Jump to content

computer loops startup, can only boot into safe mode


Recommended Posts

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites

thanks for your help. here is the report

RogueKiller V7.6.6 [08/10/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User: Woodbury [Admin rights]

Mode: Scan -- Date: 08/12/2012 15:42:23

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 9 ¤¤¤

[bLACKLIST DLL] HKUS\.DEFAULT[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-19[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-20[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-18[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac\desktop.ini --> FOUND

[susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> FOUND

[ZeroAccess][sig found] services.exe : c:\windows\system32\services.exe --> FOUND

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD2500AAKX-753CA1 +++++

--- User ---

[MBR] 9127847ab9ebf8645185a0dbc0e7c7a4

[bSP] 826b4d320f4c3d4026d00870efb4e82e : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 752 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1622016 | Size: 237680 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

Link to post
Share on other sites

Here you go......

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

¤¤¤ Registry Entries: 9 ¤¤¤

[bLACKLIST DLL] HKUS\.DEFAULT[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-19[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-20[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

[bLACKLIST DLL] HKUS\S-1-5-18[...]\Run : Adobe (rundll32.exe "C:\Users\Woodbury\AppData\Local\Deployment\Adobe\tvzjqlnhf.dll",CreateInstance) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Files tab and put a check next to these and uncheck the rest. (if found)

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\@ --> FOUND

[ZeroAccess][FOLDER] U : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\U --> FOUND

[ZeroAccess][FOLDER] L : c:\windows\installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac\desktop.ini --> FOUND

Now click Delete on the right hand column under Options

-----------------------------------

Next.....

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:



    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

    [*]Select Command Prompt

    [*]In the command window type in notepad and press Enter.

    [*]The notepad opens. Under File menu select Open.

    [*]Select "Computer" and find your flash drive letter and close the notepad.

    [*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

    [*]The tool will start to run.

    [*]When the tool opens click Yes to disclaimer.

    [*]Press Scan button.

    [*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:

    services.exe

    [*]Now press the Search button

    [*]When the search is complete, search.txt will also be written to your USB

    [*]Type exit and reboot the computer normally

    [*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

MrC

Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 10-08-2012

Ran by SYSTEM at 12-08-2012 16:20:11

Running from J:\

Windows 7 Professional Service Pack 1 (X86) OS Language: English(US)

The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtDCpl.exe [2697832 2010-10-04] (Realtek Semiconductor Corp.)

HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [143384 2010-12-09] (Intel Corporation)

HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [176664 2010-12-09] (Intel Corporation)

HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [177176 2010-12-09] (Intel Corporation)

HKLM\...\Run: [iAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)

HKLM\...\Run: [iMSS] "C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [112152 2011-01-17] (Intel Corporation)

HKLM\...\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe" [87336 2009-07-06] (CyberLink Corp.)

HKLM\...\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe" [50472 2010-04-29] (CyberLink Corp.)

HKLM\...\Run: [] [x]

HKLM\...\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions)

HKLM\...\Run: [Desktop Disc Tool] "C:\Program Files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] ()

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)

HKLM\...\Run: [tvncontrol] "C:\Program Files\TightVNC\tvnserver.exe" -controlservice -slave [828944 2011-08-03] (GlavSoft LLC.)

HKLM\...\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe" [1391272 2012-01-03] (Ask)

HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation)

HKLM\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462920 2012-07-03] (Malwarebytes Corporation)

HKLM\...\Run: [Memeo Instant Backup] C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui [136416 2011-05-04] (Memeo Inc.)

HKLM\...\Run: [Memeo AutoSync] C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent [144608 2011-05-04] (Memeo Inc.)

HKLM\...\Run: [seagate Dashboard] C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui [79112 2011-06-01] ()

HKU\Woodbury\...\Run: [Google Update] "C:\Users\Woodbury\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-08-12] (Google Inc.)

HKU\Woodbury\...\Run: [KGShareApp] C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe [394752 2011-09-22] (Eastman Kodak Company)

HKU\Woodbury\...\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe [x]

HKU\Woodbury\...\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe [2433024 2011-08-11] ()

HKU\Woodbury\...\Run: [spotify Web Helper] "C:\Users\Woodbury\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1193176 2012-07-20] ()

HKLM\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1085000 2012-07-03] (Malwarebytes Corporation)

Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)

Winlogon\Notify\spba: C:\Program Files\Common Files\SPBA\homefus2.dll [X]

Tcpip\..\Interfaces\{B1EA15BF-CF64-4DF8-8A48-B8D2D6ADC77D}: [NameServer]192.168.1.4,192.168.1.5

Lsa: [Authentication Packages] msv1_0

wvauth

================================ Services (Whitelisted) ==================

2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)

2 Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [110752 2010-09-21] (Intel Corporation)

2 jhi_service; C:\Program Files\Intel\Services\IPT\jhi_service.exe [212944 2011-02-23] (Intel Corporation)

2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)

2 MemeoBackgroundService; C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe [25824 2011-05-04] (Memeo)

2 MotoHelper; C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe [227184 2011-08-10] ()

3 RoxMediaDB12OEM; "C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe" [1116656 2010-11-25] (Sonic Solutions)

2 RoxWatch12; "C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe" [219632 2010-11-25] (Sonic Solutions)

2 SeagateDashboardService; C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [14088 2011-06-01] (Memeo)

3 SecureStorageService; "C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Secure Storage Manager\SecureStorageService.exe" [1477632 2010-11-03] (Wave Systems Corp.)

2 tcsd_win32.exe; "C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe" [1629696 2010-07-13] ()

2 TdmService; "C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe" [2336104 2010-10-16] (Wave Systems Corp.)

2 tvnserver; "C:\Program Files\TightVNC\tvnserver.exe" -service [828944 2011-08-03] (GlavSoft LLC.)

