remove a Babylon infection

terra24 · November 30, 2012

Hello

I need to remove a Babylon infection, pretty sure I got it from a Cnet installer and I exited as soon as I saw the word toolbar, I definately didn't authorize anything to install.

I can keep it at bay in browser search and homepage but its still there when I use the actual address bar.

Its driving me mad, and I want to add this PC to my network but I am woried it might transfer to the other computers. (this computer has never been on the network before).

I ran malwarebytes full scan and it came out with no threats found.

I was also running MS security essentials when it got in, I since changed that to Norton internet security.

Can anyone help please.

Cheers

Keith

CatByte · November 30, 2012

Please do the following:

Please download DDS from either of these links

LINK 1

LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

Attach.txt.

NEXT

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
When asked if you want to download Avast's virus definitions please select Yes.
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well

terra24 · December 1, 2012

Hi CatByte

Thanks for the quick reply.

Logs are attached.

CatByte · December 1, 2012

Please run the following:

Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right-mouse click JRT.exe and select Run as administrator
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message

NEXT

Download AdwCleaner from here and save it to your desktop.

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

Refer to the ComboFix User's Guide

Download ComboFix from the following location:
Link
* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.
---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

terra24 · December 1, 2012

Hi CatByte

Ok ran those three tools

Logs attached

ComboFix.txt

AdwCleanerS1.txt

JRT.txt

CatByte · December 1, 2012

Please do the following:

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <-- very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

terra24 · December 1, 2012

Hi CatByte

I ran malware bytes no threats found, so I couldn't select and click remove selected. log pasted below:

Malwarebytes Anti-Malware (Trial) 1.65.1.1000

www.malwarebytes.org

Database version: v2012.12.01.03

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Terra-x :: ASUS-LAPTOP [administrator]

Protection: Enabled

1/12/2012 2:24:42 PM

mbam-log-2012-12-01 (14-24-42).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 234295

Time elapsed: 1 minute(s), 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

And Eset scan attached.

ESETSCAN.txt

CatByte · December 1, 2012

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:

Press the WinKey + R to open a run box, type Notepad > click OK.

This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')


File::
D:\From Old Laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip	
D:\From Old Laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip	
D:\From Old Laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip	
D:\From Old Laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip	
D:\From Old Laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip	
D:\From USB stick\FLEX SQUEEZE\flexsqueeze140.zip	

Folder::
C:\ProgramData\Browser Manager
C:\Users\All Users\Browser Manager

ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix may request an update; please allow it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please advise how the computer is running now and if there are any outstanding issues

terra24 · December 1, 2012

Hi CatByte

I ran the combofix as described the log is below.

The Babylon appears to be fixed in firefox and chrome but is still present in the address bar of IE 9.

ComboFix 12-12-01.02 - Terra-x 02/12/2012 8:06.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.8169.5443 [GMT 11:00]

Running from: c:\users\Terra-x\Desktop\ComboFix.exe

Command switches used :: c:\users\Terra-x\Desktop\CFScript.txt

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip"

"d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip"

"d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip"

"d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip"

"d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip"

"d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\CLONE\blog_backup.zip

d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Muscle Gain\blog_backup.zip

d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Real Reviews\blog_backup.zip

d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\BLOG BACKUPS\Vitmineral\blog_backup.zip

d:\from old laptop hd\INTERNET MARKETING ALL\INT MARKETING 2 July 11\FLEX SQUEEZE\flexsqueeze140.zip

d:\from usb stick\FLEX SQUEEZE\flexsqueeze140.zip

.

((((((((((((((((((((((((( Files Created from 2012-11-01 to 2012-12-01 )))))))))))))))))))))))))))))))

.

