bmur Posted August 15, 2012 ID:585362 Share Posted August 15, 2012 Seem to have some sort of Redirect Trojan. Malwarebytes detects it but is unable to remove it. I appreciate any assistance you can provide!Roguekiller and FRST64 logs below..Malwarebytes Anti-Malware 1.62.0.1300www.malwarebytes.orgDatabase version: v2012.07.24.12Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421brennan :: BRENNAN-PC [administrator]7/24/2012 7:34:04 PMmbam-log-2012-07-24 (19-34-04).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 188387Time elapsed: 24 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 1C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.(end).DDS (Ver_2011-08-26.01) - NTFSAMD64Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1Run by brennan at 20:07:49 on 2012-07-24Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8104.6538 [GMT -5:00].SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exeC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Program Files\ASRock\XFast LAN\spd.exeC:\Windows\System32\svchost.exe -k LocalServiceNoNetworkC:\Windows\SysWOW64\PnkBstrA.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\Core Temp\Core Temp.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Program Files\ASRock\XFast LAN\cfosspeed.exeC:\Windows\System32\rundll32.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Windows\System32\igfxpers.exeC:\Program Files (x86)\Steam\Steam.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exeC:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exeC:\Users\brennan\Local Settings\Apps\F.lux\flux.exeC:\Program Files (x86)\XFastUsb\XFastUsb.exeC:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exeC:\Program Files (x86)\Winamp\winampa.exeC:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\Common Files\Steam\SteamService.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNet"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDnsC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.mWinlogon: Userinit=userinit.exe,BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dllBHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dlluRun: [ASRockXTU]uRun: [zASRockInstantBoot]uRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silentuRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunuRun: [Octoshape Streaming Services] "C:\Users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrunuRun: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exeuRun: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /suRun: [F.lux] "C:\Users\brennan\Local Settings\Apps\F.lux\flux.exe" /noshowmRun: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exemRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"mRun: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /rmRun: [updReg] C:\Windows\UpdReg.EXEmRun: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"mRun: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exemRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mPolicies-explorer: NoActiveDesktop = 1 (0x1)mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)LSP: mswsock.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabTCP: DhcpNameServer = 192.168.1.254TCP: Interfaces\{CCBA1BC7-03D1-4509-8F93-393E8610B531} : DhcpNameServer = 192.168.1.254Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLLAppInit_DLLs: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\APPINI~1.DLL, C:\Windows\SysWOW64\nvinit.dllBHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dllBHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dllmRun-x64: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exemRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"mRun-x64: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /rmRun-x64: [updReg] C:\Windows\UpdReg.EXEmRun-x64: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"mRun-x64: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exemRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"AppInit_DLLs-X64: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\APPINI~1.DLL, C:\Windows\SysWOW64\nvinit.dllHosts: 127.0.0.1 www.spywareinfo.com.================= FIREFOX ===================.FF - ProfilePath - C:\Users\brennan\AppData\Roaming\Mozilla\Firefox\Profiles\dufcgsb9.default\FF - prefs.js: browser.startup.homepage - www.youtube.comFF - prefs.js: network.proxy.type - 0FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dllFF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dllFF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dllFF - plugin: C:\ProgramData\id Software\QuakeLive\npquakezero.dllFF - plugin: C:\Users\brennan\AppData\Roaming\Mozilla\Firefox\Profiles\dufcgsb9.default\extensions\{2d3fbcf7-be69-4433-8858-c621a8d0e58d}\plugins\npwidevinemediaoptimizer.dllFF - plugin: C:\Users\brennan\AppData\Roaming\Mozilla\plugins\npoctoshape.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dllFF - plugin: C:\Windows\SysWOW64\npDeployJava1.dllFF - plugin: C:\Windows\SysWOW64\npmproxy.dll.============= SERVICES / DRIVERS ===============.R1 AsrAppCharger;AsrAppCharger;C:\Windows\system32\DRIVERS\AsrAppCharger.sys --> C:\Windows\system32\DRIVERS\AsrAppCharger.sys [?]R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-1-13 2656280]R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\system32\DRIVERS\asmthub3.sys --> C:\Windows\system32\DRIVERS\asmthub3.sys [?]R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\system32\DRIVERS\asmtxhci.sys --> C:\Windows\system32\DRIVERS\asmtxhci.sys [?]R3 MBfilt;MBfilt;C:\Windows\system32\drivers\MBfilt64.sys --> C:\Windows\system32\drivers\MBfilt64.sys [?]R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]R3 VirtuWDDM;VirtuWDDM;C:\Windows\system32\DRIVERS\VirtuWDDM.sys --> C:\Windows\system32\DRIVERS\VirtuWDDM.sys [?]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudbus.sys --> C:\Windows\system32\DRIVERS\ssudbus.sys [?]S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-27 113120]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudmdm.sys --> C:\Windows\system32\DRIVERS\ssudmdm.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?].=============== Created Last 30 ================.2012-07-23 20:51:38 -------- d-----w- C:\Program Files (x86)\Desktop Restore2012-07-20 19:29:59 3148800 ----a-w- C:\Windows\System32\win32k.sys2012-07-12 21:23:23 -------- d-----w- C:\Program Files (x86)\Data Doctor Recovery - SIM Card (Demo)2012-07-11 02:38:42 -------- d-----w- C:\ProgramData\ManiaPlanet2012-07-11 02:38:42 -------- d-----w- C:\Program Files (x86)\ManiaPlanet2012-07-10 05:44:17 31808 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS2012-07-10 01:51:12 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy2012-07-10 01:51:12 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy2012-07-03 01:29:24 -------- d-----w- C:\Users\brennan\AppData\Local\Macromedia2012-06-29 04:26:43 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%2012-06-28 06:05:33 -------- d-----w- C:\Program Files (x86)\Oracle2012-06-28 06:05:03 772504 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll2012-06-27 02:25:16 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D04860B6-F1C9-498E-8639-C3368DC29CCF}\mpengine.dll2012-06-26 04:09:51 -------- d-----w- C:\Users\brennan\AppData\Local\Apps.