3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

========================== Drivers (Whitelisted) =============

3 e1cexpress; C:\Windows\System32\DRIVERS\e1c6232.sys [268968 2011-07-20] (Intel Corporation)

3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHDA.sys [2749416 2010-10-04] (Realtek Semiconductor Corp.)

3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)

3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41088 2010-10-19] (Intel Corporation)

3 motandroidusb; C:\Windows\System32\Drivers\motoandroid.sys [25856 2009-07-10] (Motorola)

0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)

1 MpKsl4fd32fea; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{602857B2-4308-49FA-B355-8369851ECB62}\MpKsl4fd32fea.sys [29904 2012-08-10] ()

3 netvsc; C:\Windows\System32\DRIVERS\netvsc60.sys [126464 2010-11-20] (Microsoft Corporation)

0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)

3 sscdserd; C:\Windows\System32\DRIVERS\sscdserd.sys [110280 2010-11-10] (MCCI Corporation)

3 SynthVid; C:\Windows\System32\DRIVERS\VMBusVideoM.sys [19456 2010-11-20] (Microsoft Corporation)

3 TrueSight; \??\c:\windows\system32\drivers\TrueSight.sys [14080 2012-08-12] ()

0 dqvndx; C:\Windows\System32\drivers\rsasv.sys [x]

0 lotdt; C:\Windows\System32\drivers\cvrim.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-12 16:20 - 2012-08-12 16:20 - 00000000 ____D C:\FRST

2012-08-12 12:04 - 2012-08-12 12:05 - 00895160 ____A (Farbar) C:\Users\Woodbury\Downloads\FRST.exe

2012-08-12 12:04 - 2012-08-12 12:04 - 00002320 ____A C:\Users\Woodbury\Desktop\RKreport[6].txt

2012-08-12 12:03 - 2012-08-12 12:03 - 00002300 ____A C:\Users\Woodbury\Desktop\RKreport[5].txt

2012-08-12 12:02 - 2012-08-12 12:02 - 00002063 ____A C:\Users\Woodbury\Desktop\RKreport[4].txt

2012-08-12 12:00 - 2012-08-12 12:00 - 00003544 ____A C:\Users\Woodbury\Desktop\RKreport[3].txt

2012-08-12 11:57 - 2012-08-12 11:57 - 00002635 ____A C:\Users\Woodbury\Desktop\RKreport[2].txt

2012-08-12 11:56 - 2012-08-12 11:56 - 00014080 ____A C:\Windows\System32\Drivers\TrueSight.sys

2012-08-12 11:42 - 2012-08-12 11:42 - 00002617 ____A C:\Users\Woodbury\Desktop\RKreport[1].txt

2012-08-12 11:40 - 2012-08-12 11:59 - 00000000 ____D C:\Users\Woodbury\Desktop\RK_Quarantine

2012-08-12 11:38 - 2012-08-12 11:39 - 01558528 ____A C:\Users\Woodbury\Downloads\RogueKiller.exe

2012-08-12 11:29 - 2012-08-12 11:29 - 00751391 ____A (Farbar) C:\Users\Woodbury\Downloads\MiniToolBox.exe

2012-08-12 11:29 - 2012-08-12 11:29 - 00693235 ____A (Farbar) C:\Users\Woodbury\Downloads\FSS.exe

2012-08-12 11:29 - 2012-08-12 11:29 - 00614903 ____A C:\Users\Woodbury\Downloads\adwcleaner.exe

2012-08-12 11:09 - 2012-08-12 11:09 - 00139264 ____A C:\Users\Woodbury\Downloads\SystemLook.exe

2012-08-12 11:09 - 2012-08-12 11:09 - 00000378 ____A C:\Users\Woodbury\Downloads\SystemLook.txt

2012-08-12 10:23 - 2012-08-12 10:23 - 00000000 ____D C:\Program Files\ESET

2012-08-12 10:20 - 2012-08-12 10:20 - 02322184 ____A (ESET) C:\Users\Woodbury\Downloads\esetsmartinstaller_enu.exe

2012-08-12 10:06 - 2012-08-12 10:06 - 04731392 ____A (AVAST Software) C:\Users\Woodbury\Downloads\aswMBR.exe

2012-08-12 10:03 - 2012-08-12 10:03 - 00000000 ____D C:\Users\Woodbury\AppData\Roaming\Memeo

2012-08-12 10:01 - 2012-08-12 10:01 - 00000000 ____D C:\TDSSKiller_Quarantine

2012-08-12 09:59 - 2012-08-12 09:59 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\Woodbury\Downloads\tdsskiller.exe

2012-08-12 09:23 - 2012-08-12 09:23 - 00024395 ____A C:\Users\Woodbury\Downloads\ark.txt

2012-08-12 09:10 - 2012-08-12 09:10 - 00302592 ____A C:\Users\Woodbury\Downloads\f8eih9xn.exe

2012-08-12 09:08 - 2012-08-12 09:08 - 00021432 ____A C:\Users\Woodbury\Downloads\Attach.txt

2012-08-12 09:08 - 2012-08-12 09:08 - 00014346 ____A C:\Users\Woodbury\Downloads\DDS.txt

2012-08-12 09:07 - 2012-08-12 09:07 - 00607260 ____R (Swearware) C:\Users\Woodbury\Downloads\dds.com

2012-08-12 09:06 - 2012-08-12 09:06 - 00050477 ____A C:\Users\Woodbury\Downloads\Defogger.exe

2012-08-12 09:06 - 2012-08-12 09:06 - 00000478 ____A C:\Users\Woodbury\Downloads\defogger_disable.log

2012-08-12 09:06 - 2012-08-12 09:06 - 00000000 ____A C:\Users\Woodbury\defogger_reenable