2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Jeremy\AppData\Local\temp

2012-12-01 21:11 . 2012-12-01 21:11 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-01 06:25 . 2012-12-01 06:25 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-12-01 03:34 . 2012-12-01 03:34 -------- d-----w- c:\program files (x86)\ESET

2012-12-01 02:50 . 2012-12-01 02:50 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\offreg.dll

2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- c:\windows\ERUNT

2012-12-01 01:18 . 2012-12-01 01:18 -------- d-----w- C:\JRT

2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----r- c:\program files (x86)\Skype

2012-11-30 20:42 . 2012-11-30 20:42 -------- d-----w- c:\program files (x86)\Common Files\Skype

2012-11-30 20:42 . 2012-11-30 20:43 -------- d-----w- c:\programdata\Skype

2012-11-30 20:41 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D5C5C9E-8C1B-4731-9516-098C382AE0B6}\mpengine.dll

2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\programdata\Malwarebytes

2012-11-25 00:39 . 2012-11-25 00:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-11-25 00:39 . 2012-09-29 08:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-24 06:10 . 2012-11-24 06:10 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2012-11-24 06:05 . 2012-11-24 06:05 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Symantec

2012-11-24 06:05 . 2012-11-24 06:05 -------- d-----w- c:\program files\Common Files\Symantec Shared

2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\windows\system32\drivers\NISx64

2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\program files (x86)\Norton Internet Security

2012-11-24 06:04 . 2012-11-24 06:04 -------- d-----w- c:\programdata\Norton

2012-11-24 06:03 . 2012-11-24 06:03 -------- d-----w- c:\program files (x86)\NortonInstaller

2012-11-24 04:26 . 2012-11-24 04:26 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2012-11-23 23:30 . 2012-11-23 23:30 -------- d-----w- c:\programdata\Browser Manager

2012-11-23 23:02 . 2012-11-23 23:01 1174993 ----a-w- c:\windows\unins001.exe

2012-11-23 23:02 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\WIMBLEMS.sys

2012-11-23 22:57 . 2012-11-23 23:02 -------- d-----w- c:\program files (x86)\Corsair

2012-11-23 22:57 . 2012-11-23 22:56 1174993 ----a-w- c:\windows\unins000.exe

2012-11-23 22:57 . 2012-03-26 23:58 25600 ----a-w- c:\windows\system32\drivers\CORSGKB.sys

2012-11-23 22:33 . 2006-08-20 19:06 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\SSGR1pc.dll

2012-11-23 22:33 . 2006-11-21 00:40 89600 ----a-w- c:\windows\system32\SSGR1ci.dll

2012-11-23 22:33 . 2006-11-19 21:22 151552 ----a-w- c:\windows\system32\SSGR1ci.exe

2012-11-23 22:33 . 2009-03-02 03:12 11576 ------w- c:\windows\system32\drivers\SSPORT.SYS

2012-11-23 22:33 . 2009-03-02 03:12 53816 ------w- c:\windows\system32\drivers\DGIVECP.SYS

2012-11-23 22:33 . 2012-11-23 22:33 -------- d-----w- c:\program files (x86)\SAMSUNG

2012-11-20 11:48 . 2012-11-20 11:49 -------- d-----w- c:\users\Terra-x

2012-11-20 11:32 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll

2012-11-20 11:32 . 2012-08-23 13:20 54272 ----a-w- c:\windows\system32\MsRdpWebAccess.dll

2012-11-20 11:32 . 2012-08-23 11:20 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe

2012-11-20 11:32 . 2012-08-23 11:14 384000 ----a-w- c:\windows\system32\wksprt.exe

2012-11-20 11:32 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll

2012-11-20 11:32 . 2012-08-23 10:39 1048064 ----a-w- c:\windows\SysWow64\mstsc.exe

2012-11-20 11:32 . 2012-08-23 10:22 1123840 ----a-w- c:\windows\system32\mstsc.exe

2012-11-20 11:32 . 2012-08-23 09:51 3174912 ----a-w- c:\windows\system32\rdpcorets.dll

2012-11-20 11:32 . 2012-08-23 08:19 4916224 ----a-w- c:\windows\SysWow64\mstscax.dll

