoandroid_01007.Wdf

2012-07-04 09:29 - 2012-07-04 09:28 - 04614205 ____A C:\Users\JB\Downloads\RSDLite5.6.rar

2012-07-04 09:05 - 2012-07-04 09:05 - 01656459 ____A C:\Users\JB\Downloads\winrar-x64-420.exe

2012-07-04 09:00 - 2012-07-04 08:58 - 32655232 ____A (Motorola Mobility) C:\Users\JB\Downloads\MotorolaDeviceManager_2.2.17.exe

2012-07-03 13:46 - 2012-07-16 08:22 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-06-25 16:04 - 2012-06-25 16:04 - 01394248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml4.dll

2012-06-23 20:03 - 2012-06-23 20:03 - 00907735 ____A ( ) C:\Users\JB\Downloads\DVD43_Plugin_Setup_1.0.0.5 (1).exe

2012-06-23 20:00 - 2012-06-23 20:00 - 00907735 ____A ( ) C:\Users\JB\Downloads\DVD43_Plugin_Setup_1.0.0.5.exe

2012-06-23 19:59 - 2012-06-23 19:59 - 00568900 ____A ( ) C:\Users\JB\Downloads\DVD43_4-6-0_Setup.exe

2012-06-23 19:49 - 2012-06-23 19:49 - 00000786 ____A C:\Users\Jessica\Desktop\Handbrake.lnk

2012-06-23 19:49 - 2012-06-23 19:49 - 00000786 ____A C:\Users\JB\Desktop\Handbrake.lnk

2012-06-23 19:48 - 2012-06-23 19:46 - 07205327 ____A C:\Users\JB\Downloads\HandBrake-0.9.6-x86_64-Win_GUI.exe

2012-06-21 22:22 - 2012-06-21 22:21 - 20851656 ____A (Fengtao Software Inc. ) C:\Users\JB\Downloads\DVDFab8185Qt.exe

2012-06-21 16:24 - 2012-06-21 16:04 - 319161945 ____A C:\Users\JB\Downloads\Blur_Version.5.9.905.XT875.Verizon.en.US.zip

2012-06-17 22:52 - 2012-06-17 22:52 - 00000989 ____A C:\Users\Jessica\Desktop\DVD Shrink 3.2.lnk

2012-06-17 22:52 - 2012-06-17 22:52 - 00000159 ____A C:\Users\JB\Downloads\dvdrip.ini

2012-06-17 22:50 - 2012-06-17 22:50 - 01094021 ____A C:\Users\JB\Downloads\dvdshrink32setup.zip

2012-06-17 22:50 - 2012-06-17 22:50 - 00305139 ____A C:\Users\JB\Downloads\DVD Rip 0.2.exe

2012-06-17 22:48 - 2012-06-17 22:47 - 12366024 ____A (Digiarty Software, Inc. ) C:\Users\JB\Downloads\winx-dvd-ripper.exe

2012-06-15 20:20 - 2012-06-21 18:06 - 102587148 ____N C:\Users\JB\Desktop\IMG_1291.MOV

2012-06-11 22:08 - 2012-07-15 23:40 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-09 00:43 - 2012-07-10 22:28 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-08 23:41 - 2012-07-10 22:28 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2012-06-08 22:22 - 2012-06-08 22:22 - 11800758 ____A C:\Users\JB\Downloads\Jace.zip

2012-06-07 20:49 - 2012-06-07 20:46 - 24043049 ____A C:\Users\JB\Downloads\getimage.tif

2012-06-06 01:06 - 2012-07-10 22:28 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-06 01:06 - 2012-07-10 22:28 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-06 01:02 - 2012-07-10 22:28 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-06-06 00:05 - 2012-07-10 22:28 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2012-06-06 00:05 - 2012-07-10 22:28 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2012-06-06 00:03 - 2012-07-10 22:28 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2012-06-04 19:22 - 2012-06-04 19:22 - 00356328 ____A C:\Users\JB\Downloads\WinZip165.exe

2012-06-04 19:15 - 2012-06-04 19:14 - 09212995 ____A C:\Users\JB\Downloads\RJWOTEP0001.7z