2012-08-12 08:47 - 2012-08-12 08:47 - 00388608 ____A (Trend Micro Inc.) C:\Users\Woodbury\Downloads\HijackThis.exe

2012-08-12 08:47 - 2012-08-12 08:47 - 00011293 ____A C:\Users\Woodbury\Downloads\hijackthis.log

2012-08-12 08:25 - 2012-08-12 08:25 - 00131072 ____A C:\Windows\Minidump\081212-62306-01.dmp

2012-08-12 08:19 - 2012-08-12 08:19 - 00607260 ____R (Swearware) C:\Users\Woodbury\Downloads\dds.scr

2012-08-12 07:56 - 2012-08-12 07:56 - 00131072 ____A C:\Windows\Minidump\081212-67049-01.dmp

2012-08-12 07:53 - 2012-08-12 07:54 - 00131072 ____A C:\Windows\Minidump\081212-62447-01.dmp

2012-08-12 07:50 - 2012-08-12 07:51 - 00131072 ____A C:\Windows\Minidump\081212-60575-01.dmp

2012-08-12 07:48 - 2012-08-12 07:48 - 00131072 ____A C:\Windows\Minidump\081212-60606-01.dmp

2012-08-11 10:40 - 2012-08-11 10:40 - 00000000 ____D C:\Users\Woodbury\AppData\Roaming\Seagate

2012-08-11 10:39 - 2012-08-11 10:39 - 00001245 ____A C:\Users\Public\Desktop\Seagate Dashboard.lnk

2012-08-11 10:39 - 2012-08-11 10:39 - 00000000 ____D C:\Program Files\Seagate

2012-08-11 10:39 - 2012-08-11 10:39 - 00000000 ____D C:\Program Files\Memeo

2012-08-11 10:39 - 2012-08-11 10:39 - 00000000 ____D C:\Program Files\Common Files\Memeo

2012-08-11 10:37 - 2012-08-11 10:37 - 00000000 ____D C:\Users\Woodbury\AppData\Roaming\Leadertech

2012-08-11 10:32 - 2012-08-11 10:32 - 00000000 ____D C:\Users\Woodbury\Documents\SIGNAGE - Copy

2012-08-11 10:32 - 2012-08-11 10:32 - 00000000 ____D C:\Users\Woodbury\Documents\scans-pics - Copy

2012-08-11 10:32 - 2012-08-11 10:32 - 00000000 ____D C:\Users\Woodbury\Documents\lost sales - Copy

2012-08-11 10:32 - 2012-08-11 10:32 - 00000000 ____D C:\Users\Woodbury\Documents\Damages 2008 - Copy

2012-08-11 10:32 - 2012-08-11 10:32 - 00000000 ____D C:\Users\Woodbury\Documents\CRM Questionair - Copy

2012-08-11 10:32 - 2012-02-16 08:19 - 00030720 ____A C:\Users\Woodbury\Documents\Copy of Lost Sales 2011 (2) - Copy.xls

2012-08-11 10:32 - 2011-07-15 10:32 - 13533184 ____A C:\Users\Woodbury\Documents\archive - Copy.pst

2012-08-11 10:31 - 2012-08-11 10:31 - 00000000 ____D C:\Users\Woodbury\Desktop\lg sale and uniform reports

2012-08-11 09:32 - 2012-08-11 09:32 - 00131072 ____A C:\Windows\Minidump\081112-59108-01.dmp

2012-08-11 09:29 - 2012-08-11 09:30 - 00131072 ____A C:\Windows\Minidump\081112-57907-01.dmp

2012-08-11 09:27 - 2012-08-11 09:27 - 00131072 ____A C:\Windows\Minidump\081112-59233-01.dmp

2012-08-11 09:24 - 2012-08-11 09:24 - 00131072 ____A C:\Windows\Minidump\081112-58235-01.dmp

2012-08-11 09:22 - 2012-08-11 09:22 - 00131072 ____A C:\Windows\Minidump\081112-57938-01.dmp

2012-08-11 09:19 - 2012-08-11 09:19 - 00131072 ____A C:\Windows\Minidump\081112-58547-01.dmp

2012-08-11 09:17 - 2012-08-11 09:17 - 00131072 ____A C:\Windows\Minidump\081112-57330-01.dmp

2012-08-11 08:04 - 2012-08-11 08:04 - 00131072 ____A C:\Windows\Minidump\081112-63008-01.dmp

2012-08-11 07:49 - 2012-08-11 07:49 - 00131072 ____A C:\Windows\Minidump\081112-62915-01.dmp

2012-08-11 06:27 - 2012-08-11 06:28 - 00131072 ____A C:\Windows\Minidump\081112-49920-01.dmp

2012-08-11 06:25 - 2012-08-11 06:25 - 00131072 ____A C:\Windows\Minidump\081112-42978-01.dmp

2012-08-11 06:23 - 2012-08-11 06:23 - 00131072 ____A C:\Windows\Minidump\081112-64553-01.dmp

2012-08-11 06:21 - 2012-08-11 06:21 - 00131072 ____A C:\Windows\Minidump\081112-59654-01.dmp

2012-08-11 06:19 - 2012-08-11 06:19 - 00131072 ____A C:\Windows\Minidump\081112-67969-01.dmp

2012-08-11 06:17 - 2012-08-11 06:17 - 00131072 ____A C:\Windows\Minidump\081112-40841-01.dmp

2012-08-11 06:14 - 2012-08-11 06:15 - 00131072 ____A C:\Windows\Minidump\081112-35006-01.dmp

2012-08-11 06:12 - 2012-08-11 06:12 - 00131072 ____A C:\Windows\Minidump\081112-43149-01.dmp

2012-08-11 06:09 - 2012-08-11 06:10 - 00131072 ____A C:\Windows\Minidump\081112-34445-01.dmp