==================== Find3M ====================.2012-07-03 18:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys2012-07-03 00:50:07 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2012-07-03 00:50:07 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll2012-06-02 20:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll2012-06-02 20:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll2012-05-15 09:29:47 889664 ----a-w- C:\Windows\System32\nvvsvc.exe2012-05-15 09:29:46 63296 ----a-w- C:\Windows\System32\nvshext.dll2012-05-15 09:29:46 118080 ----a-w- C:\Windows\System32\nvmctray.dll2012-05-15 09:29:45 2621723 ----a-w- C:\Windows\System32\nvcoproc.bin2012-05-15 09:29:25 3149632 ----a-w- C:\Windows\System32\nvsvc64.dll2012-05-15 09:28:42 6151488 ----a-w- C:\Windows\System32\nvcpl.dll2012-05-11 12:34:14 203320 ----a-w- C:\Windows\System32\drivers\ssudmdm.sys2012-05-05 15:20:07 8744608 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe2012-05-05 07:27:39 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe2012-05-05 07:27:32 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr2012-05-05 07:27:32 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe2012-05-05 07:23:15 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex02012-05-05 00:29:16 687504 ----a-w- C:\Windows\SysWow64\deployJava1.dll2012-05-04 11:06:22 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe2012-05-04 10:03:53 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe2012-05-04 10:03:50 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe2012-05-03 23:43:56 244812 ----a-w- C:\Windows\QLPrism Uninstaller.exe2012-05-01 05:40:20 209920 ----a-w- C:\Windows\System32\profsvc.dll2012-04-28 05:32:05 1112064 ----a-w- C:\Windows\System32\rdpcorets.dll2012-04-28 03:55:21 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys2012-04-26 05:41:56 77312 ----a-w- C:\Windows\System32\rdpwsx.dll2012-04-26 05:41:55 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll2012-04-26 05:34:27 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe.============= FINISH: 20:08:17.67 ===============.DDS (Ver_2011-08-26.01).Microsoft Windows 7 UltimateBoot Device: \Device\HarddiskVolume1Install Date: 1/13/2012 5:06:52 PMSystem Uptime: 7/24/2012 7:50:19 PM (1 hours ago).Motherboard: ASRock | | Z68 Extreme3 Gen3Processor: Intel® Core™ i5-2500K CPU @ 3.30GHz | CPUSocket | 1584/100mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 931 GiB total, 353.903 GiB free..==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP77: 7/18/2012 11:56:34 PM - Scheduled CheckpointRP78: 7/20/2012 2:27:21 PM - Windows UpdateRP79: 7/23/2012 3:51:25 PM - Installed Desktop Restore.==== Installed Programs ======================.Acrobat.comAdobe AIRAdobe Flash Player 11 ActiveXAdobe Flash Player 11 PluginAdobe Reader 9Asmedia ASM104x USB 3.0 Host Controller DriverASRock eXtreme Tuner v0.1.110ASRock InstantBoot v1.29Battlefield 3™Battlefield: Bad Company™ 2Battlelog Web PluginsBlacklight: RetributionCall of Duty: Modern Warfare 3 - MultiplayerCounter-StrikeCounter-Strike: Global Offensive BetaData Doctor Recovery - SIM Card (Demo)Diablo IIIDivX Web PlayerDota 2ESN SonarF.luxGOM PlayerGOMTV StreamerHeroes of NewerthHotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)Intel® Control CenterIntel® Management Engine ComponentsIntel® Processor GraphicsJava Auto UpdaterJava™ 6 Update 31Java™ 7 Update 5JavaFX 2.1.1Killing FloorMalwarebytes Anti-Malware version 1.62.0.1300ManiaPlanetMicrosoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219Mozilla Firefox 14.0.1 (x86 en-US)Mozilla Maintenance ServiceMumble 1.2.3Need For Speed™ WorldNVIDIA PhysXOctoshape Streaming ServicesOriginPunkBuster ServicesQLPrismQuake Live Mozilla PluginRealtek Ethernet Controller DriverRealtek High Definition Audio DriverSamsung KiesSecurity Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)Skype™ 5.8Spybot - Search & DestroyStarCraft IISteamSuper MNC InvitationalTERAThe Secret WorldTHX TruStudioUpdate for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)VC80CRTRedist - 8.0.50727.762VLC media player 2.0.1WinampWinamp Detector Plug-inXFastUsb.==== Event Viewer Messages From Past Week ========.7/24/2012 8:02:36 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.7/24/2012 7:50:39 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom.==== End Of File ===========================RogueKiller V7.6.4 [07/17/2012] by Tigzymail: tigzyRK<at>gmail<dot>comFeedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/Blog: http://tigzyrk.blogspot.comOperating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser: brennan [Admin rights]Mode: Scan -- Date: 08/14/2012 22:26:54¤¤¤ Bad processes: 0 ¤¤¤¤¤¤ Registry Entries: 3 ¤¤¤[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\brennan\AppData\Local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\n.) -> FOUND[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND¤¤¤ Particular Files / Folders: ¤¤¤[ZeroAccess][FILE] @ : c:\windows\installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\@ --> FOUND[ZeroAccess][FOLDER] U : c:\windows\installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U --> FOUND[ZeroAccess][FOLDER] L : c:\windows\installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L --> FOUND[ZeroAccess][FILE] @ : c:\users\brennan\appdata\local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\@ --> FOUND[ZeroAccess][FOLDER] U : c:\users\brennan\appdata\local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U --> FOUND[ZeroAccess][FOLDER] L : c:\users\brennan\appdata\local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L --> FOUND[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND[ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND¤¤¤ Driver: [NOT LOADED] ¤¤¤¤¤¤ Infection : ZeroAccess ¤¤¤¤¤¤ HOSTS File: ¤¤¤127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com127.0.0.1 www.0scan.com127.0.0.1 0scan.com127.0.0.1 1000gratisproben.com127.0.0.1 www.1000gratisproben.com127.0.0.1 1001namen.com127.0.0.1 www.1001namen.com127.0.0.1 www.100888290cs.com127.0.0.1 100888290cs.com127.0.0.1 100sexlinks.com127.0.0.1 www.100sexlinks.com[...]¤¤¤ MBR Check: ¤¤¤+++++ PhysicalDrive0: SAMSUNG HD103SJ ATA Device +++++--- User ---[MBR] b95c8cc3473f2bddc621a7319366e565[bSP] b013177a37d549faadc3c40ef54990c7 : Windows 7 MBR CodePartition table:0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MoUser = LL1 ... OK!User = LL2 ... OK!Finished : << RKreport[1].txt >>RKreport[1].txtScan result of Farbar Recovery Scan Tool Version: 25-07-2012 01Ran by SYSTEM at 14-08-2012 21:51:05Running from F:\Windows 7 Ultimate (X64) OS Language: English(US)The current controlset is ControlSet001========================== Registry (Whitelisted) =============HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11860072 2011-06-08] (Realtek Semiconductor)HKLM\...\Run: [XFast LAN] C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-07-04] (cFos Software GmbH)HKLM\...\Run: [THXCfg64] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 [26624 2011-05-13] (Creative Technology Ltd.)HKLM\...\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)HKLM\...\Run: [igfxTray] C:\Windows\system32\igfxtray.exe [167704 2011-08-31] (Intel Corporation)HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-08-31] (Intel Corporation)HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-08-31] (Intel Corporation)HKLM-x32\...\Run: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe [4942336 2012-01-13] (FNet Co., Ltd.)HKLM-x32\...\Run: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /r [909824 2011-05-19] (Creative Technology Ltd)HKLM-x32\...\Run: [updReg] C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)HKLM-x32\...