2012-11-20 11:32 . 2012-08-23 08:13 5773824 ----a-w- c:\windows\system32\mstscax.dll

2012-11-20 11:24 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys

2012-11-20 11:24 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll

2012-11-20 11:24 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

2012-11-20 11:24 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2012-11-20 11:24 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll

2012-11-20 11:24 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll

2012-11-20 11:24 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2012-11-20 11:24 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2012-11-20 11:24 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2012-11-20 11:24 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll

2012-11-20 11:24 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2012-11-19 19:03 . 2012-11-19 19:03 -------- d-----w- c:\users\Jeremy\AppData\Local\Macromedia

2012-11-19 11:34 . 2012-11-19 11:35 -------- d-----w- c:\users\Jeremy\AppData\Roaming\FileZilla

2012-11-19 07:56 . 2012-11-19 07:56 -------- d-----w- c:\program files (x86)\FileZilla FTP Client

2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files\Microsoft Silverlight

2012-11-19 07:32 . 2012-11-19 07:32 -------- d-----w- c:\program files (x86)\Microsoft Silverlight

2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-11-19 07:15 . 2012-11-19 07:15 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-11-19 07:15 . 2012-11-19 07:15 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-11-19 07:15 . 2012-11-19 07:15 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-11-19 07:15 . 2012-11-19 07:15 -------- d-----w- c:\program files (x86)\Java

2012-11-19 06:46 . 2012-08-21 02:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-11-19 06:45 . 2012-11-19 06:45 -------- d-----w- c:\program files\iPod

2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files\iTunes

2012-11-19 06:45 . 2012-11-19 06:46 -------- d-----w- c:\program files (x86)\iTunes

2012-11-18 12:21 . 2012-10-09 18:17 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

2012-11-18 12:21 . 2012-10-09 17:40 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

2012-11-18 12:21 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

2012-11-18 12:21 . 2012-10-09 17:40 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

2012-11-18 11:33 . 2012-11-20 01:18 -------- d-----w- c:\program files (x86)\Microsoft Works

2012-11-18 11:32 . 2012-11-18 11:32 -------- d-----w- c:\windows\PCHEALTH

2012-11-18 11:26 . 2012-11-18 11:26 -------- d-----w- c:\program files\Microsoft Office

2012-11-18 11:24 . 2012-11-18 11:24 -------- d-----r- C:\MSOCache

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll

2012-11-18 11:08 . 2012-11-18 11:08 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

2012-11-18 11:08 . 2012-11-18 11:08 -------- d-----w- c:\program files (x86)\QuickTime

2012-11-18 10:04 . 2012-11-18 10:04 -------- d-----w- c:\users\Jeremy\AppData\Local\Mozilla

2012-11-18 09:04 . 2012-11-18 09:04 -------- d-----w- c:\windows\system32\SPReview

2012-11-18 09:02 . 2012-11-18 09:02 -------- d-----w- c:\windows\system32\EventProviders

2012-11-18 09:00 . 2012-10-29 10:04 66395536 ----a-w- c:\windows\system32\MRT.exe

2012-11-18 08:57 . 2012-11-18 09:47 -------- d-----w- c:\program files\CPUID

2012-11-18 08:46 . 2012-11-18 08:46 -------- d--h--w- c:\programdata\.syncID

2012-11-18 08:45 . 2012-11-29 11:09 -------- d--h--w- c:\programdata\.Syncables

2012-11-18 08:16 . 2012-05-31 01:25 279656 ------w- c:\windows\system32\MpSigStub.exe

2012-11-18 07:41 . 2012-11-18 07:41 -------- d-----w- C:\WINSSLog

2012-11-17 23:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-17 23:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-17 23:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

2012-11-17 23:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-17 23:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-17 23:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-11-17 23:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-17 23:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-17 23:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-17 23:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-17 23:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-17 04:56 . 2012-10-18 18:25 3149824 ----a-w- c:\windows\system32\win32k.sys