2012-08-11 06:07 - 2012-08-11 06:08 - 00131072 ____A C:\Windows\Minidump\081112-43555-01.dmp

2012-08-11 05:39 - 2012-08-11 05:39 - 00131072 ____A C:\Windows\Minidump\081112-37128-01.dmp

2012-08-11 05:04 - 2012-08-11 05:04 - 00131072 ____A C:\Windows\Minidump\081112-49561-01.dmp

2012-08-10 15:25 - 2012-08-10 15:25 - 00000000 __SHD C:\Windows\System32\%APPDATA%

2012-08-10 15:18 - 2012-08-10 15:18 - 00131072 ____A C:\Windows\Minidump\081012-52104-01.dmp

2012-08-10 15:16 - 2012-08-10 15:16 - 00131072 ____A C:\Windows\Minidump\081012-43617-01.dmp

2012-08-10 15:04 - 2012-08-10 15:04 - 00131072 ____A C:\Windows\Minidump\081012-53726-01.dmp

2012-08-10 15:02 - 2012-08-12 08:25 - 00000000 ____D C:\Windows\Minidump

2012-08-10 15:02 - 2012-08-10 15:02 - 00131072 ____A C:\Windows\Minidump\081012-72010-01.dmp

2012-08-10 15:01 - 2012-08-12 08:24 - 220370009 ____A C:\Windows\MEMORY.DMP

2012-07-31 09:55 - 2012-07-31 11:23 - 00039936 ____A C:\Users\Woodbury\Desktop\Copy of Packaging Stocktake July 2012 US.xls

2012-07-25 08:07 - 2012-07-25 08:08 - 00000000 ____D C:\Users\Woodbury\Desktop\folder

2012-07-24 11:48 - 2012-07-24 11:49 - 00010484 ____A C:\Users\Woodbury\Desktop\Copy of Stationary Inventory.xlsx

2012-07-16 13:51 - 2012-07-16 13:51 - 00001073 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 13:51 - 2012-07-16 13:51 - 00000000 ____D C:\Users\Woodbury\AppData\Roaming\Malwarebytes

2012-07-16 13:51 - 2012-07-16 13:51 - 00000000 ____D C:\Users\All Users\Malwarebytes

2012-07-16 13:51 - 2012-07-16 13:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2012-07-16 13:51 - 2012-07-03 09:46 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-07-16 13:48 - 2012-07-16 13:49 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Woodbury\Downloads\mbam-setup-1.62.0.1300.exe

============ 3 Months Modified Files ========================

2012-08-12 12:13 - 2010-11-20 13:48 - 00064184 ____A C:\Windows\PFRO.log

2012-08-12 12:13 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-08-12 12:13 - 2009-07-13 20:39 - 00066266 ____A C:\Windows\setupact.log

2012-08-12 12:06 - 2010-11-20 13:01 - 00786100 ____A C:\Windows\System32\PerfStringBackup.INI

2012-08-12 12:05 - 2012-08-12 12:04 - 00895160 ____A (Farbar) C:\Users\Woodbury\Downloads\FRST.exe

2012-08-12 12:04 - 2012-08-12 12:04 - 00002320 ____A C:\Users\Woodbury\Desktop\RKreport[6].txt

2012-08-12 12:03 - 2012-08-12 12:03 - 00002300 ____A C:\Users\Woodbury\Desktop\RKreport[5].txt

2012-08-12 12:02 - 2012-08-12 12:02 - 00002063 ____A C:\Users\Woodbury\Desktop\RKreport[4].txt

2012-08-12 12:00 - 2012-08-12 12:00 - 00003544 ____A C:\Users\Woodbury\Desktop\RKreport[3].txt

2012-08-12 11:57 - 2012-08-12 11:57 - 00002635 ____A C:\Users\Woodbury\Desktop\RKreport[2].txt

2012-08-12 11:56 - 2012-08-12 11:56 - 00014080 ____A C:\Windows\System32\Drivers\TrueSight.sys

2012-08-12 11:42 - 2012-08-12 11:42 - 00002617 ____A C:\Users\Woodbury\Desktop\RKreport[1].txt

2012-08-12 11:39 - 2012-08-12 11:38 - 01558528 ____A C:\Users\Woodbury\Downloads\RogueKiller.exe

2012-08-12 11:31 - 2011-08-12 12:01 - 00000920 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1088043340-3029459262-2287327895-1000UA.job

2012-08-12 11:29 - 2012-08-12 11:29 - 00751391 ____A (Farbar) C:\Users\Woodbury\Downloads\MiniToolBox.exe

2012-08-12 11:29 - 2012-08-12 11:29 - 00693235 ____A (Farbar) C:\Users\Woodbury\Downloads\FSS.exe

2012-08-12 11:29 - 2012-08-12 11:29 - 00614903 ____A C:\Users\Woodbury\Downloads\adwcleaner.exe

2012-08-12 11:18 - 2012-03-29 04:19 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-08-12 11:09 - 2012-08-12 11:09 - 00139264 ____A C:\Users\Woodbury\Downloads\SystemLook.exe

2012-08-12 11:09 - 2012-08-12 11:09 - 00000378 ____A C:\Users\Woodbury\Downloads\SystemLook.txt

2012-08-12 10:20 - 2012-08-12 10:20 - 02322184 ____A (ESET) C:\Users\Woodbury\Downloads\esetsmartinstaller_enu.exe

2012-08-12 10:10 - 2011-08-12 08:54 - 00000360 ____A C:\Windows\System32\config\netlogon.ftl

2012-08-12 10:10 - 2009-07-13 20:34 - 00021312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-08-12 10:10 - 2009-07-13 20:34 - 00021312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-08-12 10:06 - 2012-08-12 10:06 - 04731392 ____A (AVAST Software) C:\Users\Woodbury\Downloads\aswMBR.exe