\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3524536 2012-07-15] (Samsung Electronics Co., Ltd.)HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252296 2012-01-17] (Sun Microsystems, Inc.)HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.)HKU\brennan\...\Run: [ASRockXTU] [x]HKU\brennan\...\Run: [zASRockInstantBoot] [x]HKU\brennan\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1353080 2012-08-13] (Valve Corporation)HKU\brennan\...\Run: [Octoshape Streaming Services] "C:\Users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun [70936 2009-01-08] (Octoshape ApS)HKU\brennan\...\Run: [F.lux] "C:\Users\brennan\Local Settings\Apps\F.lux\flux.exe" /noshow [966656 2009-08-28] ()Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.254AppInit_DLLs: C:\PROGRA~1\LUCIDL~1\VIRTU\APPINI~1.DLL,C:\Windows\system32\nvinitx.dll==================== Services (Whitelisted) ======2 cFosSpeedS; "C:\Program Files\ASRock\XFast LAN\spd.exe" -service [395136 2011-07-04] (cFos Software GmbH)2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-07-25] ()2 UNS; "C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe" [2656280 2011-02-22] (Intel Corporation)========================== Drivers (Whitelisted) =============1 cFosSpeed; C:\Windows\System32\DRIVERS\cfosspeed6.sys [1632128 2011-07-04] (cFos Software GmbH)3 FNETTBOH_305; C:\Windows\System32\Drivers\FNETTBOH_305.sys [31808 2012-07-09] (FNet Co., Ltd.)1 FNETURPX; C:\Windows\System32\Drivers\FNETURPX.sys [15936 2012-01-13] (FNet Co., Ltd.)3 pbfilter; \??\C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()3 VirtuWDDM; C:\Windows\System32\Drivers\VirtuWDDM.sys [66336 2011-07-07] (Lucidlogix Inc.)3 ALSysIO; \??\C:\Users\brennan\AppData\Local\Temp\ALSysIO64.sys [x]4 NVHDA; C:\Windows\System32\drivers\nvhda64v.sys [x]3 Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [x]3 tsusbhub; C:\Windows\System32\drivers\tsusbhub.sys [x]3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]========================== NetSvcs (Whitelisted) ======================= One Month Created Files and Folders ==============2012-08-08 18:20 - 2012-08-08 18:39 - 00000000 ____D C:\Users\brennan\AppData\Roaming\ImgBurn2012-08-08 18:19 - 2012-08-08 18:19 - 00001865 ____A C:\Users\Public\Desktop\ImgBurn.lnk2012-08-08 18:19 - 2012-08-08 18:19 - 00000000 ____D C:\Program Files (x86)\ImgBurn2012-08-07 21:08 - 2012-08-07 21:09 - 00000000 ____D C:\Users\brennan\AppData\Roaming\Apple Computer2012-08-07 21:08 - 2012-08-07 21:08 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Users\brennan\AppData\Local\Apple Computer2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Users\brennan\AppData\Local\Apple2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Users\All Users\Apple Computer2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Users\All Users\{93E26451-CD9A-43A5-A2FA-C42392EA4001}2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Program Files\iTunes2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Program Files\iPod2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Program Files (x86)\iTunes2012-08-07 21:08 - 2012-08-07 21:08 - 00000000 ____D C:\Program Files (x86)\Apple Software Update2012-08-07 21:08 - 2009-05-18 10:17 - 00034152 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys2012-08-07 21:08 - 2008-04-17 09:12 - 00126312 ____A (GEAR Software Inc.) C:\Windows\System32\GEARAspi64.dll2012-08-07 21:08 - 2008-04-17 09:12 - 00107368 ____A (GEAR Software Inc.) C:\Windows\SysWOW64\GEARAspi.dll2012-08-07 21:07 - 2012-08-07 21:07 - 00000000 ____D C:\Users\All Users\Apple2012-08-07 21:07 - 2012-08-07 21:07 - 00000000 ____D C:\Program Files\Common Files\Apple2012-08-07 21:07 - 2012-08-07 21:07 - 00000000 ____D C:\Program Files\Bonjour2012-08-07 21:07 - 2012-08-07 21:07 - 00000000 ____D C:\Program Files (x86)\Bonjour2012-08-07 16:30 - 2012-08-14 18:30 - 00000000 ____D C:\Users\brennan\AppData\Roaming\dvdcss2012-08-07 15:11 - 2012-08-14 11:16 - 00000000 ____D C:\dvd flick projects2012-08-07 14:55 - 2012-08-14 12:39 - 00000000 ____D C:\Users\brennan\AppData\Roaming\DVD Flick2012-08-07 14:55 - 2012-08-07 14:55 - 00001914 ____A C:\Users\brennan\Desktop\DVD Flick.lnk2012-08-07 14:55 - 2012-08-07 14:55 - 00000000 ____D C:\Program Files (x86)\DVD Flick2012-08-07 14:55 - 2008-08-31 10:27 - 00028672 ____A (-) C:\Windows\SysWOW64\mousewheel.ocx2012-08-07 14:55 - 2007-08-31 15:36 - 00036864 ____A (Robdogg Inc.) C:\Windows\SysWOW64\trayicon_handler.ocx2012-08-07 14:55 - 2004-03-08 21:00 - 01081616 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mscomctl.ocx2012-08-07 14:55 - 2004-03-08 21:00 - 00662288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mscomct2.ocx2012-08-07 14:55 - 2004-03-08 21:00 - 00609824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.ocx2012-08-07 14:55 - 2004-03-08 21:00 - 00212240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\richtx32.ocx2012-08-07 14:55 - 2003-01-26 10:41 - 00040960 ____A (vbAccelerator) C:\Windows\SysWOW64\ssubtmr6.dll2012-08-07 14:55 - 1998-06-23 21:00 - 00164144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\comct232.ocx2012-08-06 16:53 - 2012-08-07 14:27 - 00000085 ___SH C:\Users\All Users\.zreglib2012-08-06 16:51 - 2012-08-06 16:51 - 00001199 ____A C:\Users\Public\Desktop\CloneDVD2.lnk2012-08-06 16:51 - 2012-08-06 16:51 - 00000000 ____D C:\Program Files (x86)\Elaborate Bytes2012-08-02 20:07 - 2012-08-07 16:28 - 00000000 ____D C:\QLPrism2012-08-02 20:07 - 2012-08-02 20:07 - 00250534 ____A C:\Windows\QLPrism Uninstaller.exe2012-08-02 20:07 - 2012-08-02 20:07 - 00001567 ____A C:\Users\Public\Desktop\QLPrism Config Utility.lnk2012-08-02 20:07 - 2012-08-02 20:07 - 00001478 ____A C:\Users\Public\Desktop\QLPrism.lnk2012-07-30 20:49 - 2012-08-12 15:41 - 00000000 ____D C:\Music22012-07-26 21:49 - 2012-07-26 21:49 - 00000000 ____D C:\FRST2012-07-25 19:13 - 2012-07-25 19:13 - 00000000 ____D C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP2012-07-25 19:13 - 2012-07-24 17:14 - 03130440 ____A C:\Windows\SysWOW64\pbsvc_blr.exe2012-07-25 00:35 - 2012-06-03 23:59 - 00203320 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudmdm.sys2012-07-25 00:35 - 2012-06-03 23:59 - 00099384 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudbus.sys2012-07-25 00:27 - 2012-07-25 00:28 - 00000043 ____A C:\Users\brennan\Desktop\stuff to do....txt2012-07-24 18:45 - 2012-07-24 18:45 - 01438391 ____A (Farbar) C:\Users\brennan\Downloads\FRST64.exe2012-07-24 18:14 - 2012-07-24 18:14 - 00002647 ____A C:\Users\brennan\Desktop\RKreport[1].txt2012-07-24 18:13 - 2012-07-24 18:14 - 00000000 ____D C:\Users\brennan\Desktop\RK_Quarantine2012-07-24 18:13 - 2012-07-24 18:13 - 01552384 ____A C:\Users\brennan\Desktop\RogueKiller.exe2012-07-24 16:46 - 2012-07-24 16:46 - 00607260 ____R (Swearware) C:\Users\brennan\Desktop\dds.com2012-07-24 15:25 - 2012-08-01 10:58 - 00000293 ____A C:\Users\brennan\Desktop\car q's.txt2012-07-23 12:51 - 2012-07-23 12:51 - 00336384 ____A C:\Users\brennan\Downloads\DeskInst64.msi2012-07-23 12:51 - 2012-07-23 12:51 - 00000000 ____D C:\Program Files (x86)\Desktop Restore2012-07-20 11:29 - 2012-06-11 19:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2012-07-20 11:27 - 2012-06-08 21:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2012-07-20 11:27 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2012-07-20 11:27 - 2012-06-05 22:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll2012-07-20 11:27 - 2012-06-05 22:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll2012-07-20 11:27 - 2012-06-05 22:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll2012-07-20 