2012-06-02 17:19 - 2012-06-08 18:10 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 17:19 - 2012-06-08 18:10 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 17:19 - 2012-06-08 18:10 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 17:19 - 2012-06-08 18:09 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 17:19 - 2012-06-08 18:09 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 17:15 - 2012-06-08 18:10 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 17:15 - 2012-06-08 18:09 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 15:19 - 2012-06-08 18:09 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 15:15 - 2012-06-08 18:09 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 07:49 - 2012-07-15 20:56 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 07:17 - 2012-07-15 20:56 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 07:12 - 2012-07-15 20:56 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 07:05 - 2012-07-15 20:56 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 07:05 - 2012-07-15 20:56 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 07:04 - 2012-07-15 20:56 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 07:04 - 2012-07-15 20:56 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 07:03 - 2012-07-15 20:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 07:01 - 2012-07-15 20:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 07:00 - 2012-07-15 20:56 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 06:59 - 2012-07-15 20:56 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 06:57 - 2012-07-15 20:56 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 06:57 - 2012-07-15 20:56 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 06:54 - 2012-07-15 20:56 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-02 04:07 - 2012-07-15 20:56 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-06-02 03:43 - 2012-07-15 20:56 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-06-02 03:33 - 2012-07-15 20:56 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-06-02 03:26 - 2012-07-15 20:56 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-06-02 03:25 - 2012-07-15 20:56 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-06-02 03:25 - 2012-07-15 20:56 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-06-02 03:23 - 2012-07-15 20:56 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-06-02 03:21 - 2012-07-15 20:56 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-06-02 03:20 - 2012-07-15 20:56 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-06-02 03:19 - 2012-07-15 20:56 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-06-02 03:19 - 2012-07-15 20:56 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-06-02 03:17 - 2012-07-15 20:56 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-06-02 03:16 - 2012-07-15 20:56 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-06-02 03:14 - 2012-07-15 20:56 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-06-02 00:50 - 2012-07-10 22:28 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-02 00:48 - 2012-07-10 22:28 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-02 00:48 - 2012-07-10 22:28 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-02 00:45 - 2012-07-10 22:28 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-02 00:44 - 2012-07-10 22:28 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-06-01 23:40 - 2012-07-10 22:28 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2012-06-01 23:40 - 2012-07-10 22:28 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2012-06-01 23:39 - 2012-07-10 22:28 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2012-06-01 23:34 - 2012-07-10 22:28 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2012-05-24 15:37 - 2012-05-24 15:37 - 00347424 ____A (Microsoft Corporation) C:\Users\JB\Downloads\MicrosoftFixit.Printing.Run.exe

2012-05-19 23:00 - 2012-05-19 23:00 - 02929525 ____A C:\Users\JB\Downloads\The Eye of the World - Robert Jordan.epub

2012-05-18 17:04 - 2012-05-18 17:00 - 00137732 ____A C:\Windows\hpoins44.dat

2012-05-18 17:04 - 2012-05-18 17:00 - 00000354 ____A C:\Users\All Users\hpzinstall.log

2012-05-18 17:04 - 2012-05-18 17:00 - 00000354 ____A C:\Users\All Users\Application Data\hpzinstall.log

2012-05-18 17:00 - 2012-05-18 16:56 - 39969288 ____A C:\Users\JB\Downloads\DJ_AIO_06_F2400_NonNet_Basic_Win_enu_140_175.exe

2012-05-04 06:06 - 2012-06-12 12:23 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2012-05-04 05:03 - 2012-06-12 12:23 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2012-05-04 05:03 - 2012-06-12 12:23 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2012-05-01 00:40 - 2012-06-12 12:23 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll

2012-04-29 20:12 - 2012-04-29 20:12 - 00000997 ____A C:\Users\Jessica\Desktop\SopCast.lnk

2012-04-27 22:55 - 2012-06-12 12:23 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys

2012-04-26 00:41 - 2012-06-12 12:23 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll

2012-04-26 00:41 - 2012-06-12 12:23 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll

2012-04-26 00:34 - 2012-06-12 12:23 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe

2012-04-24 00:37 - 2012-06-12 12:22 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2012-04-24 00:37 - 2012-06-12 12:22 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2012-04-24 00:37 - 2012-06-12 12:22 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2012-04-23 23:36 - 2012-06-12 12:22 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2012-04-23 23:36 - 2012-06-12 12:22 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2012-04-23 23:36 - 2012-06-12 12:22 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

ZeroAccess:

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\00000004.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\1afb2d56

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\201d3dde

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000004.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000008.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\000000cb.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000000.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000032.@

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000064.@

ZeroAccess:

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\@

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\L

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\U

ZeroAccess:

C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:

C:\Windows\assembly\GAC_64\Desktop.ini

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 11%

Total physical RAM: 6051.18 MB

Available physical RAM: 5350.05 MB

Total Pagefile: 6049.38 MB

Available Pagefile: 5340.35 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:584.34 GB) (Free:474.09 GB) NTFS

2 Drive d: (RECOVERY) (Fixed) (Total:11.79 GB) (Free:3.45 GB) NTFS ==>[system with boot components (obtained from reading drive)]

3 Drive e: (JESSICA) (Removable) (Total:3.74 GB) (Free:2.8 GB) FAT32

5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 596 GB 3072 KB

Disk 1 Online 3827 MB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 OEM 39 MB 31 KB

Partition 2 Primary 11 GB 40 MB

Partition 3 Primary 584 GB 11 GB

==================================================================================

Disk: 0

Partition 1

Type : DE

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 FAT Partition 39 MB Healthy Hidden

==================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 D RECOVERY NTFS Partition 11 GB Healthy

==================================================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C OS NTFS Partition 584 GB Healthy

==================================================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 3826 MB 16 KB

==================================================================================

Disk: 1

Partition 1

Type : 0B

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 E JESSICA FAT32 Removable 3826 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-08 03:23

======================= End Of Log ==========================

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

services.exe is infected and has to be replaced:

C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.

In Vista or Windows 7: Boot to System Recovery Options and run FRST.

Type the following in the edit box after "Search:".

services.exe

It then should look like:

Search: services.exe

Click Search button and post the log (Search.txt) it makes to your reply.

MrC

Link to post
Share on other sites
iambecoming

iambecoming

Posted
  • Author
Posted

Farbar Recovery Scan Tool Version: 16-07-2012 02

Ran by SYSTEM at 2012-07-16 18:09:33

Running from F:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe

[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

====== End Of Search ======

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, here you go......

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt


C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\00000004.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\1afb2d56
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\201d3dde
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000004.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000008.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\000000cb.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000000.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000032.@
C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000064.@
C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}
C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\@
C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\L
C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\U
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini

Replace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exe

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST64 and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

Link to post
Share on other sites
iambecoming

iambecoming

Posted
  • Author
Posted

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 16-07-2012 02

Ran by SYSTEM at 2012-07-16 18:31:54 Run:1

Running from E:\

==============================================

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699} moved successfully.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\00000004.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\1afb2d56 not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\L\201d3dde not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000004.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\00000008.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\000000cb.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000000.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000032.@ not found.

C:\Windows\Installer\{420b8180-fbea-d69d-522e-36ce6650d699}\U\80000064.@ not found.

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699} moved successfully.

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\@ not found.

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\L not found.

C:\Users\JB\AppData\Local\{420b8180-fbea-d69d-522e-36ce6650d699}\U not found.

C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.

C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.

C:\Windows\System32\services.exe moved successfully.

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

==== End of Fixlog ====

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Great...Well Done, next.............

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
iambecoming

iambecoming

Posted
  • Author
Posted

Here's the Combofix log.

ComboFix 12-07-16.01 - JB 07/16/2012 19:04:01.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6051.4748 [GMT -5:00]

Running from: c:\users\JB\Desktop\ComboFix.exe

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Roaming

.

.

((((((((((((((((((((((((( Files Created from 2012-06-17 to 2012-07-17 )))))))))))))))))))))))))))))))

.

.