2012-08-12 09:59 - 2012-08-12 09:59 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\Woodbury\Downloads\tdsskiller.exe

2012-08-12 09:23 - 2012-08-12 09:23 - 00024395 ____A C:\Users\Woodbury\Downloads\ark.txt

2012-08-12 09:10 - 2012-08-12 09:10 - 00302592 ____A C:\Users\Woodbury\Downloads\f8eih9xn.exe

2012-08-12 09:08 - 2012-08-12 09:08 - 00021432 ____A C:\Users\Woodbury\Downloads\Attach.txt

2012-08-12 09:08 - 2012-08-12 09:08 - 00014346 ____A C:\Users\Woodbury\Downloads\DDS.txt

2012-08-12 09:07 - 2012-08-12 09:07 - 00607260 ____R (Swearware) C:\Users\Woodbury\Downloads\dds.com

2012-08-12 09:06 - 2012-08-12 09:06 - 00050477 ____A C:\Users\Woodbury\Downloads\Defogger.exe

2012-08-12 09:06 - 2012-08-12 09:06 - 00000478 ____A C:\Users\Woodbury\Downloads\defogger_disable.log

2012-08-12 09:06 - 2012-08-12 09:06 - 00000000 ____A C:\Users\Woodbury\defogger_reenable

2012-08-12 08:47 - 2012-08-12 08:47 - 00388608 ____A (Trend Micro Inc.) C:\Users\Woodbury\Downloads\HijackThis.exe

2012-08-12 08:47 - 2012-08-12 08:47 - 00011293 ____A C:\Users\Woodbury\Downloads\hijackthis.log

2012-08-12 08:25 - 2012-08-12 08:25 - 00131072 ____A C:\Windows\Minidump\081212-62306-01.dmp

2012-08-12 08:24 - 2012-08-10 15:01 - 220370009 ____A C:\Windows\MEMORY.DMP

2012-08-12 08:19 - 2012-08-12 08:19 - 00607260 ____R (Swearware) C:\Users\Woodbury\Downloads\dds.scr

2012-08-12 07:56 - 2012-08-12 07:56 - 00131072 ____A C:\Windows\Minidump\081212-67049-01.dmp

2012-08-12 07:54 - 2012-08-12 07:53 - 00131072 ____A C:\Windows\Minidump\081212-62447-01.dmp

2012-08-12 07:51 - 2012-08-12 07:50 - 00131072 ____A C:\Windows\Minidump\081212-60575-01.dmp

2012-08-12 07:48 - 2012-08-12 07:48 - 00131072 ____A C:\Windows\Minidump\081212-60606-01.dmp

2012-08-11 10:39 - 2012-08-11 10:39 - 00001245 ____A C:\Users\Public\Desktop\Seagate Dashboard.lnk

2012-08-11 09:35 - 2011-07-22 10:15 - 01284151 ____A C:\Windows\WindowsUpdate.log

2012-08-11 09:32 - 2012-08-11 09:32 - 00131072 ____A C:\Windows\Minidump\081112-59108-01.dmp

2012-08-11 09:30 - 2012-08-11 09:29 - 00131072 ____A C:\Windows\Minidump\081112-57907-01.dmp

2012-08-11 09:27 - 2012-08-11 09:27 - 00131072 ____A C:\Windows\Minidump\081112-59233-01.dmp

2012-08-11 09:24 - 2012-08-11 09:24 - 00131072 ____A C:\Windows\Minidump\081112-58235-01.dmp

2012-08-11 09:22 - 2012-08-11 09:22 - 00131072 ____A C:\Windows\Minidump\081112-57938-01.dmp

2012-08-11 09:19 - 2012-08-11 09:19 - 00131072 ____A C:\Windows\Minidump\081112-58547-01.dmp

2012-08-11 09:17 - 2012-08-11 09:17 - 00131072 ____A C:\Windows\Minidump\081112-57330-01.dmp

2012-08-11 08:04 - 2012-08-11 08:04 - 00131072 ____A C:\Windows\Minidump\081112-63008-01.dmp

2012-08-11 07:49 - 2012-08-11 07:49 - 00131072 ____A C:\Windows\Minidump\081112-62915-01.dmp

2012-08-11 06:28 - 2012-08-11 06:27 - 00131072 ____A C:\Windows\Minidump\081112-49920-01.dmp

2012-08-11 06:25 - 2012-08-11 06:25 - 00131072 ____A C:\Windows\Minidump\081112-42978-01.dmp

2012-08-11 06:23 - 2012-08-11 06:23 - 00131072 ____A C:\Windows\Minidump\081112-64553-01.dmp

2012-08-11 06:21 - 2012-08-11 06:21 - 00131072 ____A C:\Windows\Minidump\081112-59654-01.dmp

2012-08-11 06:19 - 2012-08-11 06:19 - 00131072 ____A C:\Windows\Minidump\081112-67969-01.dmp

2012-08-11 06:17 - 2012-08-11 06:17 - 00131072 ____A C:\Windows\Minidump\081112-40841-01.dmp

2012-08-11 06:15 - 2012-08-11 06:14 - 00131072 ____A C:\Windows\Minidump\081112-35006-01.dmp

2012-08-11 06:12 - 2012-08-11 06:12 - 00131072 ____A C:\Windows\Minidump\081112-43149-01.dmp

2012-08-11 06:10 - 2012-08-11 06:09 - 00131072 ____A C:\Windows\Minidump\081112-34445-01.dmp

2012-08-11 06:08 - 2012-08-11 06:07 - 00131072 ____A C:\Windows\Minidump\081112-43555-01.dmp

2012-08-11 05:39 - 2012-08-11 05:39 - 00131072 ____A C:\Windows\Minidump\081112-37128-01.dmp