11:27 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2012-07-20 11:27 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2012-07-20 11:27 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll2012-07-20 11:27 - 2012-06-02 04:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2012-07-20 11:27 - 2012-06-02 04:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2012-07-20 11:27 - 2012-06-02 04:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2012-07-20 11:27 - 2012-06-02 04:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2012-07-20 11:27 - 2012-06-02 04:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2012-07-20 11:27 - 2012-06-02 04:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2012-07-20 11:27 - 2012-06-02 04:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2012-07-20 11:27 - 2012-06-02 04:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2012-07-20 11:27 - 2012-06-02 04:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2012-07-20 11:27 - 2012-06-02 04:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2012-07-20 11:27 - 2012-06-02 03:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2012-07-20 11:27 - 2012-06-02 03:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2012-07-20 11:27 - 2012-06-02 03:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2012-07-20 11:27 - 2012-06-02 03:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2012-07-20 11:27 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2012-07-20 11:27 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2012-07-20 11:27 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2012-07-20 11:27 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2012-07-20 11:27 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2012-07-20 11:27 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2012-07-20 11:27 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2012-07-20 11:27 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2012-07-20 11:27 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2012-07-20 11:27 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2012-07-20 11:27 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2012-07-20 11:27 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2012-07-20 11:27 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2012-07-20 11:27 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2012-07-20 11:27 - 2012-06-01 21:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys2012-07-20 11:27 - 2012-06-01 21:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys2012-07-20 11:27 - 2012-06-01 21:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys2012-07-20 11:27 - 2012-06-01 21:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll2012-07-20 11:27 - 2012-06-01 21:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll2012-07-20 11:27 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2012-07-20 11:27 - 2012-06-01 20:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2012-07-20 11:27 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2012-07-20 11:27 - 2012-06-01 20:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2012-07-20 11:27 - 2010-06-25 19:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll2012-07-20 11:27 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll============ 3 Months Modified Files ========================2012-08-14 18:44 - 2012-08-14 18:44 - 00000048 ____A C:\Windows\EE8CF7B1BCB80CF6.log2012-08-14 18:43 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT2012-08-14 18:43 - 2009-07-13 20:51 - 00035362 ____A C:\Windows\setupact.log2012-08-14 18:19 - 2009-07-13 21:13 - 00726142 ____A C:\Windows\System32\PerfStringBackup.INI2012-08-13 12:25 - 2009-07-13 20:45 - 00014416 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02012-08-13 12:25 - 2009-07-13 20:45 - 00014416 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02012-08-08 18:19 - 2012-08-08 18:19 - 00001865 ____A C:\Users\Public\Desktop\ImgBurn.lnk2012-08-07 21:08 - 2012-08-07 21:08 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk2012-08-07 14:55 - 2012-08-07 14:55 - 00001914 ____A C:\Users\brennan\Desktop\DVD Flick.lnk2012-08-07 14:27 - 2012-08-06 16:53 - 00000085 ___SH C:\Users\All Users\.zreglib2012-08-06 16:51 - 2012-08-06 16:51 - 00001199 ____A C:\Users\Public\Desktop\CloneDVD2.lnk2012-08-05 19:42 - 2012-06-12 18:07 - 00000584 ____A C:\Users\brennan\Desktop\musics.txt2012-08-02 20:07 - 2012-08-02 20:07 - 00250534 ____A C:\Windows\QLPrism Uninstaller.exe2012-08-02 20:07 - 2012-08-02 20:07 - 00001567 ____A C:\Users\Public\Desktop\QLPrism Config Utility.lnk2012-08-02 20:07 - 2012-08-02 20:07 - 00001478 ____A C:\Users\Public\Desktop\QLPrism.lnk2012-08-01 10:58 - 2012-07-24 15:25 - 00000293 ____A C:\Users\brennan\Desktop\car q's.txt2012-07-30 12:54 - 2012-04-29 00:12 - 00000251 ____A C:\Users\brennan\Desktop\funnyshit.txt2012-07-26 21:30 - 2012-01-13 15:06 - 01308817 ____A C:\Windows\WindowsUpdate.log2012-07-26 21:28 - 2012-01-13 15:59 - 00001130 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk2012-07-25 19:23 - 2012-05-04 23:23 - 00298016 ____A C:\Windows\SysWOW64\PnkBstrB.xtr2012-07-25 19:23 - 2012-04-30 15:52 - 00298016 ____A C:\Windows\SysWOW64\PnkBstrB.exe2012-07-25 19:23 - 2012-04-30 15:52 - 00076888 ____A C:\Windows\SysWOW64\PnkBstrA.exe2012-07-25 19:14 - 2012-04-30 15:52 - 00189248 ____A C:\Windows\SysWOW64\PnkBstrB.ex02012-07-25 00:28 - 2012-07-25 00:27 - 00000043 ____A C:\Users\brennan\Desktop\stuff to do....txt2012-07-24 18:45 - 2012-07-24 18:45 - 01438391 ____A (Farbar) C:\Users\brennan\Downloads\FRST64.exe2012-07-24 18:14 - 2012-07-24 18:14 - 00002647 ____A C:\Users\brennan\Desktop\RKreport[1].txt2012-07-24 18:13 - 2012-07-24 18:13 - 01552384 ____A C:\Users\brennan\Desktop\RogueKiller.exe2012-07-24 17:14 - 2012-07-25 19:13 - 03130440 ____A C:\Windows\SysWOW64\pbsvc_blr.exe2012-07-24 16:50 - 2012-01-13 05:03 - 00015298 ____A C:\Windows\PFRO.log2012-07-24 16:46 - 2012-07-24 16:46 - 00607260 ____R (Swearware) C:\Users\brennan\Desktop\dds.com2012-07-23 12:51 - 2012-07-23 12:51 - 00336384 ____A C:\Users\brennan\Downloads\DeskInst64.msi2012-07-20 18:54 - 2009-07-13 20:45 - 00268912 ____A C:\Windows\System32\FNTCACHE.DAT2012-07-20 18:49 - 2012-06-25 21:10 - 00001237 ____A C:\Users\brennan\Desktop\car.txt2012-07-20 11:28 - 2012-01-13 16:40 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe2012-07-19 19:09 - 2012-01-13 16:26 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2012-07-12 22:07 - 2012-01-13 15:08 - 00000721 ____A C:\Users\brennan\Desktop\passwords.txt2012-07-12 13:23 - 2012-07-12 13:23 - 00001367 ____A C:\Users\brennan\Desktop\Data Doctor Recovery - SIM Card (Demo).lnk2012-07-12 13:22 - 2012-07-12 13:22 - 02451224 ____A (Pro Data Doctor Pvt. Ltd.) C:\Users\brennan\Downloads\sim-card.exe2012-07-10 18:38 - 2012-07-10 18:38 - 00001083 ____A C:\Users\Public\Desktop\ManiaPlanet.lnk2012-07-10 18:36 - 2012-07-10 18:22 - 877373381 ____A C:\Users\brennan\Desktop\ManiaPlanet_Setup-1.bin2012-07-10 18:22 - 2012-07-10 18:22 - 01147424 ____A (Nadeo ) C:\Users\brennan\Desktop\ManiaPlanet_Setup.exe2012-07-09 21:44 - 2012-07-09 21:44 - 00031808 ____A (FNet Co., Ltd.) C:\Windows\System32\Drivers\FNETTBOH_305.SYS2012-07-09 17:51 - 2012-07-09 17:51 - 00001258 ____A C:\Users\brennan\Desktop\Spybot - Search & Destroy.lnk2012-07-03 10:46 - 2012-01-13 16:26 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys2012-07-02 16:50 - 2012-04-04 04:44 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2012-07-02 16:50 - 2012-01-13 16:21 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2012-06-27 22:04 - 2012-03-01 22:02 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe2012-06-27 22:04 - 2012-03-01 22:02 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe2012-06-25 23:02 - 2011-09-16 08:54 - 00330240 ____A ((?)