2012-11-17 04:55 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll

2012-11-17 04:55 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-01 01:43 . 2012-04-18 13:15 45056 ----a-w- c:\windows\system32\acovcnt.exe

2012-11-19 07:22 . 2012-09-07 02:28 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-19 07:22 . 2012-09-07 02:28 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-18 09:17 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll

2012-11-18 09:17 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll

2012-10-24 16:12 . 2012-10-24 16:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

2012-10-24 16:12 . 2012-10-24 16:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

2012-10-16 08:38 . 2012-11-28 02:53 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-28 02:53 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-28 02:53 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-09-14 19:19 . 2012-10-09 06:12 2048 ----a-w- c:\windows\system32\tzres.dll

2012-09-14 18:28 . 2012-10-09 06:12 2048 ----a-w- c:\windows\SysWow64\tzres.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-06 222496]

"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]

"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]

"Syncables"="c:\program files (x86)\syncables\syncables desktop\Syncables.exe" [2010-07-19 370480]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-11-09 17877168]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"FLxHCIm"="c:\program files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [2011-01-21 40448]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]

"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2012-04-18 3058304]

"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-01-28 907776]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"CPMonitor"="c:\program files (x86)\Roxio\CinePlayer\5.0\CPMonitor.exe" [2010-10-15 84464]

"VAWinAgent"="c:\expressgateutil\VAWinAgent.exe" [2010-08-13 21504]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-24 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-02 252848]

"Corsair laver"="c:\program files (x86)\Corsair\K90 Keyboard\K90Hid.exe" [2012-05-21 1780736]

"Corsair M60 Mouse"="c:\program files (x86)\Corsair\M60 Mouse\M60Hid.exe" [2012-05-21 1766400]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-2-4 548528]

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-3-12 1083680]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-11-21 3290304]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

R2 VideAceWindowsService;VideAceWindowsService;c:\expressgateutil\VAWinService.exe [2010-08-21 77312]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-04-18 79360]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-04-18 79360]

R3 DIRECTIO;DIRECTIO;E:\DirectIo.sys [x]

R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-08-03 290920]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-17 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1300000.080\SYMDS64.SYS [2011-05-16 451192]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1300000.080\SYMEFA64.SYS [2011-05-16 1083512]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-07-26 17024]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20121106.001\BHDrvx64.sys [2012-11-06 1384608]

S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1300000.080\ccSetx64.sys [2011-05-23 165512]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20121130.001\IDSvia64.sys [2012-11-23 513184]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1300000.080\Ironx64.SYS [2011-05-16 189560]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1300000.080\SYMNETS.SYS [2011-05-09 396408]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe [2011-05-24 138760]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-03-02 11576]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-28 378984]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-04-16 13832]

S2 TurboBoost;Intel® Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-04-16 134928]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-12-14 53800]

S3 CORSGKB;Corsair Gaming Keyboard;c:\windows\system32\drivers\CORSGKB.sys [2012-03-26 25600]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-11-25 138912]

S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2011-01-21 161280]

S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2011-01-21 50176]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]

S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]

S3 WIMBLEMS;Corsair M60 Gaming Mouse;c:\windows\system32\drivers\WIMBLEMS.sys [2012-03-26 25600]

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-07 07:22]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15]

.

2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-23 11:15]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-22 11075176]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"SynAsusAcpi"="c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe" [bU]

"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920]

"Setwallpaper"="c:\programdata\SetWallpaper.cmd" [bU]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com.au/

mStart Page = hxxp://asus.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 10.0.0.138

FF - ProfilePath - c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/

FF - ExtSQL: 2012-11-24 17:05; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn

FF - ExtSQL: 2012-11-27 21:11; support@lastpass.com; c:\users\Terra-x\AppData\Roaming\Mozilla\Firefox\Profiles\itzt61yr.default\extensions\support@lastpass.com

FF - ExtSQL: 2012-12-01 07:43; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

FF - ExtSQL: 2012-12-01 11:53; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.0.0.128\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-12-02 08:15:44

ComboFix-quarantined-files.txt 2012-12-01 21:15

ComboFix2.txt 2012-12-01 02:59

.

Pre-Run: 209,456,168,960 bytes free

Post-Run: 207,496,204,288 bytes free

.

- - End Of File - - F820C63A7DC3F7DCC4E562234C308671

CatByte · December 1, 2012

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
services.exe
/md5stop
%systemroot%\*. /rp /s
%systemdrive%\$Recycle.Bin|@;true;true;true /fp
DRIVES
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Post both logs

terra24 · December 1, 2012

Hi CatByte

OTL logs attached

Extras.Txt

OTL.Txt

CatByte · December 1, 2012

Please run the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKU\S-1-5-21-3393893806-3609269745-4236858211-1004\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3393893806-3609269745-4236858211-1004\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3393893806-3609269745-4236858211-1004\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=115308&tt=4712_6&babsrc=SP_ss&mntrId=8cdc21510000000000006a5d60c14dbc
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O20 - AppInit_DLLs: (c:\PROGRA~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll) - c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll ()
[2012/11/24 10:30:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager

:Files
ipconfig /flushdns /c

:Commands
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Please advise if there are any outstanding issues

terra24 · December 2, 2012

Hi CatByte

I ran the OTL as described, log is below.

All browsers now seem free of Babylon search. (thankyou)

All processes killed

========== OTL ==========

HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_USERS\S-1-5-21-3393893806-3609269745-4236858211-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\PROGRA~3\BROWSE~1\25911~1.18\{C16C1~1\mngr.dll deleted successfully.

File move failed. c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager\2.5.911.18 scheduled to be moved on reboot.

Folder move failed. C:\ProgramData\Browser Manager scheduled to be moved on reboot.

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Terra-x\Desktop\cmd.bat deleted successfully.

C:\Users\Terra-x\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Jeremy

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 314162258 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 85022900 bytes

->Google Chrome cache emptied: 432230100 bytes

->Flash cache emptied: 5881 bytes

User: Public

->Temp folder emptied: 0 bytes

User: Terra-x

->Temp folder emptied: 67545 bytes

->Temporary Internet Files folder emptied: 21287849 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 9949860 bytes

->Google Chrome cache emptied: 7690576 bytes

->Flash cache emptied: 2675 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36074817 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 865.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12022012_104948

Files\Folders moved on Reboot...

c:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings folder moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content folder moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components folder moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension folder moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} folder moved successfully.

C:\ProgramData\Browser Manager\2.5.911.18 folder moved successfully.

C:\ProgramData\Browser Manager folder moved successfully.

C:\Users\Terra-x\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

CatByte · December 2, 2012

how is your computer running now

are there any outstanding issues

terra24 · December 2, 2012

Hi CatByte

I tried all browsers , all seem to be babylon free. I changed everything back to the settings where it would show up ie home page set to a page rather than a bookmark etc thats where the new page would be hijacked and all is working properly. I have opened and closed the browsers a few times and tested again. No problems found.

I would say that the problem has been fixed.

Thank you. I will be making a donation.

Do I need to uninstall the tools etc.. any special removal instructions.

CatByte · December 2, 2012

We just have some housekeeping to do now,

Please do the following:

You can delete the DDS, JRT and aswMBR logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Press the WinKey +R to open a run box
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

NEXT

Double click on adwcleaner.exe to run the tool.
Click on Uninstall.
Confirm with yes.

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
[*]Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
[*]WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
[*]Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
[*]ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
[*]In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
PC Safety and Security--What Do I Need?.
[*]Simple and easy ways to keep your computer safe and secure on the Internet

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

terra24 · December 2, 2012

Hi CatByte

All tools deleted, everything working fine now.

I think the help you offer on this forum is fantastic and I am very grateful for your help.

Thank You

CatByte · December 2, 2012

you are welcome

stay safe

~CB

LDTate · December 7, 2012

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

remove a Babylon infection

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information