2012-08-11 05:04 - 2012-08-11 05:04 - 00131072 ____A C:\Windows\Minidump\081112-49561-01.dmp

2012-08-10 15:18 - 2012-08-10 15:18 - 00131072 ____A C:\Windows\Minidump\081012-52104-01.dmp

2012-08-10 15:16 - 2012-08-10 15:16 - 00131072 ____A C:\Windows\Minidump\081012-43617-01.dmp

2012-08-10 15:04 - 2012-08-10 15:04 - 00131072 ____A C:\Windows\Minidump\081012-53726-01.dmp

2012-08-10 15:02 - 2012-08-10 15:02 - 00131072 ____A C:\Windows\Minidump\081012-72010-01.dmp

2012-08-10 06:03 - 2011-08-14 08:48 - 00275456 ____A C:\Users\Woodbury\Desktop\Thomas Pink Daily Planner.xls

2012-08-10 06:02 - 2011-11-26 11:25 - 00740352 ____A C:\Users\Woodbury\Desktop\2012 Ledger.xls

2012-08-09 15:31 - 2011-08-12 12:01 - 00000868 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1088043340-3029459262-2287327895-1000Core.job

2012-08-02 18:18 - 2012-03-29 04:19 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe

2012-08-02 18:18 - 2011-07-22 10:16 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

2012-07-31 11:23 - 2012-07-31 09:55 - 00039936 ____A C:\Users\Woodbury\Desktop\Copy of Packaging Stocktake July 2012 US.xls

2012-07-27 06:08 - 2011-09-14 05:39 - 00000490 _RASH C:\Users\administrator\ntuser.pol

2012-07-24 11:49 - 2012-07-24 11:48 - 00010484 ____A C:\Users\Woodbury\Desktop\Copy of Stationary Inventory.xlsx

2012-07-19 23:55 - 2011-08-12 11:00 - 00009771 _RASH C:\Users\All Users\ntuser.pol

2012-07-16 13:51 - 2012-07-16 13:51 - 00001073 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2012-07-16 13:49 - 2012-07-16 13:48 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Woodbury\Downloads\mbam-setup-1.62.0.1300.exe

2012-07-11 23:19 - 2009-07-13 20:33 - 00459360 ____A C:\Windows\System32\FNTCACHE.DAT

2012-07-11 23:02 - 2009-07-13 18:04 - 00000478 ____A C:\Windows\win.ini

2012-07-11 23:01 - 2011-08-08 11:18 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2012-07-03 09:46 - 2012-07-16 13:51 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2012-06-27 14:00 - 2012-06-27 14:00 - 05949709 ____A C:\Users\Woodbury\Downloads\documents-export-2012-06-27.zip

2012-06-25 12:31 - 2012-06-25 12:31 - 00010931 ____A C:\Users\Woodbury\Desktop\Group Tour Calendar-July 2012.xlsx

2012-06-25 08:48 - 2012-06-25 08:46 - 00048778 ____A C:\Users\Woodbury\Desktop\Woodbury measurements - Revised (2).xlsx

2012-06-14 06:37 - 2012-06-14 06:37 - 03822860 ____A C:\Users\Woodbury\Downloads\documents-export-2012-06-14.zip

2012-06-12 12:08 - 2012-06-12 12:14 - 00395670 ____A C:\Users\Woodbury\Desktop\Duratran.jpeg

2012-06-12 09:55 - 2012-06-12 09:55 - 00015872 ____A C:\Users\Woodbury\Desktop\Group Tour Calendar-June 2012.xls

2012-06-11 18:40 - 2012-07-11 23:01 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2012-06-08 20:41 - 2012-07-11 00:45 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2012-06-05 21:05 - 2012-07-11 00:45 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2012-06-05 21:05 - 2012-07-11 00:45 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2012-06-05 21:03 - 2012-07-11 00:45 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll

2012-06-02 14:19 - 2012-06-21 01:33 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll

2012-06-02 14:19 - 2012-06-21 01:33 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll

2012-06-02 14:19 - 2012-06-21 01:33 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe

2012-06-02 14:19 - 2012-06-21 01:33 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll

2012-06-02 14:19 - 2012-06-21 01:33 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll

2012-06-02 14:12 - 2012-06-21 01:33 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll

2012-06-02 14:12 - 2012-06-21 01:33 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll

2012-06-02 11:19 - 2012-06-21 01:33 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll

2012-06-02 11:12 - 2012-06-21 01:33 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe

2012-06-02 01:07 - 2012-07-11 23:02 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-06-02 00:43 - 2012-07-11 23:02 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-06-02 00:33 - 2012-07-11 23:02 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-06-02 00:26 - 2012-07-11 23:02 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-06-02 00:25 - 2012-07-11 23:03 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-06-02 00:25 - 2012-07-11 23:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-06-02 00:23 - 2012-07-11 23:02 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-06-02 00:21 - 2012-07-11 23:03 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-06-02 00:20 - 2012-07-11 23:03 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-06-02 00:19 - 2012-07-11 23:03 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-06-02 00:19 - 2012-07-11 23:03 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-06-02 00:17 - 2012-07-11 23:03 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-06-02 00:16 - 2012-07-11 23:03 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-06-02 00:14 - 2012-07-11 23:03 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-06-01 20:45 - 2012-07-11 00:45 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys

2012-06-01 20:45 - 2012-07-11 00:45 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys

2012-06-01 20:40 - 2012-07-11 00:45 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys

2012-06-01 20:40 - 2012-07-11 00:45 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll

2012-06-01 20:39 - 2012-07-11 00:45 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2012-05-31 06:49 - 2012-05-31 05:37 - 00046080 ____A C:\Users\Woodbury\Desktop\Copy of Packaging Stocktake May 2012 US.xls