????) C:\Windows\MASetupCaller.dll2012-06-25 23:02 - 2011-09-16 08:54 - 00045320 ____A (MARKANY) C:\Windows\SysWOW64\MAMACExtract.dll2012-06-22 00:41 - 2012-06-22 00:41 - 00001203 ____A C:\Users\Public\Desktop\The Secret World.lnk2012-06-11 19:08 - 2012-07-20 11:29 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2012-06-08 21:43 - 2012-07-20 11:27 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2012-06-08 20:41 - 2012-07-20 11:27 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2012-06-05 22:06 - 2012-07-20 11:27 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll2012-06-05 22:06 - 2012-07-20 11:27 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll2012-06-05 22:02 - 2012-07-20 11:27 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll2012-06-05 21:05 - 2012-07-20 11:27 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2012-06-05 21:05 - 2012-07-20 11:27 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2012-06-05 21:03 - 2012-07-20 11:27 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll2012-06-03 23:59 - 2012-07-25 00:35 - 00203320 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudmdm.sys2012-06-03 23:59 - 2012-07-25 00:35 - 00099384 ____A (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\System32\Drivers\ssudbus.sys2012-06-02 14:19 - 2012-06-21 13:58 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll2012-06-02 14:19 - 2012-06-21 13:58 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll2012-06-02 14:19 - 2012-06-21 13:58 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe2012-06-02 14:19 - 2012-06-21 13:58 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll2012-06-02 14:19 - 2012-06-21 13:58 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll2012-06-02 14:15 - 2012-06-21 13:58 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll2012-06-02 14:15 - 2012-06-21 13:58 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll2012-06-02 12:19 - 2012-06-21 13:57 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll2012-06-02 12:15 - 2012-06-21 13:57 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe2012-06-02 04:49 - 2012-07-20 11:27 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2012-06-02 04:17 - 2012-07-20 11:27 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2012-06-02 04:12 - 2012-07-20 11:27 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2012-06-02 04:05 - 2012-07-20 11:27 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2012-06-02 04:05 - 2012-07-20 11:27 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2012-06-02 04:04 - 2012-07-20 11:27 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2012-06-02 04:04 - 2012-07-20 11:27 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2012-06-02 04:03 - 2012-07-20 11:27 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2012-06-02 04:01 - 2012-07-20 11:27 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2012-06-02 04:00 - 2012-07-20 11:27 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2012-06-02 03:59 - 2012-07-20 11:27 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2012-06-02 03:57 - 2012-07-20 11:27 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2012-06-02 03:57 - 2012-07-20 11:27 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2012-06-02 03:54 - 2012-07-20 11:27 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2012-06-02 01:07 - 2012-07-20 11:27 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2012-06-02 00:43 - 2012-07-20 11:27 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2012-06-02 00:33 - 2012-07-20 11:27 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2012-06-02 00:26 - 2012-07-20 11:27 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2012-06-02 00:25 - 2012-07-20 11:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2012-06-02 00:25 - 2012-07-20 11:27 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2012-06-02 00:23 - 2012-07-20 11:27 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2012-06-02 00:21 - 2012-07-20 11:27 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2012-06-02 00:20 - 2012-07-20 11:27 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2012-06-02 00:19 - 2012-07-20 11:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2012-06-02 00:19 - 2012-07-20 11:27 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2012-06-02 00:17 - 2012-07-20 11:27 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2012-06-02 00:16 - 2012-07-20 11:27 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2012-06-02 00:14 - 2012-07-20 11:27 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2012-06-01 21:50 - 2012-07-20 11:27 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys2012-06-01 21:48 - 2012-07-20 11:27 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys2012-06-01 21:48 - 2012-07-20 11:27 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys2012-06-01 21:45 - 2012-07-20 11:27 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll2012-06-01 21:44 - 2012-07-20 11:27 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll2012-06-01 20:40 - 2012-07-20 11:27 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2012-06-01 20:40 - 2012-07-20 11:27 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2012-06-01 20:39 - 2012-07-20 11:27 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2012-06-01 20:34 - 2012-07-20 11:27 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2012-05-29 16:26 - 2012-05-29 16:26 - 00001066 ____A C:\Users\Public\Desktop\VLC media player.lnk2012-05-20 00:46 - 2012-05-20 00:46 - 00001189 ____A C:\Users\Public\Desktop\Diablo III.lnk2012-05-17 19:59 - 2012-01-13 08:50 - 00189563 ____A C:\Windows\DirectX.logZeroAccess:C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\LC:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\UC:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\00000004.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\1afb2d56C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\201d3ddeC:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\55490ac4C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000004.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000008.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\000000cb.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000000.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000032.@C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000064.