2012-07-16 22:42 . 2012-07-16 22:42 -------- d-----w- C:\FRST

2012-07-16 13:22 . 2012-07-16 13:22 -------- d-----w- c:\users\JB\AppData\Roaming\Malwarebytes

2012-07-16 13:22 . 2012-07-16 13:22 -------- d-----w- c:\programdata\Malwarebytes

2012-07-16 13:22 . 2012-07-16 13:22 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-07-16 13:22 . 2012-07-03 18:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-16 04:58 . 2012-07-16 04:58 -------- d-----w- c:\users\JB\AppData\Roaming\SUPERAntiSpyware.com

2012-07-16 04:57 . 2012-07-16 04:58 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-07-16 04:57 . 2012-07-16 04:57 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2012-07-16 04:40 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys

2012-07-13 21:44 . 2012-07-13 21:44 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2012-07-11 23:30 . 2012-07-11 23:30 -------- d-----w- c:\users\JB\AppData\Roaming\Macrovision

2012-07-11 20:49 . 2012-07-11 21:20 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-11 20:49 . 2012-07-11 20:49 -------- d-----w- c:\windows\system32\Macromed

2012-07-11 17:34 . 2012-07-11 17:34 -------- d-----w- c:\users\JB\AppData\Local\Diagnostics

2012-07-04 20:24 . 2012-07-04 20:24 -------- d-----w- c:\users\JB\AppData\Local\Motorola

2012-07-04 14:20 . 2012-07-04 14:20 -------- d-----w- c:\programdata\Motorola

2012-07-04 14:03 . 2012-07-04 14:03 -------- d-----w- c:\users\JB\AppData\Roaming\Motorola Mobility

2012-07-04 14:02 . 2012-07-04 20:15 -------- d-----w- c:\program files (x86)\Motorola

2012-07-04 14:02 . 2012-07-04 14:03 -------- d-----w- c:\program files (x86)\Motorola Mobility

2012-07-04 14:01 . 2012-07-04 14:01 -------- d-----w- c:\program files\Motorola Inc

2012-07-04 14:01 . 2012-07-04 14:01 -------- d-----w- c:\program files\Common Files\Motorola Shared

2012-07-04 14:01 . 2012-07-04 14:01 -------- d-----w- c:\users\JB\AppData\Roaming\Motorola

2012-06-25 21:04 . 2012-06-25 21:04 1394248 ----a-w- c:\windows\SysWow64\msxml4.dll

2012-06-24 01:01 . 2012-06-24 01:03 -------- d-----w- c:\program files (x86)\DVD43 Plug-in

2012-06-24 01:01 . 2010-05-25 20:26 611840 ----a-w- c:\windows\SysWow64\DVD43.dll

2012-06-24 00:51 . 2012-06-24 00:51 -------- d-----w- c:\users\JB\AppData\Roaming\HandBrake

2012-06-24 00:49 . 2012-06-24 00:49 -------- d-----w- c:\program files\Handbrake

2012-06-22 03:28 . 2012-06-22 03:28 -------- d-----w- c:\programdata\dvdfab

2012-06-21 23:02 . 2012-06-21 23:02 -------- d-----w- c:\users\JB\AppData\Local\Windows Live

2012-06-18 04:01 . 2012-06-22 02:59 -------- d-----w- c:\users\JB\AppData\Roaming\dvdcss

2012-06-18 03:59 . 2012-06-18 03:59 -------- d-----w- c:\users\JB\AppData\Roaming\Digiarty

2012-06-18 03:52 . 2012-06-22 03:04 -------- d-----w- c:\programdata\DVD Shrink

2012-06-18 03:52 . 2012-06-18 03:52 -------- d-----w- c:\program files (x86)\DVD Shrink

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-11 21:20 . 2011-11-01 22:16 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-06-02 22:19 . 2012-06-08 23:09 38424 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-08 23:10 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-08 23:10 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-08 23:10 44056 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-08 23:09 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-08 23:10 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-08 23:09 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 20:19 . 2012-06-08 23:09 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 20:15 . 2012-06-08 23:09 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-05-04 11:06 . 2012-06-12 17:23 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-05-04 10:03 . 2012-06-12 17:23 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-05-04 10:03 . 2012-06-12 17:23 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-05-01 05:40 . 2012-06-12 17:23 209920 ----a-w- c:\windows\system32\profsvc.dll

2012-04-28 03:55 . 2012-06-12 17:23 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-04-26 05:41 . 2012-06-12 17:23 77312 ----a-w- c:\windows\system32\rdpwsx.dll

2012-04-26 05:41 . 2012-06-12 17:23 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-04-26 05:34 . 2012-06-12 17:23 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-04-24 05:37 . 2012-06-12 17:22 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2012-04-24 05:37 . 2012-06-12 17:22 140288 ----a-w- c:\windows\system32\cryptnet.dll

2012-04-24 05:37 . 2012-06-12 17:22 1462272 ----a-w- c:\windows\system32\crypt32.dll

2012-04-24 04:36 . 2012-06-12 17:22 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-04-24 04:36 . 2012-06-12 17:22 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-04-24 04:36 . 2012-06-12 17:22 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 5661056]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]

"Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-04-04 35736]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]

"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2011-04-29 885760]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736]

"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2011-05-04 136416]

"Seagate Dashboard"="c:\program files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-06-01 79112]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 0201491342483215mcinstcleanup;McAfee Application Installer Cleanup (0201491342483215);c:\users\JB\AppData\Local\Temp\020149~1.EXE [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 DellDigitalDelivery;Dell Digital Delivery Service;c:\program files (x86)\Dell Digital Delivery\DeliveryService.exe [2011-07-13 150920]

R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-11 250056]

R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-05-19 1335360]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-29 6144]

R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-29 29720]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [2009-07-10 31744]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2012-01-25 22016]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2012-01-25 9728]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2012-01-25 27136]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2011-11-08 11776]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]

R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-04-10 25072]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]

R3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys [2011-07-20 136000]

R3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys [2011-07-20 406336]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-03 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]

S2 AdobeActiveFileMonitor10.0;Adobe Active File Monitor V10;c:\program files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [2011-09-15 169624]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-05-19 921664]

S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-05-19 995392]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]

S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-05-04 25824]

S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-05-18 116632]

S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]

S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2011-09-02 65657]

S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2011-06-01 14088]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-07-08 1692480]

S3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys [2011-05-19 51712]

S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2011-05-19 53248]

S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-07-19 282624]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]

S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-07-19 59904]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-09-21 56344]

S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-12-28 8505856]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-10-26 406632]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-17 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-11 21:20]

.

2012-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1336452609-2486671542-1175796360-1000Core.job

- c:\users\JB\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-02 20:45]

.

2012-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1336452609-2486671542-1175796360-1000UA.job

- c:\users\JB\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-02 20:45]

.

2012-07-04 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]

.

2012-07-16 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 61ae910b-6303-4deb-b4a9-e92cb1fa712f.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

2012-07-16 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task e89d2894-f9e0-4a8c-a136-28daa3bcf68b.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

2012-07-16 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-20 168216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-20 392472]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-20 416024]

"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2011-01-21 3666800]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]

"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-05-19 10365952]

"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2011-04-29 2055016]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-06-16 499608]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;192.168.*.*

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\users\JB\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.254

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Toolbar-Locked - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]

"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe

c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

c:\program files (x86)\Common Files\Java\Java Update\jusched.exe

.

**************************************************************************

.

Completion time: 2012-07-16 19:27:33 - machine was rebooted

ComboFix-quarantined-files.txt 2012-07-17 00:27

.

Pre-Run: 510,930,182,144 bytes free

Post-Run: 511,360,102,400 bytes free

.

- - End Of File - - FA8A685438CBB11839197B82A27B9004

Link to post
Share on other sites
iambecoming

iambecoming

Posted
  • Author
Posted

Finished the scan. It said no malicious items were detected. Here's the log in case you needed it. If not, thanks for everything. I'll definitely be hitting up your Paypal on a secure computer!

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.17.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

JB :: JB-PC [administrator]

Protection: Disabled

7/16/2012 10:32:14 PM

mbam-log-2012-07-16 (22-32-14).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled:

Objects scanned: 233423

Time elapsed: 2 minute(s), 27 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Great thumbsup.gif

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.