ZeroAccess:

C:\Windows\Installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}

C:\Windows\Installer\{3a94a105-3d1c-9304-c322-302fbf17b76a}\U

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 13%

Total physical RAM: 3976.93 MB

Available physical RAM: 3444.32 MB

Total Pagefile: 3975.22 MB

Available Pagefile: 3448.67 MB

Total Virtual: 2047.88 MB

Available Virtual: 1958.29 MB

======================= Partitions =========================

1 Drive c: (OS) (Fixed) (Total:232.11 GB) (Free:193.82 GB) NTFS

7 Drive j: (FreeAgent GoFlex Drive) (Fixed) (Total:465.76 GB) (Free:465.04 GB) NTFS

9 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

10 Drive y: (RECOVERY) (Fixed) (Total:0.73 GB) (Free:0.54 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 232 GB 2048 KB

Disk 1 No Media 0 B 0 B

Disk 2 No Media 0 B 0 B

Disk 3 No Media 0 B 0 B

Disk 4 No Media 0 B 0 B

Disk 5 Online 465 GB 1024 KB

Disk 6 No Media 0 B 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 OEM 39 MB 31 KB

Partition 2 Primary 752 MB 40 MB

Partition 3 Primary 232 GB 792 MB

==================================================================================

Disk: 0

Partition 1

Type : DE

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 9 FAT Partition 39 MB Healthy Hidden

==================================================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y RECOVERY NTFS Partition 752 MB Healthy

==================================================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C OS NTFS Partition 232 GB Healthy

==================================================================================

Partitions of Disk 5:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 465 GB 31 KB

==================================================================================

Disk: 5

Partition 1

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 7 J FreeAgent G NTFS Partition 465 GB Healthy

==================================================================================

Last Boot: 2012-08-06 20:41

======================= End Of Log ==========================

Farbar Recovery Scan Tool Version: 10-08-2012

Ran by SYSTEM at 2012-08-12 16:21:20

Running from J:\

================== Search: "services.exe" ===================

C:\Windows\System32\services.exe

[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

=== End Of Search ===

Link to post
Share on other sites

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

Link to post
Share on other sites

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites

hi I figured out how to get to the previous step you requested. here is the fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 10-08-2012

Ran by SYSTEM at 2012-08-12 17:25:26 Run:1

Running from J:\

==============================================

C:\Windows\Installer\{3a94a105-3d1c-9304-c322-302fbf17b76a} moved successfully.

==== End of Fixlog ====

I should continue to the combofix step, right?

Link to post
Share on other sites

ok here's the report

ComboFix 12-08-10.02 - Woodbury 08/12/2012 17:42:45.1.4 - x86

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3241.2244 [GMT -4:00]

Running from: c:\users\Woodbury\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\users\Woodbury\AppData\Roaming\Microsoft\Windows\Recent\ADP Time Saver.url

c:\users\Woodbury\AppData\Roaming\Microsoft\Windows\Recent\Pay Stub Site.url

c:\users\Woodbury\AppData\Roaming\Microsoft\Windows\Recent\Pink Link.url

J:\Autorun.inf

J:\Setup.exe

.

.

((((((((((((((((((((((((( Files Created from 2012-07-12 to 2012-08-12 )))))))))))))))))))))))))))))))

.

.

2012-08-13 00:20 . 2012-08-13 00:20 -------- d-----w- C:\FRST

2012-08-12 19:56 . 2012-08-12 19:56 14080 ----a-w- c:\windows\system32\drivers\TrueSight.sys

2012-08-12 18:23 . 2012-08-12 18:23 -------- d-----w- c:\program files\ESET

2012-08-12 18:03 . 2012-08-12 18:03 -------- d-----w- c:\users\Woodbury\AppData\Roaming\Memeo

2012-08-12 18:01 . 2012-08-12 18:01 -------- d-----w- C:\TDSSKiller_Quarantine

2012-08-11 18:40 . 2012-08-11 18:40 -------- d-----w- c:\users\Woodbury\AppData\Roaming\Seagate

2012-08-11 18:39 . 2012-08-11 18:39 -------- d-----w- c:\program files\Common Files\Memeo

2012-08-11 18:39 . 2012-08-11 18:39 -------- d-----w- c:\program files\Memeo

2012-08-11 18:39 . 2012-08-11 18:39 -------- d-----w- c:\program files\Seagate

2012-08-11 18:37 . 2012-08-11 18:37 -------- d-----w- c:\users\Woodbury\AppData\Roaming\Leadertech

2012-08-10 23:25 . 2012-08-10 23:25 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-08-10 21:10 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{602857B2-4308-49FA-B355-8369851ECB62}\mpengine.dll

2012-08-09 13:37 . 2012-06-29 08:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-07-16 21:51 . 2012-07-16 21:51 -------- d-----w- c:\users\Woodbury\AppData\Roaming\Malwarebytes

2012-07-16 21:51 . 2012-07-16 21:51 -------- d-----w- c:\programdata\Malwarebytes

2012-07-16 21:51 . 2012-07-16 21:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-07-16 21:51 . 2012-07-03 17:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-03 02:18 . 2012-03-29 12:19 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-08-03 02:18 . 2011-07-22 18:16 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-12 02:40 . 2012-07-12 07:01 2345984 ----a-w- c:\windows\system32\win32k.sys

2012-06-06 05:05 . 2012-07-11 08:45 1390080 ----a-w- c:\windows\system32\msxml6.dll

2012-06-06 05:05 . 2012-07-11 08:45 1236992 ----a-w- c:\windows\system32\msxml3.dll

2012-06-06 05:03 . 2012-07-11 08:45 805376 ----a-w- c:\windows\system32\cdosys.dll