@ZeroAccess:C:\Users\brennan\AppData\Local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}C:\Users\brennan\AppData\Local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\@C:\Users\brennan\AppData\Local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\LC:\Users\brennan\AppData\Local\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\UZeroAccess:C:\Windows\assembly\GAC_32\Desktop.iniZeroAccess:C:\Windows\assembly\GAC_64\Desktop.ini========================= Known DLLs (Whitelisted) ===================================== Bamital & volsnap Check ============C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.C:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legit==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK========================= Memory info ======================Percentage of memory in use: 9%Total physical RAM: 8103.53 MBAvailable physical RAM: 7323.65 MBTotal Pagefile: 8101.68 MBAvailable Pagefile: 7312.65 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.89 MB======================= Partitions =========================1 Drive c: () (Fixed) (Total:931.41 GB) (Free:308.51 GB) NTFS2 Drive e: (Repair disc Windows 7 64-bit) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF3 Drive f: () (Removable) (Total:0.96 GB) (Free:0.54 GB) FAT4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS5 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 931 GB 0 B Disk 1 Online 980 MB 0 B Partitions of Disk 0:=============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 931 GB 101 MB==================================================================================Disk: 0Partition 1Type : 07Hidden: NoActive: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 1 Y System Rese NTFS Partition 100 MB Healthy ==================================================================================Disk: 0Partition 2Type : 07Hidden: NoActive: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 2 C NTFS Partition 931 GB Healthy ==================================================================================Partitions of Disk 1:=============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 980 MB 40 KB==================================================================================Disk: 1Partition 1Type : 06Hidden: NoActive: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- --------* Volume 3 F FAT Removable 980 MB Healthy ============================================================================================================================================Last Boot: 2012-08-07 01:18======================= End Of Log ==========================Farbar Recovery Scan Tool Version: 25-07-2012 01Ran by SYSTEM at 2012-08-14 21:59:18Running from F:\================== Search: "services.exe" ===================C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCBC:\Windows\System32\services.exe[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06====== End Of Search ====== Link to post Share on other sites More sharing options...
Staff screen317 Posted August 15, 2012 Staff ID:585366 Share Posted August 15, 2012 Hi and welcome to Malwarebytes. Please update MBAM, run a Quick Scan, and post its log. Next, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix When the tool is finished, it will produce a report for you.Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
bmur Posted August 15, 2012 Author ID:585745 Share Posted August 15, 2012 Malwarebytes Anti-Malware 1.62.0.1300www.malwarebytes.orgDatabase version: v2012.08.15.07Windows 7 Service Pack 1 x64 NTFSInternet Explorer 9.0.8112.16421brennan :: BRENNAN-PC [administrator]8/15/2012 2:17:20 PMWORK..mbam-log-2012-08-15 (14-18-17).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 195920Time elapsed: 30 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 3C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000008.@ (Trojan.Dropper.BCMiner) -> No action taken.C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\000000cb.@ (Rootkit.0Access) -> No action taken.C:\Windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000032.@ (Rootkit.0Access) -> No action taken.(end)ComboFix 12-08-15.01 - brennan 08/15/2012 14:55:47.1.4 - x64Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8104.6950 [GMT -5:00]Running from: c:\users\brennan\Desktop\ComboFix.exeSP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\assembly\GAC_32\Desktop.inic:\windows\assembly\GAC_64\Desktop.inic:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\00000004.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\1afb2d56c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\201d3ddec:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\L\55490ac4c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000004.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\00000008.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\000000cb.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000000.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000032.@c:\windows\Installer\{ef4f13ab-809e-e240-2a68-b6a08a24a7c2}\U\80000064.@c:\windows\SysWow64\muzapp.exe.Infected copy of c:\windows\system32\services.exe was found and disinfectedRestored copy from - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe..((((((((((((((((((((((((( Files Created from 2012-07-15 to 2012-08-15 )))))))))))))))))))))))))))))))..2012-08-15 20:02 . 2012-08-15 20:02 -------- d-----w- c:\users\Default\AppData\Local\temp2012-08-09 02:20 . 2012-08-09 02:39 -------- d-----w- c:\users\brennan\AppData\Roaming\ImgBurn2012-08-09 02:19 . 2012-08-09 02:19 -------- d-----w- c:\program files (x86)\ImgBurn2012-08-08 05:07 . 2012-08-08 05:07 -------- d-----w- c:\program files\Common Files\Apple2012-08-08 05:07 . 2012-08-08 05:07 -------- d-----w- c:\program files\Bonjour2012-08-08 05:07 . 2012-08-08 05:07 -------- d-----w- c:\program files (x86)\Bonjour2012-08-08 05:07 . 2012-08-08 05:08 -------- d-----w- c:\program files (x86)\Common Files\Apple2012-08-08 05:07 . 2012-08-08 05:07 -------- d-----w- c:\programdata\Apple2012-08-08 00:30 . 2012-08-15 02:30 -------- d-----w- c:\users\brennan\AppData\Roaming\dvdcss2012-08-07 23:11 . 2012-08-14 19:16 -------- d-----w- C:\dvd flick projects2012-08-07 22:55 . 2012-08-14 20:39 -------- d-----w- c:\users\brennan\AppData\Roaming\DVD Flick2012-08-07 22:55 . 2012-08-07 22:55 -------- d-----w- c:\program files (x86)\DVD Flick2012-08-07 22:55 . 2008-08-31 18:27 28672 ----a-w- c:\windows\SysWow64\mousewheel.ocx2012-08-07 22:55 . 2007-08-31 23:36 36864 ----a-w- c:\windows\SysWow64\trayicon_handler.ocx2012-08-07 22:55 . 2004-03-09 05:00 662288 ----a-w- c:\windows\SysWow64\mscomct2.ocx2012-08-07 22:55 . 2004-03-09 05:00 609824 ----a-w- c:\windows\SysWow64\comctl32.ocx2012-08-07 22:55 . 2004-03-09 05:00 212240 ----a-w- c:\windows\SysWow64\richtx32.ocx2012-08-07 22:55 . 2004-03-09 05:00 1081616 ----a-w- c:\windows\SysWow64\mscomctl.ocx2012-08-07 22:55 . 2003-01-26 18:41 40960 ----a-w- c:\windows\SysWow64\ssubtmr6.dll2012-08-07 22:55 . 1998-06-24 05:00 164144 ----a-w- c:\windows\SysWow64\comct232.ocx2012-08-07 00:51 . 2012-08-07 00:51 -------- d-----w- c:\program files (x86)\Elaborate Bytes2012-08-03 04:07 . 2012-08-03 04:07 250534 ----a-w- c:\windows\QLPrism Uninstaller.exe2012-08-03 04:07 . 2012-08-08 00:28 -------- d-----w- C:\QLPrism2012-07-31 04:49 . 2012-08-12 23:41 -------- d-----w- C:\Music22012-07-27 05:49 . 2012-07-27 05:49 -------- d-----w- C:\FRST2012-07-27 05:28 . 2012-07-14 00:17 136672 ----a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll2012-07-26 03:13 . 2012-07-25 01:14 3130440 ----a-w- c:\windows\SysWow64\pbsvc_blr.exe2012-07-26 03:13 . 2012-07-26 03:13 -------- d-----w- c:\windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP2012-07-25 08:35 . 2012-06-04 07:59 99384 ----a-w- c:\windows\system32\drivers\ssudbus.sys2012-07-25 08:35 . 2012-06-04 07:59 203320 ----a-w- c:\windows\system32\drivers\ssudmdm.sys2012-07-23 20:51 . 2012-07-23 20:51 -------- d-----w- c:\program files (x86)\Desktop Restore2012-07-20 19:29 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-07-26 03:23 . 2012-04-30 23:52 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe2012-07-26 03:23 . 2012-05-05 07:23 298016 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr2012-07-26 03:23 . 