Successfully blocked access to malicious website

Narkis · January 18, 2013

I'm constantly getting messages saying "Malwarebytes anti-malware successfully blocked access to a potentially malicious website" for a few different IP addreses, all using port 62789 and process svchost.exe. Full scans with Anti-Malware and Spybot S&D have come up clean, but I'm not so sure.

I'm attaching the logs from DDS, as per the sticky.

dds.txt

attach.txt

CatByte · January 18, 2013

Please run the following:

Please download aswMBR.exe and save it to your desktop.
Double click aswMBR.exe to start the tool.
When asked if you want to download Avast's virus definitions please select Yes.
Click Scan
- Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
- You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

Narkis · January 19, 2013

Alright, here's the log. I'm also attaching the MBR file.

Run date: 2013-01-19 01:15:33

-----------------------------

01:15:33.797 OS Version: Windows x64 6.1.7601 Service Pack 1

01:15:33.797 Number of processors: 4 586 0x1707

01:15:33.798 ComputerName: MENTAT UserName: Chris

01:15:36.565 Initialize success

01:22:06.851 AVAST engine defs: 13011802

01:22:27.188 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005f

01:22:27.190 Disk 0 Vendor: ST350032 SD15 Size: 476940MB BusType: 3

01:22:27.198 Disk 0 MBR read successfully

01:22:27.200 Disk 0 MBR scan

01:22:27.203 Disk 0 Windows 7 default MBR code

01:22:27.215 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

01:22:27.224 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848

01:22:27.240 Disk 0 scanning C:\Windows\system32\drivers

01:22:37.002 Service scanning

01:22:55.301 Modules scanning

01:22:55.307 Disk 0 trace - called modules:

01:22:55.324 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor.sys

01:22:55.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003872060]

01:22:55.661 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> [0xfffffa80024df330]

01:22:55.665 5 ACPI.sys[fffff88000f2c7a1] -> nt!IofCallDriver -> \Device\0000005f[0xfffffa8002ec59c0]

01:22:58.533 AVAST engine scan C:\Windows

01:23:02.241 AVAST engine scan C:\Windows\system32

01:27:31.047 AVAST engine scan C:\Windows\system32\drivers

01:27:54.856 AVAST engine scan C:\Users\Chris

02:18:13.800 AVAST engine scan C:\ProgramData

02:19:17.467 Scan finished successfully

02:23:40.814 Disk 0 MBR has been saved successfully to "C:\Users\Chris\Desktop\MBR.dat"

02:23:40.819 The log file has been saved successfully to "C:\Users\Chris\Desktop\aswMBR.txt"

CatByte · January 19, 2013

Please run the following

Refer to the ComboFix User's Guide

Download ComboFix from the following location:
Link
* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.
---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Narkis · January 19, 2013

I seem to have forgotten to actually attach the file. Apologies for the double post.

MBR.zip

Narkis · January 19, 2013

And here's Combofix' log:

ComboFix 13-01-17.04 - Chris 19/01/2013 2:43.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1253.30.1033.18.3071.785 [GMT 2:00]

Running from: c:\users\Chris\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2012-12-19 to 2013-01-19 )))))))))))))))))))))))))))))))

.

2013-01-19 00:50 . 2013-01-19 00:50 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-01-19 00:50 . 2013-01-19 00:50 -------- d-----w- c:\users\hedev\AppData\Local\temp

2013-01-19 00:50 . 2013-01-19 00:50 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-17 18:36 . 2013-01-12 01:30 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-01-17 09:11 . 2013-01-17 09:11 -------- d-----w- c:\users\Chris\AppData\Local\FalloutNV

2013-01-16 21:07 . 2013-01-16 21:07 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft

2013-01-16 21:07 . 2013-01-16 21:07 -------- d-----w- c:\program files (x86)\DVDVideoSoft

2013-01-16 04:26 . 2013-01-16 04:26 -------- d-----w- c:\program files\Recuva

2013-01-13 04:30 . 2013-01-14 19:14 -------- d-----w- c:\users\Chris\AppData\Roaming\KeePass

2013-01-13 04:02 . 2013-01-13 04:02 -------- d-----w- c:\program files (x86)\KeePass Password Safe 2

2013-01-12 21:32 . 2013-01-12 21:32 -------- d-----w- c:\users\Chris\AppData\Roaming\Wargaming.net

2013-01-12 17:24 . 2013-01-12 17:24 -------- d-----w- c:\users\Chris\AppData\Roaming\Unity

2013-01-11 05:00 . 2013-01-12 17:24 -------- d-----w- c:\users\Chris\AppData\Local\Ubisoft

2013-01-11 05:00 . 2013-01-17 04:32 -------- d-sh--w- c:\users\Chris\wc

2013-01-11 05:00 . 2013-01-11 05:00 -------- d-sh--w- c:\users\Chris\AppData\Roaming\wyUpdate AU

2013-01-11 04:55 . 2013-01-11 04:55 -------- d-----w- c:\users\Chris\AppData\Roaming\Ubisoft

2013-01-10 16:12 . 2013-01-10 16:12 -------- d-----w- c:\users\Alloi

2013-01-10 16:10 . 2013-01-10 16:11 -------- d-----w- c:\users\Stela

2013-01-07 21:51 . 2013-01-08 16:31 -------- d-----w- C:\New folder

2013-01-07 21:00 . 2013-01-07 21:00 -------- d-----w- c:\program files (x86)\AGEIA Technologies

2013-01-07 21:00 . 2013-01-07 21:00 -------- d-----w- c:\windows\2FDD750F49B740C19D5ED2955BC0E2D8.TMP

2012-12-29 00:54 . 2012-12-29 00:54 550328 ----a-w- c:\windows\SysWow64\nvStreaming.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-12 15:07 . 2012-10-17 23:20 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-01-12 15:07 . 2012-10-17 23:20 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-29 10:34 . 2012-10-11 04:44 2504248 ----a-w- c:\windows\SysWow64\nvapi.dll

2012-12-29 10:34 . 2012-10-11 04:44 1813432 ----a-w- c:\windows\system32\nvdispco64.dll

2012-12-29 10:34 . 2012-10-11 04:44 15052368 ----a-w- c:\windows\system32\nvwgf2umx.dll

2012-12-29 10:34 . 2012-10-11 04:44 12641120 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

2012-12-29 10:34 . 2012-10-11 04:44 1107592 ----a-w- c:\windows\system32\nvumdshimx.dll

2012-12-29 10:34 . 2012-10-11 04:44 1504696 ----a-w- c:\windows\system32\nvdispgenco64.dll

2012-12-29 10:34 . 2012-10-11 04:44 15129064 ----a-w- c:\windows\SysWow64\nvd3dum.dll

2012-12-29 10:34 . 2012-10-11 04:44 2824656 ----a-w- c:\windows\system32\nvapi64.dll

2012-12-29 08:40 . 2012-10-11 04:45 6382008 ----a-w- c:\windows\system32\nvcpl.dll

2012-12-29 08:40 . 2012-10-11 04:45 3455416 ----a-w- c:\windows\system32\nvsvc64.dll

2012-12-29 08:40 . 2012-10-11 04:45 2923201 ----a-w- c:\windows\system32\nvcoproc.bin

2012-12-29 08:40 . 2012-10-11 04:45 884152 ----a-w- c:\windows\system32\nvvsvc.exe

2012-12-29 08:40 . 2012-10-11 04:45 63928 ----a-w- c:\windows\system32\nvshext.dll

2012-12-29 08:40 . 2012-10-11 04:45 118712 ----a-w- c:\windows\system32\nvmctray.dll

2012-12-14 14:49 . 2012-10-11 02:16 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-12 23:41 . 2012-10-11 05:51 67413224 ----a-w- c:\windows\system32\MRT.exe

2012-12-06 00:19 . 2012-10-21 01:52 43520 ----a-w- c:\windows\SysWow64\CmdLineExt03.dll

2012-11-22 03:26 . 2012-12-12 23:37 3149824 ----a-w- c:\windows\system32\win32k.sys

2012-11-21 21:35 . 2012-11-21 21:35 0 ----a-w- c:\program files (x86)\FallenEnchantress.exe

2012-11-15 21:33 . 2012-11-15 21:33 111968 ----a-w- c:\windows\system32\drivers\avgmfx64.sys

2012-11-14 07:06 . 2012-12-12 23:39 17811968 ----a-w- c:\windows\system32\mshtml.dll

2012-11-14 06:32 . 2012-12-12 23:39 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-11-14 06:11 . 2012-12-12 23:39 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-11-14 06:04 . 2012-12-12 23:39 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-11-14 06:04 . 2012-12-12 23:39 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-11-14 06:02 . 2012-12-12 23:39 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-11-14 06:02 . 2012-12-12 23:39 237056 ----a-w- c:\windows\system32\url.dll

2012-11-14 05:59 . 2012-12-12 23:39 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-11-14 05:58 . 2012-12-12 23:39 816640 ----a-w- c:\windows\system32\jscript.dll

2012-11-14 05:57 . 2012-12-12 23:39 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-11-14 05:57 . 2012-12-12 23:39 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-11-14 05:55 . 2012-12-12 23:39 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-11-14 05:55 . 2012-12-12 23:39 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-11-14 05:53 . 2012-12-12 23:39 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-11-14 05:52 . 2012-12-12 23:39 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-11-14 05:46 . 2012-12-12 23:39 248320 ----a-w- c:\windows\system32\ieui.dll

2012-11-14 02:09 . 2012-12-12 23:39 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-11-14 01:58 . 2012-12-12 23:39 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-11-14 01:57 . 2012-12-12 23:39 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-11-14 01:49 . 2012-12-12 23:39 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-11-14 01:48 . 2012-12-12 23:39 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-11-14 01:44 . 2012-12-12 23:39 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-11-11 02:07 . 2012-10-13 02:13 419840 ----a-w- c:\windows\system32\systemcpl.dll

2012-11-11 02:07 . 2012-10-13 02:13 14848 ----a-w- c:\windows\system32\slwga.dll

2012-11-11 02:07 . 2012-10-13 02:13 13824 ----a-w- c:\windows\SysWow64\slwga.dll

2012-11-11 02:07 . 2012-10-13 02:14 1008640 ----a-w- c:\windows\system32\user32.dll

2012-11-11 02:07 . 2012-10-13 02:13 833024 ----a-w- c:\windows\SysWow64\user32.dll

2012-11-09 05:45 . 2012-12-12 23:37 2048 ----a-w- c:\windows\system32\tzres.dll

2012-11-09 04:42 . 2012-12-12 23:37 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-11-05 21:35 . 2012-12-12 23:37 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-11-05 20:41 . 2012-12-12 23:37 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-11-05 20:32 . 2012-12-12 23:37 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-11-05 20:32 . 2012-12-12 23:37 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-11-02 05:59 . 2012-12-12 23:37 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-11-02 05:11 . 2012-12-12 23:37 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

2012-10-22 11:02 . 2012-10-22 11:02 154464 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2010-11-20 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[7] 2009-07-14 . 72D7B3EA16946E8F0CF7458150031CC6 . 1008640 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll

[-] 2012-11-11 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll

.

[-] 2012-11-11 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll

[7] 2010-11-20 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[7] 2009-07-14 . E8B0FFC209E504CB7E79FC24E6C085F0 . 833024 . . [6.1.7600.16385] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-08-28 3671904]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-05 1310720]

"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2012-10-04 1912832]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-11 1255736]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-12 283200]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-12-29 383416]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-10-23 2848168]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2012-10-12 50856]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - ASWMBR

*Deregistered* - aswMBR

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-01-10 22:16 1606760 ----a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.52\Installer\setup.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-11 11:34]

.

2013-01-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-11 11:34]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-10-12 1464984]

"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-10-12 2075288]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.gr/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\3wn9l8d3.default\

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-01-19 02:53:15

ComboFix-quarantined-files.txt 2013-01-19 00:53

.

Pre-Run: 70.222.864.384 bytes free

Post-Run: 69.886.271.488 bytes free

.

- - End Of File - - 1987FAD384D03FAD1C951E0209D12EEE

CatByte · January 19, 2013

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:

Press the WinKey + R to open a run box, type Notepad > click OK.

This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')


FCopy::
c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll | c:\windows\system32\user32.dll
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll | c:\windows\SysWOW64\user32.dll

DDS::
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix may request an update; please allow it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right-mouse click JRT.exe and select Run as administrator
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message

NEXT

Download AdwCleaner from here and save it to your desktop.

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <-- very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

Narkis · January 19, 2013

All done. The results:

Combofix

ComboFix 13-01-17.04 - Chris 19/01/2013 3:34.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1253.30.1033.18.3071.1823 [GMT 2:00]

Running from: c:\users\Chris\Desktop\ComboFix.exe

Command switches used :: c:\users\Chris\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

--------------- FCopy ---------------

.

c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll --> c:\windows\system32\user32.dll

c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll --> c:\windows\SysWOW64\user32.dll

.

((((((((((((((((((((((((( Files Created from 2012-12-19 to 2013-01-19 )))))))))))))))))))))))))))))))

.

2013-01-19 01:43 . 2013-01-19 01:43 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-01-19 01:43 . 2013-01-19 01:43 -------- d-----w- c:\users\hedev\AppData\Local\temp

2013-01-19 01:43 . 2013-01-19 01:43 -------- d-----w- c:\users\Default\AppData\Local\temp