2012-06-02 22:19 . 2012-06-21 09:33 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 09:33 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 09:33 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-21 09:33 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:19 . 2012-06-21 09:33 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:12 . 2012-06-21 09:33 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:12 . 2012-06-21 09:33 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 19:19 . 2012-06-21 09:33 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 19:12 . 2012-06-21 09:33 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-02 08:33 . 2012-07-12 07:02 1800192 ----a-w- c:\windows\system32\jscript9.dll

2012-06-02 08:25 . 2012-07-12 07:03 1129472 ----a-w- c:\windows\system32\wininet.dll

2012-06-02 08:25 . 2012-07-12 07:02 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2012-06-02 08:20 . 2012-07-12 07:03 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2012-06-02 08:16 . 2012-07-12 07:03 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-06-02 04:45 . 2012-07-11 08:45 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2012-06-02 04:45 . 2012-07-11 08:45 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2012-06-02 04:40 . 2012-07-11 08:45 369336 ----a-w- c:\windows\system32\drivers\cng.sys

2012-06-02 04:40 . 2012-07-11 08:45 225280 ----a-w- c:\windows\system32\schannel.dll

2012-06-02 04:39 . 2012-07-11 08:45 219136 ----a-w- c:\windows\system32\ncrypt.dll

2012-07-18 19:02 . 2011-10-17 20:16 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]

"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\yt.dll" [2011-11-02 2015544]

.

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

.

[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]

[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2012-01-03 20:31 1514152 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"

[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]

2010-10-16 21:10 119664 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"

[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]

2010-10-16 21:10 119664 ----a-w- c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KGShareApp"="c:\program files\Kodak\KODAK Share Button App\KGShare_App.exe" [2011-09-22 394752]

"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2011-08-12 2433024]

"Spotify Web Helper"="c:\users\Woodbury\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-07-20 1193176]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtDCpl.exe" [2010-10-04 2697832]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-12-09 143384]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-12-09 176664]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-12-09 177176]

"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]

"IMSS"="c:\program files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2011-01-17 112152]

"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]

"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-29 50472]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"Desktop Disc Tool"="c:\program files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"tvncontrol"="c:\program files\TightVNC\tvnserver.exe" [2011-08-03 828944]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

"Memeo Instant Backup"="c:\program files\Memeo\AutoBackup\MemeoLauncher2.exe" [2011-05-04 136416]

"Memeo AutoSync"="c:\program files\Memeo\AutoSync\MemeoLauncher2.exe" [2011-05-04 144608]

"Seagate Dashboard"="c:\program files\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-06-01 79112]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"DisableCAD"= 1 (0x1)

"SoftwareSASGeneration"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]

2010-09-15 16:11 1971536 ----a-w- c:\program files\Common Files\SPBA\homefus2.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

Authentication Packages REG_MULTI_SZ msv1_0 wvauth

.

R0 dqvndx;dqvndx;c:\windows\System32\drivers\rsasv.sys [x]

R0 lotdt;lotdt;c:\windows\System32\drivers\cvrim.sys [x]

R1 MpKsl4fd32fea;MpKsl4fd32fea;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{602857B2-4308-49FA-B355-8369851ECB62}\MpKsl4fd32fea.sys [x]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]

R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 netvsc;netvsc;c:\windows\system32\DRIVERS\netvsc60.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]

R3 SynthVid;SynthVid;c:\windows\system32\DRIVERS\VMBusVideoM.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]

S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [x]

S2 jhi_service;Intel® Identity Protection Technology Host Interface Service;c:\program files\Intel\Services\IPT\jhi_service.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\Memeo\AutoBackup\MemeoBackgroundService.exe [x]

S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [x]

S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [x]

S2 tvnserver;TightVNC Server;c:\program files\TightVNC\tvnserver.exe [x]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]

S3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c6232.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 MEI;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [x]

.

.

Contents of the 'Scheduled Tasks' folder

.

2012-08-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 02:18]

.

2012-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1088043340-3029459262-2287327895-1000Core.job

- c:\users\Woodbury\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 20:01]

.

2012-08-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1088043340-3029459262-2287327895-1000UA.job

- c:\users\Woodbury\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-12 20:01]

.

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

TCP: Interfaces\{B1EA15BF-CF64-4DF8-8A48-B8D2D6ADC77D}: NameServer = 192.168.1.4,192.168.1.5

FF - ProfilePath - c:\users\Woodbury\AppData\Roaming\Mozilla\Firefox\Profiles\ttv17soi.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://g.msn.com/USREL/1

FF - prefs.js: network.proxy.type - 2

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

HKCU-Run-Active Desktop Calendar - c:\program files\XemiComputers\Active Desktop Calendar\ADC.exe

SafeBoot-MsMpSvc

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'lsass.exe'(588)

c:\windows\system32\wvauth.DLL

.

- - - - - - - > 'Explorer.exe'(4684)

c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\WUDFHost.exe

c:\program files\Common Files\SPBA\upeksvr.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\Motorola\MotoHelper\MotoHelperAgent.exe

c:\program files\Kodak\KODAK Share Button App\Listener.exe

c:\program files\Seagate\Seagate Dashboard\MemeoDashboard.exe

c:\program files\Intel\Intel® Management Engine Components\LMS\LMS.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\DllHost.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

.

**************************************************************************

.

Completion time: 2012-08-12 17:52:35 - machine was rebooted

ComboFix-quarantined-files.txt 2012-08-12 21:52

.

Pre-Run: 209,081,974,784 bytes free

Post-Run: 209,176,530,944 bytes free

.

- - End Of File - - 8771FAF74EE375D3477C925A72DAD215

Link to post
Share on other sites

Lets make sure:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :Filefind
    rsasv.sys
    cvrim.sys


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

MrC

Link to post
Share on other sites

Great thumbsup.gif and Yes > you're good to go!

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.