2012-04-30 23:52 298016 ----a-w- c:\windows\SysWow64\PnkBstrB.exe2012-07-26 03:14 . 2012-04-30 23:52 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.ex02012-07-20 19:28 . 2012-01-14 00:40 59701280 ----a-w- c:\windows\system32\MRT.exe2012-07-10 05:44 . 2012-07-10 05:44 31808 ----a-w- c:\windows\system32\drivers\FNETTBOH_305.SYS2012-07-03 18:46 . 2012-01-14 00:26 24904 ----a-w- c:\windows\system32\drivers\mbam.sys2012-07-03 00:50 . 2012-04-04 12:44 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2012-07-03 00:50 . 2012-01-14 00:21 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2012-06-26 07:02 . 2011-09-16 16:54 330240 ----a-w- c:\windows\MASetupCaller.dll2012-06-26 07:02 . 2011-09-16 16:54 45320 ----a-w- c:\windows\SysWow64\MAMACExtract.dll2012-06-02 22:19 . 2012-06-21 21:58 38424 ----a-w- c:\windows\system32\wups.dll2012-06-02 22:19 . 2012-06-21 21:58 2428952 ----a-w- c:\windows\system32\wuaueng.dll2012-06-02 22:19 . 2012-06-21 21:58 44056 ----a-w- c:\windows\system32\wups2.dll2012-06-02 22:19 . 2012-06-21 21:58 57880 ----a-w- c:\windows\system32\wuauclt.exe2012-06-02 22:19 . 2012-06-21 21:58 701976 ----a-w- c:\windows\system32\wuapi.dll2012-06-02 22:15 . 2012-06-21 21:58 2622464 ----a-w- c:\windows\system32\wucltux.dll2012-06-02 22:15 . 2012-06-21 21:58 99840 ----a-w- c:\windows\system32\wudriver.dll2012-06-02 20:19 . 2012-06-21 21:57 186752 ----a-w- c:\windows\system32\wuwebv.dll2012-06-02 20:15 . 2012-06-21 21:57 36864 ----a-w- c:\windows\system32\wuapp.exe2012-05-31 04:04 . 2012-06-27 02:25 9013136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D04860B6-F1C9-498E-8639-C3368DC29CCF}\mpengine.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-13 1353080]"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]"Octoshape Streaming Services"="c:\users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]"F.lux"="c:\users\brennan\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2012-01-13 4942336]"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-07-16 3524536]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-08 421776].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=c:\progra~1\LUCIDL~1\VIRTU\x86\appinit_dll.dll c:\windows\SysWOW64\nvinit.dll.R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-06-04 99384]R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-07-10 31808]R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [2010-11-07 24176]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-06-04 203320]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-13 1255736]R4 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 15368]S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-01-13 15936]S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-22 2656280]S3 ALSysIO;ALSysIO;c:\users\brennan\AppData\Local\Temp\ALSysIO64.sys [x]S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-03-05 126952]S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-03-05 390632]S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344]S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-21 471144]S3 VirtuWDDM;VirtuWDDM;c:\windows\system32\DRIVERS\VirtuWDDM.sys [2011-07-08 66336]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - ALSYSIO..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-09 11860072]"XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-07-04 1441152]"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2011-05-13 26624]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-09-01 167704]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-09-01 392472]"Persistence"="c:\windows\system32\igfxpers.exe" [2011-09-01 416024].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"LoadAppInit_DLLs"=0x1"AppInit_DLLs"=c:\progra~1\LUCIDL~1\VIRTU\appinit_dll.dll c:\windows\System32\nvinitx.dll.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localTCP: DhcpNameServer = 192.168.1.254CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\shell32.dllFF - ProfilePath - c:\users\brennan\AppData\Roaming\Mozilla\Firefox\Profiles\dufcgsb9.default\FF - prefs.js: browser.startup.homepage - www.youtube.comFF - prefs.js: network.proxy.type - 0.- - - - ORPHANS REMOVED - - - -.Wow6432Node-HKCU-Run-ASRockXTU - (no file)Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\windows\SysWOW64\PnkBstrA.exec:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe.**************************************************************************.Completion time: 2012-08-15 16:22:14 - machine was rebootedComboFix-quarantined-files.txt 2012-08-15 21:22.Pre-Run: 360,928,673,792 bytes freePost-Run: 361,089,310,720 bytes free.- - End Of File - - 16C86363F417590A853686782851E187.DDS (Ver_2011-08-26.01) - NTFSAMD64Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1Run by brennan at 16:25:33 on 2012-08-15Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8104.6434 [GMT -5:00].SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\NVIDIA Corporation\Display\nvxdsync.exeC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\ASRock\XFast LAN\spd.exeC:\Windows\SysWOW64\PnkBstrA.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Windows\System32\svchost.exe -k secsvcsC:\Windows\system32\taskhost.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\taskeng.exeC:\Program Files\Core Temp\Core Temp.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Program Files\ASRock\XFast LAN\cfosspeed.exeC:\Windows\System32\rundll32.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Windows\System32\igfxpers.exeC:\Program Files (x86)\Steam\Steam.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exeC:\Users\brennan\Local Settings\Apps\F.lux\flux.exeC:\Program Files (x86)\XFastUsb\XFastUsb.exeC:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exeC:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\iTunes\iTunesHelper.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files\iPod\bin\iPodService.exeC:\Windows\system32\SearchIndexer.exeC:\Windows\System32\svchost.exe -k WerSvcGroupC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files (x86)\Common Files\Steam\SteamService.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exe.============== Pseudo HJT Report ===============.uInternet Settings,ProxyOverride = *.localBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dlluRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silentuRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunuRun: [Octoshape Streaming Services] "C:\Users\brennan\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrunuRun: [F.lux] "C:\Users\brennan\Local Settings\Apps\F.lux\flux.exe" /noshowmRun: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exemRun: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /rmRun: [updReg] C:\Windows\UpdReg.EXEmRun: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exemRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cabTCP: DhcpNameServer = 192.168.1.254TCP: Interfaces\{CCBA1BC7-03D1-4509-8F93-393E8610B531} : DhcpNameServer = 192.168.1.254Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLLAppInit_DLLs: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\appinit_dll.dll C:\Windows\SysWOW64\nvinit.dllBHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dllBHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dllmRun-x64: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exemRun-x64: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /rmRun-x64: [updReg] C:\Windows\UpdReg.EXEmRun-x64: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exemRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"AppInit_DLLs-X64: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\appinit_dll.dll C:\Windows\SysWOW64\nvinit.dll.================= FIREFOX ===================.FF - ProfilePath - C:\Users\brennan\AppData\Roaming\Mozilla\Firefox\Profiles\dufcgsb9.default\FF - prefs.js: browser.startup.homepage - www.youtube.comFF - prefs.js: network.proxy.type - 0FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dllFF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dllFF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dllFF - plugin: C:\ProgramData\id Software\QuakeLive\npquakezero.dllFF - plugin: C:\Users\brennan\AppData\Roaming\Mozilla\plugins\npoctoshape.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dllFF - plugin: C:\Windows\SysWOW64\npDeployJava1.dllFF - plugin: C:\Windows\SysWOW64\npmproxy.dll.============= SERVICES / DRIVERS ===============.R1 AsrAppCharger;AsrAppCharger;C:\Windows\system32\DRIVERS\AsrAppCharger.sys --> C:\Windows\system32\DRIVERS\AsrAppCharger.sys [?]R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\system32\DRIVERS\asmthub3.sys --> C:\Windows\system32\DRIVERS\asmthub3.sys [?]R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\system32\DRIVERS\asmtxhci.sys --> C:\Windows\system32\DRIVERS\asmtxhci.sys [?]R3 MBfilt;MBfilt;C:\Windows\system32\drivers\MBfilt64.sys --> C:\Windows\system32\drivers\MBfilt64.sys [?]R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]R3 VirtuWDDM;VirtuWDDM;C:\Windows\system32\DRIVERS\VirtuWDDM.sys --> C:\Windows\system32\DRIVERS\VirtuWDDM.sys [?]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-1-13 2656280]S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudbus.sys --> C:\Windows\system32\DRIVERS\ssudbus.sys [?]S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-27 113120]S3 pbfilter;pbfilter;C:\Program Files\PeerBlock\pbfilter.sys [2012-1-22 24176]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudmdm.sys --> C:\Windows\system32\DRIVERS\ssudmdm.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]S4 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856].=============== Created Last 30 ================.2012-08-15 21:24:46 -------- d-sh--w- C:\$RECYCLE.BIN2012-08-15 19:52:41 98816 ----a-w- C:\Windows\sed.exe2012-08-15 19:52:41 518144 ----a-w- C:\Windows\SWREG.exe2012-08-15 19:52:41 256000 ----a-w- C:\Windows\PEV.exe2012-08-15 19:52:41 208896 ----a-w- C:\Windows\MBR.exe2012-08-08 05:07:37 -------- d-----w- C:\Program Files\Bonjour2012-08-08 05:07:37 -------- d-----w- C:\Program Files (x86)\Bonjour2012-08-07 23:11:48 -------- d-----w- C:\dvd flick projects2012-08-07 22:55:13 -------- d-----w- C:\Users\brennan\AppData\Roaming\DVD Flick2012-08-07 22:55:02 662288 ----a-w- C:\Windows\SysWow64\mscomct2.ocx2012-08-07 22:55:02 609824 ----a-w- C:\Windows\SysWow64\comctl32.ocx2012-08-07 22:55:02 40960 ----a-w- C:\Windows\SysWow64\ssubtmr6.dll2012-08-07 22:55:02 36864 ----a-w- C:\Windows\SysWow64\trayicon_handler.ocx2012-08-07 22:55:02 28672 ----a-w- C:\Windows\SysWow64\mousewheel.ocx2012-08-07 22:55:02 212240 ----a-w- C:\Windows\SysWow64\richtx32.ocx2012-08-07 22:55:02 164144 ----a-w- C:\Windows\SysWow64\comct232.ocx2012-08-07 22:55:02 1081616 ----a-w- C:\Windows\SysWow64\mscomctl.ocx2012-08-07 22:55:02 -------- d-----w- C:\Program Files (x86)\DVD Flick2012-08-07 00:51:26 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes2012-08-03 04:07:30 250534 ----a-w- C:\Windows\QLPrism Uninstaller.exe2012-08-03 04:07:29 -------- d-----w- C:\QLPrism2012-07-31 04:49:57 -------- d-----w- C:\Music22012-07-27 05:49:05 -------- d-----w- C:\FRST2012-07-27 05:28:34 136672 ----a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll2012-07-26 03:13:46 3130440 ----a-w- C:\Windows\SysWow64\pbsvc_blr.exe2012-07-26 03:13:45 -------- d-----w- C:\Windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP2012-07-25 08:35:14 99384 ----a-w- C:\Windows\System32\drivers\ssudbus.sys2012-07-25 08:35:14 203320 ----a-w- C:\Windows\System32\drivers\ssudmdm.sys2012-07-23 20:51:38 -------- d-----w- C:\Program Files (x86)\Desktop Restore2012-07-20 19:29:59 3148800 ----a-w- C:\Windows\System32\win32k.sys.==================== Find3M ====================.2012-07-26 03:23:56 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe2012-07-26 03:23:48 298016 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr2012-07-26 03:23:48 298016 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe2012-07-26 03:14:10 189248 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex02012-07-10 05:44:17 31808 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS2012-07-03 18:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys2012-07-03 00:50:07 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2012-07-03 00:50:07 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe2012-06-26 07:02:40 330240 ----a-w- C:\Windows\MASetupCaller.dll2012-06-26 07:02:38 45320 ----a-w- C:\Windows\SysWow64\MAMACExtract.dll2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll2012-06-02 20:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll2012-06-02 20:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll.============= FINISH: 16:27:11.93 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted August 18, 2012 Staff ID:587043 Share Posted August 18, 2012 Hi,My apologies for the delay.Please zip up and attach this folder:C:\qoobox\quarantineRun TFC by OldTimer to clear temporary files:Please download TFC from here and save it to your desktop.Close any open programs and Internet browsers.Double click TFC.exe to run it and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.Please be patient as clearing out temp files may take a while.Once it completes you may be prompted to restart your computer, please do so.Once it's finished you may delete TFC.exe from your Desktop or save it for later use for the cleaning of temporary files.Download the file TDSSKiller.zip and extract it into a folder on the infected PC.Execute the file TDSSKiller.exe by double-clicking on it.Wait for the scan and disinfection process to be over.When its work is over, the utility prompts for a reboot to complete the disinfection.By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).The log is like UtilityName.Version_Date_Time_log.txt.for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.Please post that log here.Next, please run a free online scan with the ESET Online ScannerNote: You will need to use Internet Explorer for this scan.Tick the box next to YES, I accept the Terms of Use.Click StartWhen asked, allow the ActiveX control to installClick StartMake sure that the options Remove found threats and the option Scan unwanted applications is checkedClick ScanWait for the scan to finishExport the threats found (if any), and post them here.Next, please download AdwCleaner by Xplode onto your Desktop.Double click on AdwCleaner.exe to run the tool.Click on Search.A logfile will automatically open after the scan has finished.Please post the content of that logfile in your reply.You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.Next, download my Security Check from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.Let me know how things are running now and what issues remain.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted August 30, 2012 Staff ID:591510 Share Posted August 30, 2012 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 9, 2012 ID:595265 Share Posted September 9, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts