Jump to content

I am Infected with malware and need help


Recommended Posts

Re-starting a new thread. here are the scan results.

#JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.6.5 (02.18.2013:1)

OS: Microsoft Windows XP x86

Ran by Mr. Bojangles on Sun 02/24/2013 at 22:14:19.36

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\urlsearchhooks\\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_users\S-1-5-21-2838019926-1718427338-2428480347-1008\software\microsoft\internet explorer\searchscopes\\DefaultScope

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_current_user\software\1clickdownload

Successfully deleted: [Registry Key] hkey_local_machine\software\conduit

Successfully deleted: [Registry Key] hkey_local_machine\software\iminent

Successfully deleted: [Registry Key] hkey_current_user\software\pricegong

Successfully deleted: [Registry Key] hkey_current_user\software\softonic

Successfully deleted: [Registry Key] hkey_current_user\software\sweetim

Successfully deleted: [Registry Key] hkey_local_machine\software\sweetim

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\conduit.engine

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT1060933

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT2548838

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT2704262

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3c471948-f874-49f5-b338-4f214a2ee0b1}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}

Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}

~~~ Files

Successfully deleted: [File] "C:\WINDOWS\system32\conduitengine.tmp"

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Application Data\adawaretb"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Application Data\pricegong"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\adawarebp"

Successfully deleted: [Folder] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\conduit"

Successfully deleted: [Folder] "C:\Program Files\adawaretb"

Successfully deleted: [Folder] "C:\Program Files\conduit"

Successfully deleted: [Folder] "C:\Program Files\free youtube downloader"

Successfully deleted: [Folder] "C:\WINDOWS\freecorder"

Successfully deleted: [Folder] "C:\WINDOWS\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}"

~~~ FireFox

Successfully deleted: [File] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\user.js

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\conduitcommon

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}

Successfully deleted the following from C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\prefs.js

user_pref("CT1060933..clientLogIsEnabled", false);

user_pref("CT1060933..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

user_pref("CT1060933..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

user_pref("CT1060933.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

user_pref("CT1060933.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

user_pref("CT1060933.BrowserCompStateIsOpen_129681785283868963", true);

user_pref("CT1060933.BrowserCompStateIsOpen_129686665230467549", true);

user_pref("CT1060933.BrowserCompStateIsOpen_130040833450137909", true);

user_pref("CT1060933.CTID", "CT1060933");

user_pref("CT1060933.CurrentServerDate", "24-2-2013");

user_pref("CT1060933.DSInstall", false);

user_pref("CT1060933.DialogsAlignMode", "LTR");

user_pref("CT1060933.DialogsGetterLastCheckTime", "Sun Feb 24 2013 06:57:59 GMT+1000");

user_pref("CT1060933.DownloadReferralCookieData", "");

user_pref("CT1060933.FirstServerDate", "16-2-2012");

user_pref("CT1060933.FirstTime", true);

user_pref("CT1060933.FirstTimeFF3", true);

user_pref("CT1060933.FixPageNotFoundErrors", true);

user_pref("CT1060933.GroupingServerCheckInterval", 1440);

user_pref("CT1060933.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

user_pref("CT1060933.HPInstall", false);

user_pref("CT1060933.HasUserGlobalKeys", true);

user_pref("CT1060933.Initialize", true);

user_pref("CT1060933.InitializeCommonPrefs", true);

user_pref("CT1060933.InstallationAndCookieDataSentCount", 3);

user_pref("CT1060933.InstallationId", "ConduitNSISIntegration");

user_pref("CT1060933.InstallationType", "ConduitXPEIntegration");

user_pref("CT1060933.InstalledDate", "Thu Feb 16 2012 15:31:54 GMT+1000");

user_pref("CT1060933.InvalidateCache", false);

user_pref("CT1060933.IsGrouping", false);

user_pref("CT1060933.IsInitSetupIni", true);

user_pref("CT1060933.IsMulticommunity", false);

user_pref("CT1060933.IsOpenThankYouPage", false);

user_pref("CT1060933.IsOpenUninstallPage", true);

user_pref("CT1060933.LanguagePackLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.LanguagePackReloadIntervalMM", 1440);

user_pref("CT1060933.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

user_pref("CT1060933.LastLogin_3.10.0.1", "Thu Feb 16 2012 15:31:56 GMT+1000");

user_pref("CT1060933.LastLogin_3.12.2.3", "Mon May 28 2012 08:37:18 GMT+1000");

user_pref("CT1060933.LastLogin_3.13.0.6", "Mon Jul 16 2012 02:25:24 GMT+1000");

user_pref("CT1060933.LastLogin_3.14.1.0", "Tue Aug 21 2012 22:42:45 GMT+1000");

user_pref("CT1060933.LastLogin_3.15.1.0", "Wed Nov 07 2012 10:33:29 GMT+1000");

user_pref("CT1060933.LastLogin_3.16.0.100", "Wed Feb 13 2013 06:17:51 GMT+1000");

user_pref("CT1060933.LastLogin_3.16.0.3", "Sat Jan 05 2013 04:34:35 GMT+1000");

user_pref("CT1060933.LastLogin_3.18.0.7", "Sun Feb 24 2013 18:38:12 GMT+1000");

user_pref("CT1060933.LatestVersion", "3.18.0.7");

user_pref("CT1060933.Locale", "en-us");

user_pref("CT1060933.MCDetectTooltipHeight", "83");

user_pref("CT1060933.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

user_pref("CT1060933.MCDetectTooltipWidth", "295");

user_pref("CT1060933.MyStuffEnabledAtInstallation", true);

user_pref("CT1060933.OriginalFirstVersion", "3.10.0.1");

user_pref("CT1060933.RadioIsPodcast", false);

user_pref("CT1060933.RadioLastCheckTime", "Thu Feb 16 2012 15:31:57 GMT+1000");

user_pref("CT1060933.RadioLastUpdateIPServer", "0");

user_pref("CT1060933.RadioLastUpdateServer", "129326918102570000");

user_pref("CT1060933.RadioMediaID", "21504191");

user_pref("CT1060933.RadioMediaType", "Media Player");

user_pref("CT1060933.RadioMenuSelectedID", "EBRadioMenu_CT106093321504191");

user_pref("CT1060933.RadioShrinkedFromSetup", false);

user_pref("CT1060933.RadioStationName", "KFOG");

user_pref("CT1060933.RadioStationURL", "hxxp://live.cumulusstreaming.com/KFOG-FM");

user_pref("CT1060933.SearchCaption", "Freecorder Customized Web Search");

user_pref("CT1060933.SearchFromAddressBarIsInit", true);

user_pref("CT1060933.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=2&q=");

user_pref("CT1060933.SearchInNewTabEnabled", true);

user_pref("CT1060933.SearchInNewTabIntervalMM", 1440);

user_pref("CT1060933.SearchInNewTabLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID&UM=UM_ID");

user_pref("CT1060933.SearchInNewTabUserEnabled", false);

user_pref("CT1060933.SendProtectorDataViaLogin", true);

user_pref("CT1060933.ServiceMapLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.SettingsLastCheckTime", "Sun Feb 24 2013 21:38:31 GMT+1000");

user_pref("CT1060933.SettingsLastUpdate", "1361679090");

user_pref("CT1060933.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT1060933&SearchSource=13");

user_pref("CT1060933.ThirdPartyComponentsInterval", 504);

user_pref("CT1060933.ThirdPartyComponentsLastCheck", "Thu Feb 16 2012 15:31:53 GMT+1000");

user_pref("CT1060933.ThirdPartyComponentsLastUpdate", "1312887586");

user_pref("CT1060933.ToolbarShrinkedFromSetup", false);

user_pref("CT1060933.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1060933");

user_pref("CT1060933.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com

user_pref("CT1060933.UserID", "UN14161264893491318");

user_pref("CT1060933.ValidationData_Toolbar", 1);

user_pref("CT1060933.alertChannelId", "15651");

user_pref("CT1060933.autoDisableScopes", -1);

user_pref("CT1060933.backendstorage.autocompletepro_enable", "31");

user_pref("CT1060933.backendstorage.autocompletepro_enable_auto", "31");

user_pref("CT1060933.backendstorage.cbfirsttime", "5468752046656220313620323031322031353A33343A303820474D542B31303030");

user_pref("CT1060933.backendstorage.shoppingapp.gk.exipres", "5475652046656220323120323031322031353A33343A303720474D542B31303030");

user_pref("CT1060933.backendstorage.shoppingapp.gk.geolocation", "6175737472616C6961");

user_pref("CT1060933.components.129032145384800518", false);

user_pref("CT1060933.components.129272674122038321", false);

user_pref("CT1060933.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlP

user_pref("CT1060933.globalFirstTimeInfoLastCheckTime", "Thu Feb 16 2012 15:31:55 GMT+1000");

user_pref("CT1060933.homepageProtectorEnableByLogin", true);

user_pref("CT1060933.initDone", true);

user_pref("CT1060933.isAppTrackingManagerOn", true);

user_pref("CT1060933.isFirstRadioInstallation", false);

user_pref("CT1060933.myStuffEnabled", true);

user_pref("CT1060933.myStuffPublihserMinWidth", 400);

user_pref("CT1060933.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

user_pref("CT1060933.myStuffServiceIntervalMM", 1440);

user_pref("CT1060933.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

user_pref("CT1060933.navigateToUrlOnSearch", false);

user_pref("CT1060933.revertSettingsEnabled", true);

user_pref("CT1060933.searchProtectorDialogDelayInSec", 10);

user_pref("CT1060933.searchProtectorEnableByLogin", true);

user_pref("CT1060933.testingCtid", "");

user_pref("CT1060933.toolbarAppMetaDataLastCheckTime", "Sun Feb 24 2013 10:37:57 GMT+1000");

user_pref("CT1060933.toolbarContextMenuLastCheckTime", "Thu Feb 16 2012 15:31:56 GMT+1000");

user_pref("CT1060933.usagesFlag", 2);

user_pref("CT2704262..clientLogIsEnabled", false);

user_pref("CT2704262..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");

user_pref("CT2704262..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");

user_pref("CT2704262.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

user_pref("CT2704262.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

user_pref("CT2704262.BrowserCompStateIsOpen_129674822392465408", true);

user_pref("CT2704262.BrowserCompStateIsOpen_129738587603157113", true);

user_pref("CT2704262.BrowserCompStateIsOpen_129738587703159675", true);

user_pref("CT2704262.CTID", "CT2704262");

user_pref("CT2704262.CurrentServerDate", "18-6-2012");

user_pref("CT2704262.DSInstall", false);

user_pref("CT2704262.DialogsAlignMode", "LTR");

user_pref("CT2704262.DialogsGetterLastCheckTime", "Tue Jun 19 2012 16:14:25 GMT+1000");

user_pref("CT2704262.DownloadReferralCookieData", "");

user_pref("CT2704262.FeedLastCount129531287796537552", 295);

user_pref("CT2704262.FeedPollDate129531287797162554", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162555", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162556", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162557", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162558", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162559", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162560", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedPollDate129531287797162561", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.FeedTTL129531287797162554", 40);

user_pref("CT2704262.FeedTTL129531287797162555", 40);

user_pref("CT2704262.FeedTTL129531287797162556", 40);

user_pref("CT2704262.FeedTTL129531287797162557", 40);

user_pref("CT2704262.FeedTTL129531287797162558", 40);

user_pref("CT2704262.FeedTTL129531287797162559", 40);

user_pref("CT2704262.FeedTTL129531287797162560", 40);

user_pref("CT2704262.FeedTTL129531287797162561", 40);

user_pref("CT2704262.FirstServerDate", "10-4-2012");

user_pref("CT2704262.FirstTime", true);

user_pref("CT2704262.FirstTimeFF3", true);

user_pref("CT2704262.FixPageNotFoundErrors", true);

user_pref("CT2704262.GroupingServerCheckInterval", 1440);

user_pref("CT2704262.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

user_pref("CT2704262.HPInstall", false);

user_pref("CT2704262.HasUserGlobalKeys", true);

user_pref("CT2704262.HomePageProtectorEnabled", false);

user_pref("CT2704262.HomepageBeforeUnload", "www.google.com");

user_pref("CT2704262.Initialize", true);

user_pref("CT2704262.InitializeCommonPrefs", true);

user_pref("CT2704262.InstallationAndCookieDataSentCount", 3);

user_pref("CT2704262.InstallationId", "ConduitNSISIntegration");

user_pref("CT2704262.InstallationType", "ConduitXPEIntegration");

user_pref("CT2704262.InstalledDate", "Tue Apr 10 2012 22:51:15 GMT+1000");

user_pref("CT2704262.InvalidateCache", false);

user_pref("CT2704262.IsAlertDBUpdated", true);

user_pref("CT2704262.IsGrouping", false);

user_pref("CT2704262.IsInitSetupIni", true);

user_pref("CT2704262.IsMulticommunity", false);

user_pref("CT2704262.IsOpenThankYouPage", false);

user_pref("CT2704262.IsOpenUninstallPage", true);

user_pref("CT2704262.LanguagePackLastCheckTime", "Tue Jun 19 2012 16:14:31 GMT+1000");

user_pref("CT2704262.LanguagePackReloadIntervalMM", 1440);

user_pref("CT2704262.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");

user_pref("CT2704262.LastLogin_3.10.0.455", "Wed Apr 11 2012 06:58:54 GMT+1000");

user_pref("CT2704262.LastLogin_3.13.0.6", "Tue Jun 19 2012 21:14:50 GMT+1000");

user_pref("CT2704262.LatestVersion", "3.13.0.6");

user_pref("CT2704262.Locale", "en");

user_pref("CT2704262.MCDetectTooltipHeight", "83");

user_pref("CT2704262.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

user_pref("CT2704262.MCDetectTooltipWidth", "295");

user_pref("CT2704262.MyStuffEnabledAtInstallation", true);

user_pref("CT2704262.OriginalFirstVersion", "3.10.0.455");

user_pref("CT2704262.RadioIsPodcast", false);

user_pref("CT2704262.RadioLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CT2704262.RadioLastUpdateIPServer", "3");

user_pref("CT2704262.RadioLastUpdateServer", "129242955136270000");

user_pref("CT2704262.RadioMediaID", "21037024");

user_pref("CT2704262.RadioMediaType", "Media Player");

user_pref("CT2704262.RadioMenuSelectedID", "EBRadioMenu_CT270426221037024");

user_pref("CT2704262.RadioShrinkedFromSetup", false);

user_pref("CT2704262.RadioStationName", "California%20Rock");

user_pref("CT2704262.RadioStationURL", "hxxp://feedlive.net/california.asx");

user_pref("CT2704262.SearchCaption", "FreeSoundRecorder Customized Web Search");

user_pref("CT2704262.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");

user_pref("CT2704262.SearchFromAddressBarIsInit", true);

user_pref("CT2704262.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2704262&SearchSource=2&q=");

user_pref("CT2704262.SearchInNewTabEnabled", true);

user_pref("CT2704262.SearchInNewTabIntervalMM", 1440);

user_pref("CT2704262.SearchInNewTabLastCheckTime", "Tue Jun 19 2012 16:14:23 GMT+1000");

user_pref("CT2704262.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");

user_pref("CT2704262.SearchProtectorEnabled", false);

user_pref("CT2704262.SearchProtectorToolbarDisabled", false);

user_pref("CT2704262.SendProtectorDataViaLogin", true);

user_pref("CT2704262.ServiceMapLastCheckTime", "Tue Jun 19 2012 16:14:26 GMT+1000");

user_pref("CT2704262.SettingsLastCheckTime", "Mon Jun 18 2012 20:00:12 GMT+1000");

user_pref("CT2704262.SettingsLastUpdate", "1339926569");

user_pref("CT2704262.TBHomePageUrl", "hxxp://search.conduit.com/?SSPV=FFOB6&ctid=CT2704262&SearchSource=13");

user_pref("CT2704262.ThirdPartyComponentsInterval", 504);

user_pref("CT2704262.ThirdPartyComponentsLastCheck", "Tue Apr 10 2012 22:51:13 GMT+1000");

user_pref("CT2704262.ThirdPartyComponentsLastUpdate", "1312887586");

user_pref("CT2704262.ToolbarShrinkedFromSetup", false);

user_pref("CT2704262.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2704262");

user_pref("CT2704262.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com

user_pref("CT2704262.UserID", "UN00167515888583602");

user_pref("CT2704262.ValidationData_Toolbar", 2);

user_pref("CT2704262.alertChannelId", "1096603");

user_pref("CT2704262.autoDisableScopes", -1);

user_pref("CT2704262.backendstorage.2704262a129531303481232105000000paramsgk0", "7B2275706461746552657154696D65223A313333343039313533343937362C227570646174655265737054696D6522

user_pref("CT2704262.backendstorage.autocompletepro_enable", "31");

user_pref("CT2704262.backendstorage.autocompletepro_enable_auto", "31");

user_pref("CT2704262.backendstorage.cbcountry_000", "4155");

user_pref("CT2704262.backendstorage.cbfirsttime", "5475652041707220313020323031322032323A35323A303220474D542B31303030");

user_pref("CT2704262.backendstorage.rss_pub_config", "7B2273657474696E6773223A7B2269636F6E223A22687474703A2F2F73746F726167652E636F6E647569742E636F6D2F36322F3237302F43543237303

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat0", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat1", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat2", "2535422537422532327479706525323225334125323272737325323225324325323276657273696F6E25323225334

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat3", "2535426E756C6C2532432537422532327479706525323225334125323272737325323225324325323276657273696

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000embeddedversion", "322E352E30");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000feedsobj", "2537422532326368616E6E656C7325323225334125374225323269642532322533412532326368616E6E656C7

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000lastreporttime", "3133333430393135363530313520");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000newfeeds", "6E65774665656473");

user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000readitemsarr", "253742253232687474702533412532462532467468656361756375732E626C6F67732E6E7974696D65732

user_pref("CT2704262.backendstorage.shoppingapp.gk.exipres", "53756E2041707220313520323031322032323A35313A353220474D542B31303030");

user_pref("CT2704262.backendstorage.shoppingapp.gk.geolocation", "6175737472616C6961");

user_pref("CT2704262.backendstorage.url_history0001", "68747470733A2F2F7777772E66616365626F6F6B2E636F6D2F426F74746C6F2E62696C6C233A3A3A636C69636B68616E646C65723A3A3A3133333430

user_pref("CT2704262.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlP

user_pref("CT2704262.globalFirstTimeInfoLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CT2704262.homepageProtectorEnableByLogin", true);

user_pref("CT2704262.initDone", true);

user_pref("CT2704262.isAppTrackingManagerOn", true);

user_pref("CT2704262.isFirstRadioInstallation", false);

user_pref("CT2704262.myStuffEnabled", true);

user_pref("CT2704262.myStuffPublihserMinWidth", 400);

user_pref("CT2704262.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");

user_pref("CT2704262.myStuffServiceIntervalMM", 1440);

user_pref("CT2704262.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");

user_pref("CT2704262.navigateToUrlOnSearch", false);

user_pref("CT2704262.revertSettingsEnabled", true);

user_pref("CT2704262.searchProtectorDialogDelayInSec", 10);

user_pref("CT2704262.searchProtectorEnableByLogin", true);

user_pref("CT2704262.testingCtid", "");

user_pref("CT2704262.toolbarAppMetaDataLastCheckTime", "Tue Jun 19 2012 16:14:24 GMT+1000");

user_pref("CT2704262.toolbarContextMenuLastCheckTime", "Tue Apr 10 2012 22:51:28 GMT+1000");

user_pref("CT2704262.usagesFlag", 2);

user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1060933/CT1060933", "\"2f7efd0688764704a81c286a7b29c59a3\"");

user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2704262/CT2704262", "\"1dfbd99afb69e73cd3b40315b7aa37411\"");

user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1096603/1092307/AU", "\"0\"");

user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/15651/15317/AU", "\"0\"");

user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1060933", "\"1359609745\"");

user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2704262", "\"1329385171\"");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "m4Df43NZ+9lr21ZNdyYrjA==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-us", "wVmmvqqOMqrv5xct1cJIHg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "V3ke+ogt4ejn0sB1xPR3nw==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-us", "0uSPYx+Kl2jpu8sJZMeHjw==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "ktZKgREPsk5m13TY9rsX+A==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-us", "Dclc8oo4TTv7+mAkSlUSWg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "9zRvKErdMb8hJOq85ft5Vg==");

user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-us", "K4Vqu91uAzWURlxJRdXJOg==");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"80133a6b165cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.1", "\"801a319dd78ccc1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10.0.455", "\"4ead38b3e6bcd1:1308\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12.2.3", "\"4ead38b3e6bcd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13.0.6", "\"0d648794549cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14.1.0", "\"0e0a4327275cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15.1.0", "\"0343677cfb1cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16.0.100", "\"0343677cfb1cd1:0\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16.0.3", "\"0343677cfb1cd1:15a7\"");

user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.18.0.7", "\"0343677cfb1cd1:160f\"");

user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1060933", "\"ccd90dbc0806c30e56e17c4594b38942\"");

user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2704262", "\"d76323372b05c3748a3d6b1c93a98292\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equalizer_dead.gif", "\"0678fe477ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimize.gif", "\"046c7ab477ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gif", "\"0484de117c4c91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gif", "\"0e7a152347ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif", "\"087c778347ac91:0\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE", "\"4c814df8d80717195db596ee4f301597\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"21ba1682b5b6825cbfd420592a540476\"");

user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"2236cdfe2705dc5895ad2e365bf489a6\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/1344951.xml", "\"06340703cadb8c5f19897c486ec4a84c\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/14293310.xml", "\"49d913f02077d057531654787492c8e5\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/16887175.xml", "\"efed6cdc2ab07bcc980eab4744f3a941\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/17151925.xml", "\"7ee4299f7f60fc9b1c62d6ea04af8ebe\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/20536157.xml", "\"de5f4a5df80a59e331fbb031b7c301c7\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/30261067.xml", "\"1c9e81987908fe10595529d5b338f62b\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/428333.xml", "\"4690df8f5613ad9f6cfc1561f1d12d4b\"");

user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/816653.xml", "\"3ffd558e3194a7faa249c6316a858bad\"");

user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Mr. Bojangles\\Application Data\\Mozilla\\Firefox\\Profiles\\64w0fp13.default\\conduitCommon\

user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.455");

user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&psa=&ind=2010040916&p

user_pref("CommunityToolbar.ToolbarsList", "CT1060933,CT2704262");

user_pref("CommunityToolbar.ToolbarsList2", "CT1060933,CT2704262");

user_pref("CommunityToolbar.ToolbarsList4", "CT1060933,CT2704262");

user_pref("CommunityToolbar.globalUserId", "caad3710-a6c3-4e74-8a2c-c3b9647f7a8e");

user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2704262");

user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Apr 10 2012 22:51:16 GMT+1000");

user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);

user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Tue Apr 10 2012 23:51:39 GMT+1000");

user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");

user_pref("CommunityToolbar.notifications.locale", "en");

user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Tue Apr 10 2012 22:51:14 GMT+1000");

user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");

user_pref("CommunityToolbar.notifications.showTrayIcon", false);

user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

user_pref("CommunityToolbar.notifications.userId", "defff216-ca26-4934-af37-01bd17c5df8f");

user_pref("CommunityToolbar.originalHomepage", "www.google.com");

user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties");

user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_14293310.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Wed Apr 11 2012 06:58:56 GMT+1000");

user_pref("extensions.enabledItems", "jqs@sun.com:1.0,toolbar@ask.com:3.5.2.106,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17");

user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensearch.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&ind=2010040916&osp=mws&ptn

user_pref("extensions.mywebsearch.prevKwdEnabled", true);

user_pref("extensions.mywebsearch.prevKwdURL", "chrome://browser-region/locale/region.properties");

user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZUfox000&ptb=AL3MCd9NKxyFF0mu4ItXjw&psa=&ind=2010040916&ptnrS=ZUfox000&si=&st=kwd&n=77ceca5

Emptied folder: C:\Documents and Settings\Mr. Bojangles\Application Data\mozilla\firefox\profiles\64w0fp13.default\minidumps [4 files]

~~~ Chrome

Successfully deleted: [Folder] C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pmlghpafmmnmmkjdhacccolfgnkiboco

Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\pmlghpafmmnmmkjdhacccolfgnkiboco

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 02/24/2013 at 22:25:50.91

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#MBAM

Malwarebytes' Anti-Malware 1.41

Database version: 2866

Windows 5.1.2600 Service Pack 3

9/28/2009 6:02:51 PM

mbam-log-2009-09-28 (18-02-51).txt

Scan type: Full Scan (C:\|)

Objects scanned: 67967

Time elapsed: 21 minute(s), 35 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

#DDS

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 7.0.6000.16762

Run by Mr. Bojangles at 15:45:19 on 2013-02-25

.

============== Running Processes ================

.

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\IPSSVC.EXE

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\D-Link\DWA-525 revA\ANIWConnService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\netdde.exe

C:\Program Files\Google\Update\1.3.21.135\GoogleCrashHandler.exe

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

c:\Program Files\Zune\WMZuneComm.exe

c:\Program Files\Zune\ZuneBusEnum.exe

C:\Program Files\Common Files\Lenovo\Logger\logmon.exe

c:\Program Files\Zune\ZuneNss.exe

c:\Program Files\Zune\ZuneWlanCfgSvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe

C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\Program Files\D-Link\DWA-525 revA\AirNCFG.exe

C:\Program Files\D-Link\DWA-525 revA\WZCSLDR2.exe

C:\WINDOWS\system32\M-AudioTaskBarIcon.exe

C:\WINDOWS\system32\ICO.EXE

C:\WINDOWS\system32\FSRremoS.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\Pelmiced.exe

C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\WINDOWS\system32\taskkill.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uURLSearchHooks: TVersitybar Toolbar: {66bd2442-241b-44cd-8c7a-b51037053cdb} -

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

BHO: DriveLetterAccess: {5CA3D70E-1895-11CF-8E15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: CPwmIEBrowserHelper Object: {F040E541-A427-4CF7-85D8-75E3E0F476C5} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Facebook Update] "c:\documents and settings\mr. bojangles\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [TVT Scheduler Proxy] c:\program files\common files\lenovo\scheduler\scheduler_proxy.exe

mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"

mRun: [D-Link D-Link DWA-525] c:\program files\d-link\dwa-525 reva\AirNCFG.exe

mRun: [WZCSLDR2] c:\program files\d-link\dwa-525 reva\WZCSLDR2.exe

mRun: [M-Audio Taskbar Icon] c:\windows\system32\M-AudioTaskBarIcon.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Mouse Suite 98 Daemon] ICO.EXE

mRun: [Ad-Aware Browsing Protection] "c:\documents and settings\all users\application data\ad-aware browsing protection\adawarebp.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRunOnce: [myfavoritegadgets] <no file>

StartupFolder: c:\docume~1\mr6e0d~1.boj\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\mr. bojangles\application data\dropbox\bin\Dropbox.exe

StartupFolder: c:\documents and settings\mr. bojangles\start menu\programs\startup\startup concealer outlook.vbs

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Set As Messenger Live Display Picture - c:\program files\msnshell\bin\SetMSNDP.htm

IE: {0045D4BC-5189-4b67-969C-83BB1906C421} - {0FE81B52-73FA-425F-8F06-3F32451AC73F} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll

IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DA320635-F48C-4613-8325-D75A933C549E} - c:\program files\lenovo\system update\sulauncher.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{1C678FE9-385F-4BBE-849C-DA5C69BC931D} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: AwayNotify - c:\program files\lenovo\awaytask\AwayNotify.dll

Notify: igfxcui - igfxdev.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\25.0.1364.97\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

.

=============== Created Last 30 ================

.

2013-02-24 12:43:51 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-02-24 12:14:12 -------- d-----w- c:\windows\ERUNT

2013-02-24 12:13:57 -------- d-----w- C:\JRT

2013-02-08 07:10:46 16365936 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2013-01-29 12:04:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

==================== Find3M ====================

.

2013-02-24 12:21:09 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-02-24 12:21:09 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-23 14:00:03 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2012-12-14 06:49:28 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

.

============= FINISH: 15:51:19.08 ===============

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!


  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

    [*]Please do not attach logs or use code boxes, just copy and paste the text.

    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.

    [*]Please read every post completely before doing anything.

    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

    [*]Please provide feedback about your experience as we go.

    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

  • Download Security Check by screen317 from
here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

  • Please download
AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

  • Download & SAVE to your Desktop RogueKiller or from here
    • Quit all programs that you may have started.
    • Please disconnect any USB or external drives from the computer before you run this scan!
    • For Vista or Windows 7, right-click and select "Run as Administrator to start"
    • For Windows XP, double-click to start.
    • Wait until Prescan has finished ...
    • Then Click on "Scan" button
    • Wait until the Status box shows "Scan Finished"
    • click on "delete"
    • Wait until the Status box shows "Deleting Finished"
    • Click on "Report" and copy/paste the content of the Notepad into your next reply.
    • The log should be found in RKreport[1].txt on your Desktop
    • Exit/Close RogueKiller+

Gringo

Link to post
Share on other sites

Here are the results from the scans

Results of screen317's Security Check version 0.99.60

Windows XP Service Pack 3 x86

Internet Explorer 7 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Please wait while WMIC is being installed.

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Ad-Aware

MVPS Hosts File

Spybot - Search & Destroy

Malwarebytes Anti-Malware version 1.70.0.1100

Java 6 Update 11

Java 6 Update 6

Java version out of Date!

Adobe Flash Player 11.6.602.171

Adobe Reader 10.1.6 Adobe Reader out of Date!

Mozilla Firefox (19.0.2)

Google Chrome 25.0.1364.152

Google Chrome 25.0.1364.97

````````Process Check: objlist.exe by Laurent````````

Ad-Aware AAWService.exe is disabled!

Ad-Aware AAWTray.exe is disabled!

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 18% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

RogueKiller V8.5.2 [Feb 23 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Mr. Bojangles [Admin rights]

Mode : Scan -- Date : 03/09/2013 02:39:19

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[31] : NtConnectPort @ 0x805A45B4 -> HOOKED (Unknown @ 0x8A445E28)

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

127.0.0.1 www.0scan.com

127.0.0.1 0scan.com

127.0.0.1 1000gratisproben.com

127.0.0.1 www.1000gratisproben.com

127.0.0.1 1001namen.com

127.0.0.1 www.1001namen.com

127.0.0.1 100888290cs.com

127.0.0.1 www.100888290cs.com

127.0.0.1 www.100sexlinks.com

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] 5e6f13bc4d3da5934cfc9f3304d98a65

[bSP] e5b474159f46c3737748d986e9839ab8 : MBR Code unknown

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 146334 Mo

1 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 299692575 | Size: 6291 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_03092013_02d0239.txt >>

RKreport[1]_S_03092013_02d0239.txt

# AdwCleaner v2.114 - Logfile created 03/09/2013 at 02:28:39

# Updated 05/03/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Mr. Bojangles - MRBOJANGLES

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Mr. Bojangles\My Documents\Downloads\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar

Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\Freecorder

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\adawaretb

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\jetpack

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\APN

Folder Deleted : C:\Documents and Settings\Mr. Bojangles\Start Menu\Programs\Freecorder

Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\Freecorder

Folder Deleted : C:\Documents and Settings\NetworkService\Local Settings\Application Data\TVersitybar

Folder Deleted : C:\Program Files\1ClickDownload

***** [Registry] *****

Key Deleted : HKCU\Software\Ask&Record

Key Deleted : HKCU\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\Freecorder

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1392B8D2-5C05-419F-A8F6-B9F15A596612}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{66BD2442-241B-44CD-8C7A-B51037053CDB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9E92257F-3F0A-451D-B231-6E2DB60CDC71}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\TVersitybar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66BD2442-241B-44CD-8C7A-B51037053CDB}

Key Deleted : HKLM\Software\Freecorder

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{156267B6-9225-4A9D-9473-2C89D1AE31B9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C07E1777-905F-4B13-82E4-2B689C3A641F}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7E903FB-D2FD-4042-85E5-EFFC4F056FEA}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CBE965BB-07A3-4927-A0D8-9C32BC3EB4B9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\TVersitybar Toolbar

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TVersitybar Toolbar

Key Deleted : HKLM\Software\TVersitybar

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{66BD2442-241B-44CD-8C7A-B51037053CDB}]

***** [internet Browsers] *****

-\\ Internet Explorer v7.0.6000.16762

[OK] Registry is clean.

-\\ Mozilla Firefox v19.0.2 (en-US)

File : C:\Documents and Settings\Mr. Bojangles\Application Data\Mozilla\Firefox\Profiles\64w0fp13.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v25.0.1364.152

File : C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [4475 octets] - [09/03/2013 02:28:39]

########## EOF - C:\AdwCleaner[s1].txt - [4535 octets] ##########

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

Link to post
Share on other sites

Thanks Gringo,

I had no problems executing your instructions. combofix ran without a hitch :) here is the log file:

ComboFix 13-03-07.03 - Mr. Bojangles 03/09/2013 3:39.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1411 [GMT 10:00]

Running from: c:\documents and settings\Mr. Bojangles\My Documents\Downloads\ComboFix.exe

* Created a new restore point

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\windows\system32\SET20.tmp

c:\windows\system32\SET6F.tmp

c:\windows\system32\SET74.tmp

c:\windows\system32\SET7B.tmp

c:\windows\system32\SETBF.tmp

c:\windows\system32\SETC2.tmp

c:\windows\system32\SETCB.tmp

c:\windows\system32\SETCF.tmp

c:\windows\system32\SETD0.tmp

c:\windows\system32\SETD1.tmp

c:\windows\system32\SETD4.tmp

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\fusion.dll

c:\windows\system32\URTTemp\mscoree.dll

c:\windows\system32\URTTemp\mscoree.dll.local

c:\windows\system32\URTTemp\mscorsn.dll

c:\windows\system32\URTTemp\mscorwks.dll

c:\windows\system32\URTTemp\msvcr71.dll

c:\windows\system32\URTTemp\regtlib.exe

.

.

((((((((((((((((((((((((( Files Created from 2013-02-08 to 2013-03-08 )))))))))))))))))))))))))))))))

.

.

2013-02-25 13:58 . 2013-02-25 14:06 -------- d-----w- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\adawarebp

2013-02-24 12:14 . 2013-02-24 12:14 -------- d-----w- c:\windows\ERUNT

2013-02-24 12:13 . 2013-02-24 12:13 -------- d-----w- C:\JRT

2013-02-15 22:31 . 2013-02-15 22:31 186432 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-02 14:00 . 2009-01-08 04:47 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2013-02-27 12:13 . 2012-04-22 06:25 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-27 12:13 . 2011-05-29 09:02 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-14 06:49 . 2009-09-23 08:38 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-25 16:41 . 2013-03-08 05:46 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-09-25 16:41 . 2013-03-08 05:46 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2013-03-08 05:46 . 2013-03-08 05:46 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2010-05-04 . F247F7AC6713066D4C71721BDC73FC2E . 3600384 . . [7.00.6000.17063] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\mshtml.dll

[-] 2010-05-04 . C466BDCDFAE6F6EFD618F34BA90B1923 . 3603456 . . [7.00.6000.21264] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\mshtml.dll

[-] 2010-03-11 . 94359CD5BB6AC1CC08088F4A4091FF1E . 3599872 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\mshtml.dll

[-] 2010-03-11 . 9289EBB759293A1381AB0C326A115AEC . 3602944 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\mshtml.dll

[7] 2010-01-05 . 1673677DBD70142DB1294F1B6FC3323E . 3602944 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\mshtml.dll

[7] 2009-07-19 . F25D866DD486AD30E05E5596CB363C3E . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\mshtml.dll

[7] 2009-04-29 . 2B4315EC9E3124408A2A5074C4B97700 . 3596288 . . [7.00.6000.16850] . . c:\windows\ie8\mshtml.dll

[7] 2009-04-29 . C6FD770D518FB024245A0EE217D72BC1 . 3598336 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll

[7] 2009-03-07 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\mshtml.dll

[7] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll

[7] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie7updates\KB969897-IE7\mshtml.dll

[7] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll

[7] 2009-01-16 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB978207-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\dllcache\mshtml.dll

[7] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll

[7] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll

[7] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\mshtml.dll

[7] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll

[-] 2006-02-01 . 51C91AC189321A320FC4BC90B56255A3 . 3073024 . . [6.00.2900.2838] . . c:\windows\ie7\mshtml.dll

.

[-] 2010-05-04 . 83306356DE710DA87ED91A6AF6233214 . 832512 . . [7.00.6000.17055] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\wininet.dll

[-] 2010-05-04 . 506B3DCB9C26070072E3047C6910F844 . 841216 . . [7.00.6000.21256] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\wininet.dll

[-] 2010-03-11 . B6AB2EB1DA4BB29079B84AC842520670 . 832512 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\wininet.dll

[-] 2010-03-11 . 7F6A9D2F3CAA7780AAFD478BF3411462 . 841216 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\wininet.dll

[7] 2010-01-05 . E7B99465DE2EDCF29784B7600BF6FAE8 . 841216 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\wininet.dll

[7] 2009-07-03 . 38114DAB42FB2EB84D1726C42B8D80C5 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\wininet.dll

[7] 2009-04-29 . 8E2D471157B0DF329D8D0EA5D83B0DDB . 827392 . . [7.00.6000.16850] . . c:\windows\ie8\wininet.dll

[7] 2009-04-29 . 62CCA075F44015147B8971DAFFBCFF76 . 828928 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll

[7] 2009-03-07 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll

[7] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\wininet.dll

[7] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll

[7] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll

[7] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB978207-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ServicePackFiles\i386\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\dllcache\wininet.dll

[7] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll

[7] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\wininet.dll

[7] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll

[-] 2006-01-09 . DDE9597A3311748C1519444E2BC147BD . 662016 . . [6.00.2900.2823] . . c:\windows\ie7\wininet.dll

[-] 2005-10-21 . E7B27B6B6E06CE34EA019FD8B858C613 . 658432 . . [6.00.2900.2781] . . c:\windows\$NtUninstallKB905915$\wininet.dll

[-] 2005-10-21 . AF785C4947676A7FC1673FDC5C8D0B5B . 661504 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

.

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2qfe\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2gdr\explorer.exe

[-] 2004-08-04 . A5C1F2CF7C31874E66478910B43D6513 . 974336 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

.

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\regedit.exe

[-] 2004-08-04 . 61F45E8000C6C5913D3D1DA451337364 . 224256 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-08-21 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-15 503808]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-11-11 159472]

"D-Link D-Link DWA-525"="c:\program files\D-Link\DWA-525 revA\AirNCFG.exe" [2010-04-22 1015808]

"WZCSLDR2"="c:\program files\D-Link\DWA-525 revA\WZCSLDR2.exe" [2010-04-22 122880]

"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 644104]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]

"Ad-Aware Browsing Protection"="c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe" [2012-05-09 201112]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]

.

c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\

Dropbox.lnk - c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe [2013-1-21 28539272]

startup concealer outlook.vbs [2011-12-12 209]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-6 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]

2006-06-18 17:06 49152 ------w- c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Calendar Sync.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk

backup=c:\windows\pss\Google Calendar Sync.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^Mr. Bojangles^Start Menu^Programs^Startup^Y'z Shadow.lnk]

path=c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\Y'z Shadow.lnk

backup=c:\windows\pss\Y'z Shadow.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2011-03-15 07:42 499608 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]

2005-11-14 06:23 487424 -c----w- c:\program files\ThinkVantage\AMSG\Amsg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-08-27 11:32 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AwaySch]

2006-06-18 17:06 69632 -c----w- c:\program files\Lenovo\AwayTask\AwaySch.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

2005-06-02 17:21 48752 -c----w- c:\program files\Common Files\Symantec Shared\ccApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]

2006-07-15 02:13 2341632 ------w- c:\program files\Lenovo\Client Security Solution\cssauth.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

2006-05-19 00:24 196696 ------w- c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2006-02-02 13:20 122940 -c----w- c:\windows\system32\DLA\DLACTRLW.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]

2005-01-08 01:07 61952 -c----w- c:\windows\system32\HdAShCut.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2007-01-13 01:47 163840 -c----w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-28 00:50 221184 -c----w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-07-28 00:50 81920 -c----w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-09-09 13:30 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]

2006-07-04 16:11 110592 -c----w- c:\progra~1\THINKV~1\PrdCtr\LPMGR.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]

2010-12-07 09:39 644104 ----a-w- c:\windows\system32\M-AudioTaskBarIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]

2005-04-13 22:34 49152 -c----w- c:\windows\system32\ico.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2010-04-16 12:12 3872080 -c--a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDService.exe]

2006-03-14 00:38 41472 -c----r- c:\program files\Lenovo\SafeGuard PrivateDisk\pdservice.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2007-01-13 01:46 135168 -c----w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-05 08:36 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2008-03-25 12:28 144784 -c----w- c:\program files\Java\jre1.6.0_06\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]

2005-08-19 01:22 85696 -c----w- c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2011-12-09 17:22 74752 ----a-w- c:\program files\Winamp\winampa.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"D_Link_DWA-525"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\MSNShell\\Bin\\engie.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/6/2010 9:26 PM 64288]

R2 ANPD;ANPD Service;c:\windows\system32\ANPD.SYS [12/29/2011 6:38 PM 29411]

R2 D_Link_DWA-525_WPS;D_Link_DWA-525_WPS Service;c:\program files\D-Link\DWA-525 revA\ANIWConnService.exe [12/29/2011 6:37 PM 40960]

R2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4/8/2011 1:33 AM 3857408]

R2 PrivateDisk;PrivateDisk;c:\program files\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [3/14/2006 10:05 AM 58368]

R2 smi2;smi2;c:\program files\SMI2\smi2.sys [7/15/2006 9:55 AM 3968]

R3 MAUSBFASTTRACKPRO;Service for M-Audio FastTrack Pro;c:\windows\system32\drivers\MAudioFastTrackPro.sys [12/7/2010 3:39 PM 158600]

S3 D_Link_DWA-525;D_Link_DWA-525 Service;c:\program files\D-Link\DWA-525 revA\ANIWZCSdS.exe [12/29/2011 6:37 PM 126976]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/22/2010 3:44 AM 1737728]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [2/6/2013 1:48 AM 235216]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [12/10/2011 4:55 AM 18432]

S3 RT80x86;D-Link 802.11n Wireless Driver;c:\windows\system32\drivers\Drt2860.sys [12/29/2011 6:35 PM 1329632]

S3 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [8/19/2005 11:22 AM 124608]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - TRUESIGHT

*Deregistered* - TrueSight

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-05 13:04 1630672 ----a-w- c:\program files\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-06-21 07:40]

.

2013-03-08 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 12:13]

.

2013-03-08 c:\windows\Tasks\AdobeAAMUpdater-1.0-MRBOJANGLES-Mr. Bojangles.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-02-12 07:42]

.

2013-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]

.

2013-03-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008Core.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008UA.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2009-01-08 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2009-01-08 01:32]

.

2013-03-08 c:\windows\Tasks\User_Feed_Synchronization-{B0CC9A6F-834D-47FF-9C2A-B9379DCECD3B}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 19:58]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Set As Messenger Live Display Picture - c:\program files\MSNShell\Bin\SetMSNDP.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe

MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe

MSConfigStartUp-{36766253-3625-2B37-8020-3C1C75B36046} - c:\documents and settings\Mr. Bojangles\Application Data\Gouww\iwzi.exe

AddRemove-Ad-Aware - c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe

AddRemove-adawaretb - c:\program files\adawaretb\uninstall.exe

AddRemove-CodeMallet - c:\program files\CodeMallet\uninstall.exe

AddRemove-eSupport UndeletePlus_is1 - e:\esupport undeleteplus\unins000.exe

AddRemove-Native Instruments Controller Editor - c:\documents and settings\All Users\Application Data\{DCC412E7-393B-4016-91FB-9307F059AFB6}\Controller Editor Setup PC.exe

AddRemove-Native Instruments Guitar Rig 4 - c:\documents and settings\All Users\Application Data\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe

AddRemove-Native Instruments Guitar Rig 5 - c:\documents and settings\All Users\Application Data\{9327ACE9-CC82-4A33-9B33-291ACA1E267B}\Guitar Rig 5 Setup PC.exe

AddRemove-Native Instruments GuitarRig Mobile IO Driver - c:\documents and settings\All Users\Application Data\{4F32CAF7-963B-404D-BF13-C48BA3F5F6A7}\GuitarRig Mobile IO Driver Setup.exe

AddRemove-Native Instruments Rig Kontrol 3 Driver - c:\documents and settings\All Users\Application Data\{EC98E512-708C-4C3B-9F07-B58768C1DD8A}\Rig Kontrol 3 Driver Setup.exe

AddRemove-Native Instruments Service Center - c:\documents and settings\All Users\Application Data\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe

AddRemove-Native Instruments Session IO Driver - c:\documents and settings\All Users\Application Data\{AC46DC4F-66BD-4733-A8B4-0B69418C12D0}\Session IO Driver Setup.exe

AddRemove-Spark - c:\program files\Spark\uninstall.exe

AddRemove-Steam App 240 - c:\program files\Steam\steam.exe

AddRemove-TeamViewer 6 - c:\program files\TeamViewer\Version6\uninstall.exe

AddRemove-TVersity Codec Pack - c:\program files\TVersity Codec Pack\uninst.exe

AddRemove-{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9} - c:\documents and settings\All Users\Application Data\{9327ACE9-CC82-4A33-9B33-291ACA1E267B}\Guitar Rig 5 Setup PC.exe

AddRemove-{0886900B-B2F3-452C-B580-60F1253F7F80} - c:\documents and settings\All Users\Application Data\{DCC412E7-393B-4016-91FB-9307F059AFB6}\Controller Editor Setup PC.exe

AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\documents and settings\All Users\Application Data\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe

AddRemove-{2930FB47-6452-4476-BF16-D77F748646DB} - c:\documents and settings\All Users\Application Data\{4F32CAF7-963B-404D-BF13-C48BA3F5F6A7}\GuitarRig Mobile IO Driver Setup.exe

AddRemove-{7930FB47-6452-4476-BF16-D77F748646DB} - c:\documents and settings\All Users\Application Data\{AC46DC4F-66BD-4733-A8B4-0B69418C12D0}\Session IO Driver Setup.exe

AddRemove-{A7E19604-93AF-4611-8C9F-CE509C2B286F}_is1 - c:\program files\Free YouTube Downloader\unins000.exe

AddRemove-{B962AD08-335F-46f7-A182-257D37672E5C} - c:\documents and settings\All Users\Application Data\{EC98E512-708C-4C3B-9F07-B58768C1DD8A}\Rig Kontrol 3 Driver Setup.exe

AddRemove-{C7FAFC98-5ECC-40FC-B440-A5D5FE3A6A6E} - c:\documents and settings\All Users\Application Data\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe

AddRemove-{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} - c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-03-09 03:47

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}]

"ClassGUID"="{4D36E97D-E325-11CE-BFC1-08002BE10318}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}\#]

@="Microsoft\00??ms_mmvid\00\0c???\0e\08\00?\00\03\00\01\00???????\00???\0a\12\00?\00\01\00\01\00?????\00\00\00??7-1-2001\00\00??Video Codecs"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1000)

c:\windows\system32\tvt_gina.dll

c:\program files\Lenovo\Client Security Solution\css_gina_plugin.dll

c:\program files\Lenovo\Client Security Solution\css_wait_bar.dll

c:\program files\Lenovo\Client Security Solution\cssuserdatadispatcher.dll

c:\program files\Lenovo\Client Security Solution\csswait.dll

c:\program files\Common Files\Lenovo\tvt_banner.dll

c:\program files\Lenovo\Client Security Solution\cssdlgpwentry.dll

c:\program files\Lenovo\Client Security Solution\dlganswerprompt.dll

c:\program files\Lenovo\Client Security Solution\tvttsp.dll

c:\program files\Lenovo\Client Security Solution\tcsrpc.dll

c:\program files\Common Files\Lenovo\tvt_res.dll

c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

Completion time: 2013-03-09 03:51:02

ComboFix-quarantined-files.txt 2013-03-08 17:50

ComboFix2.txt 2009-09-27 19:15

.

Pre-Run: 13,662,547,968 bytes free

Post-Run: 14,941,941,760 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 5661F7837A8D37A02950D3364C844F25

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  • Put a checkmark beside loaded modules.
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.
  • Click the Start Scan button.
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
    Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
    If the forum still complains about it being to long send me everything that is at the end of the report after where it says
    ==================
    Scan finished
    ==================

and I will see if I want to see the whole report

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit

2.Unzip the contents to a folder in a convenient location.

3.Open the folder where the contents were unzipped and run mbar.exe

4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6.Wait while the system shuts down and the cleanup process is performed.

7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

  • •Internet access
    •Windows Update
    •Windows Firewall

9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.

10.Verify that your system is now functioning normally.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and MBAR

Gringo

Link to post
Share on other sites

05:19:30.0734 3796 ============================================================

05:19:30.0734 3796 Scan finished

05:19:30.0734 3796 ============================================================

05:19:30.0843 3384 Detected object count: 36

05:19:30.0843 3384 Actual detected object count: 36

05:21:21.0921 3384 ANPD ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 ANPD ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 Diskeeper ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 Diskeeper ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0921 3384 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0921 3384 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0937 3384 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0937 3384 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0953 3384 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0953 3384 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0968 3384 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0968 3384 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0968 3384 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0968 3384 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:21.0984 3384 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:21.0984 3384 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 EGATHDRV ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 EGATHDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0000 3384 ialm ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0000 3384 ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 IPSSVC ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 IPSSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0015 3384 Iviaspi ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0015 3384 Iviaspi ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 NIHardwareService ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 NIHardwareService ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 pmem ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 pmem ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0031 3384 PrivateDisk ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0031 3384 PrivateDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 PROCDD ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 PROCDD ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 psadd ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 psadd ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 PsaSrv ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 PsaSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0046 3384 smi2 ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0046 3384 smi2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 SUService ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TPkd ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TPkd ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TVT Backup Service ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TVT Backup Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0062 3384 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0062 3384 tvtfilter ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0078 3384 tvtfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0078 3384 tvtnetwk ( UnsignedFile.Multi.Generic ) - skipped by user

05:21:22.0078 3384 tvtnetwk ( UnsignedFile.Multi.Generic ) - User select action: Skip

05:21:22.0078 3384 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

05:21:22.0078 3384 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Link to post
Share on other sites

ok that's done,

here's the log. malware still present. will restart pc.

06:28:02.0421 3568 ============================================================

06:28:02.0421 3568 Scan finished

06:28:02.0421 3568 ============================================================

06:28:02.0546 0260 Detected object count: 36

06:28:02.0546 0260 Actual detected object count: 36

06:31:07.0125 0260 ANPD ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 ANPD ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 BVRPMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 Diskeeper ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 Diskeeper ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 DLABOIOM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 DLABOIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0125 0260 DLACDBHM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0125 0260 DLACDBHM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLADResN ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLADResN ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAIFS_M ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAIFS_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAOPIOM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAOPIOM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0140 0260 DLAPoolM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0140 0260 DLAPoolM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLARTL_N ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLARTL_N ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLAUDFAM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLAUDFAM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DLAUDF_M ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DLAUDF_M ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0156 0260 DRVMCDB ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0156 0260 DRVMCDB ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 DRVNDDM ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 DRVNDDM ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 D_Link_DWA-525 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 D_Link_DWA-525_WPS ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0171 0260 EGATHDRV ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0171 0260 EGATHDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 ialm ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 ialm ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0187 0260 IPSSVC ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0187 0260 IPSSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0203 0260 Iviaspi ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0203 0260 Iviaspi ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0203 0260 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0203 0260 Lavasoft Ad-Aware Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 NIHardwareService ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 NIHardwareService ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 pmem ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 pmem ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0218 0260 PrivateDisk ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0218 0260 PrivateDisk ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 PROCDD ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 PROCDD ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 psadd ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 psadd ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 PsaSrv ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 PsaSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0234 0260 smi2 ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0234 0260 smi2 ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 SUService ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TPkd ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TPkd ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TVT Backup Service ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TVT Backup Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0250 0260 tvtfilter ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0250 0260 tvtfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0265 0260 tvtnetwk ( UnsignedFile.Multi.Generic ) - skipped by user

06:31:07.0265 0260 tvtnetwk ( UnsignedFile.Multi.Generic ) - User select action: Skip

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS\z00clicker.dll - copied to quarantine

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

06:31:07.0343 0260 \Device\Harddisk0\DR0\TDLFS - deleted

06:31:07.0343 0260 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

 ClearJavaCache:: 

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

CFScriptB-4.gif

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  1. report from Combofix
  2. let me know of any problems you may have had
  3. How is the computer doing now after running the script?

Gringo

Link to post
Share on other sites

No running issues. still have ads.

ComboFix 13-03-07.03 - Mr. Bojangles 03/09/2013 7:21.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1293 [GMT 10:00]

Running from: c:\documents and settings\Mr. Bojangles\My Documents\Downloads\ComboFix.exe

Command switches used :: c:\documents and settings\Mr. Bojangles\Desktop\CFScript.txt.txt

AV: AVG Anti-Virus *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Symantec AntiVirus Corporate Edition *Disabled/Outdated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Client Firewall *Disabled* {5CB76A43-5FAD-476B-B9FF-26FA61F13187}

.

.

((((((((((((((((((((((((( Files Created from 2013-02-08 to 2013-03-08 )))))))))))))))))))))))))))))))

.

.

2013-03-08 20:31 . 2013-03-08 20:31 -------- d-----w- C:\TDSSKiller_Quarantine

2013-02-25 13:58 . 2013-02-25 14:06 -------- d-----w- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\adawarebp

2013-02-24 12:14 . 2013-02-24 12:14 -------- d-----w- c:\windows\ERUNT

2013-02-24 12:13 . 2013-02-24 12:13 -------- d-----w- C:\JRT

2013-02-15 22:31 . 2013-02-15 22:31 186432 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-02 14:00 . 2009-01-08 04:47 5427 ----a-w- c:\windows\system32\EGATHDRV.SYS

2013-02-27 12:13 . 2012-04-22 06:25 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-27 12:13 . 2011-05-29 09:02 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-14 06:49 . 2009-09-23 08:38 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-25 16:41 . 2013-03-08 05:46 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-09-25 16:41 . 2013-03-08 05:46 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

2013-03-08 05:46 . 2013-03-08 05:46 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2010-05-04 . F247F7AC6713066D4C71721BDC73FC2E . 3600384 . . [7.00.6000.17063] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\mshtml.dll

[-] 2010-05-04 . C466BDCDFAE6F6EFD618F34BA90B1923 . 3603456 . . [7.00.6000.21264] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\mshtml.dll

[-] 2010-03-11 . 94359CD5BB6AC1CC08088F4A4091FF1E . 3599872 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\mshtml.dll

[-] 2010-03-11 . 9289EBB759293A1381AB0C326A115AEC . 3602944 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\mshtml.dll

[7] 2010-01-05 . 1673677DBD70142DB1294F1B6FC3323E . 3602944 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\mshtml.dll

[7] 2009-07-19 . F25D866DD486AD30E05E5596CB363C3E . 5938176 . . [8.00.6001.22902] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\mshtml.dll

[7] 2009-05-13 . EEAADAA744B20E68CF5EB4FBB4F8AFA9 . 5936128 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\mshtml.dll

[7] 2009-05-13 . 1290E417BF806185CC7B2845E78A104E . 5936128 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\mshtml.dll

[7] 2009-04-29 . 2B4315EC9E3124408A2A5074C4B97700 . 3596288 . . [7.00.6000.16850] . . c:\windows\ie8\mshtml.dll

[7] 2009-04-29 . C6FD770D518FB024245A0EE217D72BC1 . 3598336 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\mshtml.dll

[7] 2009-03-07 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\mshtml.dll

[7] 2009-02-21 . 1BB754AB47B327DE8DBF2FA18C36357C . 3596800 . . [7.00.6000.21015] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\mshtml.dll

[7] 2009-02-20 . C7C3E41CC2F6EB4A629FE2184136C098 . 3595264 . . [7.00.6000.16825] . . c:\windows\ie7updates\KB969897-IE7\mshtml.dll

[7] 2009-01-16 . CC9D001B7370B292C35B366CA05B12B4 . 3596288 . . [7.00.6000.20996] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\mshtml.dll

[7] 2009-01-16 . 3B413267DA8AE71C20E5EF3E54F74728 . 3594752 . . [7.00.6000.16809] . . c:\windows\ie7updates\KB963027-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB961260-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ie7updates\KB978207-IE7\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\ServicePackFiles\i386\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\mshtml.dll

[-] 2008-12-13 . 513D14B789343F7C4150C0568E252D0B . 3866112 . . [7.00.6000.16788] . . c:\windows\system32\dllcache\mshtml.dll

[7] 2008-12-13 . C79FAD61CD4A26ED5AA8C16D991C6FBD . 3594752 . . [7.00.6000.20973] . . c:\windows\$hf_mig$\KB960714-IE7\SP2QFE\mshtml.dll

[7] 2008-10-16 . B74F31A4BD83797D7A083F922169287D . 3595264 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\mshtml.dll

[7] 2008-04-14 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\mshtml.dll

[7] 2006-11-08 . CBF04597F9CF7739E572276A2698FDD3 . 3577856 . . [7.00.5730.11] . . c:\windows\ie7updates\KB960714-IE7\mshtml.dll

[-] 2006-02-01 . 51C91AC189321A320FC4BC90B56255A3 . 3073024 . . [6.00.2900.2838] . . c:\windows\ie7\mshtml.dll

[-] 2005-11-24 . 5E7A39950EA133BB54719A6E08C544A7 . 3015680 . . [6.00.2900.2802] . . c:\windows\$NtUninstallKB905915$\mshtml.dll

[-] 2005-11-24 . D3F037F5DA702AE9DDD7663EC9D78BA7 . 3018240 . . [6.00.2900.2802] . . c:\windows\$hf_mig$\KB905915\SP2QFE\mshtml.dll

.

[-] 2010-05-04 . 83306356DE710DA87ED91A6AF6233214 . 832512 . . [7.00.6000.17055] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3gdr\wininet.dll

[-] 2010-05-04 . 506B3DCB9C26070072E3047C6910F844 . 841216 . . [7.00.6000.21256] . . c:\windows\SoftwareDistribution\Download\da350b0b03b15d30eb758fde8c0df67a\sp3qfe\wininet.dll

[-] 2010-03-11 . B6AB2EB1DA4BB29079B84AC842520670 . 832512 . . [7.00.6000.17023] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3gdr\wininet.dll

[-] 2010-03-11 . 7F6A9D2F3CAA7780AAFD478BF3411462 . 841216 . . [7.00.6000.21228] . . c:\windows\SoftwareDistribution\Download\fd907694b9730bf0b6b92a6dbc2f96ef\sp3qfe\wininet.dll

[7] 2010-01-05 . E7B99465DE2EDCF29784B7600BF6FAE8 . 841216 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\wininet.dll

[7] 2009-07-03 . 38114DAB42FB2EB84D1726C42B8D80C5 . 915456 . . [8.00.6001.22896] . . c:\windows\$hf_mig$\KB972260-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\ie8updates\KB972260-IE8\wininet.dll

[7] 2009-05-13 . 366C72AF6970DB7BB39AB0142BF09DB5 . 915456 . . [8.00.6001.18783] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3GDR\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\$hf_mig$\KB969897-IE8\SP3QFE\wininet.dll

[7] 2009-05-13 . C0EB6850C8A02A154281749DC61FAF22 . 915456 . . [8.00.6001.22873] . . c:\windows\SoftwareDistribution\Download\97fe76a20161cb86e78057600e7c82a0\SP3QFE\wininet.dll

[7] 2009-04-29 . 8E2D471157B0DF329D8D0EA5D83B0DDB . 827392 . . [7.00.6000.16850] . . c:\windows\ie8\wininet.dll

[7] 2009-04-29 . 62CCA075F44015147B8971DAFFBCFF76 . 828928 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\wininet.dll

[7] 2009-03-07 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB969897-IE8\wininet.dll

[7] 2009-03-03 . 28775945CCD53DEE280EF58DEA1A94C4 . 826368 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\wininet.dll

[7] 2009-03-03 . C8667854873938CA13C986F16B0CD183 . 828416 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll

[7] 2008-12-20 . 044E0A4E9FE97C0FB9AFE9C89E2A82E6 . 827904 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll

[7] 2008-12-20 . A82935D32D0672E8FF4E91AE398E901C . 826368 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB978207-IE7\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\ServicePackFiles\i386\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\wininet.dll

[-] 2008-10-16 . 5044269D9DC59326D8EE54C28ACD7003 . 817152 . . [7.00.6000.16762] . . c:\windows\system32\dllcache\wininet.dll

[7] 2008-10-16 . 0D5B75171FF51775B630A431B6C667E8 . 827904 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll

[7] 2008-04-14 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\wininet.dll

[7] 2006-11-08 . 92995334F993E6E49C25C6D02EC04401 . 818688 . . [7.00.5730.11] . . c:\windows\ie7updates\KB958215-IE7\wininet.dll

[-] 2006-01-09 . DDE9597A3311748C1519444E2BC147BD . 662016 . . [6.00.2900.2823] . . c:\windows\ie7\wininet.dll

[-] 2005-10-21 . E7B27B6B6E06CE34EA019FD8B858C613 . 658432 . . [6.00.2900.2781] . . c:\windows\$NtUninstallKB905915$\wininet.dll

[-] 2005-10-21 . AF785C4947676A7FC1673FDC5C8D0B5B . 661504 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll

.

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 561A50497324F378E30F55D09B4E1258 . 975872 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

[-] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2qfe\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe

[-] 2007-06-13 . 97BD6515465659FF8F3B7BE375B2EA87 . 1033216 . . [6.00.2900.3156] . . c:\windows\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\sp2gdr\explorer.exe

[-] 2004-08-04 . A5C1F2CF7C31874E66478910B43D6513 . 974336 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

.

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 0B720CAE71F51A2B93811816F187BC0A . 224256 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[7] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\regedit.exe

[-] 2004-08-04 . 61F45E8000C6C5913D3D1DA451337364 . 224256 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-08-21 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2006-07-15 503808]

"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-11-11 159472]

"D-Link D-Link DWA-525"="c:\program files\D-Link\DWA-525 revA\AirNCFG.exe" [2010-04-22 1015808]

"WZCSLDR2"="c:\program files\D-Link\DWA-525 revA\WZCSLDR2.exe" [2010-04-22 122880]

"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 644104]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"Mouse Suite 98 Daemon"="ICO.EXE" [2005-04-13 49152]

"Ad-Aware Browsing Protection"="c:\documents and settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe" [2012-05-09 201112]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]

.

c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\

Dropbox.lnk - c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe [2013-1-21 28539272]

startup concealer outlook.vbs [2011-12-12 209]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-6 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AwayNotify]

2006-06-18 17:06 49152 ------w- c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Calendar Sync.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Calendar Sync.lnk

backup=c:\windows\pss\Google Calendar Sync.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^Mr. Bojangles^Start Menu^Programs^Startup^Y'z Shadow.lnk]

path=c:\documents and settings\Mr. Bojangles\Start Menu\Programs\Startup\Y'z Shadow.lnk

backup=c:\windows\pss\Y'z Shadow.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2011-03-15 07:42 499608 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]

2005-11-14 06:23 487424 -c----w- c:\program files\ThinkVantage\AMSG\Amsg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-08-27 11:32 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AwaySch]

2006-06-18 17:06 69632 -c----w- c:\program files\Lenovo\AwayTask\AwaySch.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

2005-06-02 17:21 48752 -c----w- c:\program files\Common Files\Symantec Shared\ccApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cssauth]

2006-07-15 02:13 2341632 ------w- c:\program files\Lenovo\Client Security Solution\cssauth.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

2006-05-19 00:24 196696 ------w- c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2006-02-02 13:20 122940 -c----w- c:\windows\system32\DLA\DLACTRLW.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]

2005-01-08 01:07 61952 -c----w- c:\windows\system32\HdAShCut.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2007-01-13 01:47 163840 -c----w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-28 00:50 221184 -c----w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-07-28 00:50 81920 -c----w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-09-09 13:30 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]

2006-07-04 16:11 110592 -c----w- c:\progra~1\THINKV~1\PrdCtr\LPMGR.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]

2010-12-07 09:39 644104 ----a-w- c:\windows\system32\M-AudioTaskBarIcon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon]

2005-04-13 22:34 49152 -c----w- c:\windows\system32\ico.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2010-04-16 12:12 3872080 -c--a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDService.exe]

2006-03-14 00:38 41472 -c----r- c:\program files\Lenovo\SafeGuard PrivateDisk\pdservice.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2007-01-13 01:46 135168 -c----w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-05 08:36 421888 -c--a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2008-03-25 12:28 144784 -c----w- c:\program files\Java\jre1.6.0_06\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]

2005-08-19 01:22 85696 -c----w- c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2011-12-09 17:22 74752 ----a-w- c:\program files\Winamp\winampa.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"D_Link_DWA-525"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\MSNShell\\Bin\\engie.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/6/2010 9:26 PM 64288]

R2 ANPD;ANPD Service;c:\windows\system32\ANPD.SYS [12/29/2011 6:38 PM 29411]

R2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4/8/2011 1:33 AM 3857408]

R2 PrivateDisk;PrivateDisk;c:\program files\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [3/14/2006 10:05 AM 58368]

R2 smi2;smi2;c:\program files\SMI2\smi2.sys [7/15/2006 9:55 AM 3968]

R3 MAUSBFASTTRACKPRO;Service for M-Audio FastTrack Pro;c:\windows\system32\drivers\MAudioFastTrackPro.sys [12/7/2010 3:39 PM 158600]

S2 D_Link_DWA-525_WPS;D_Link_DWA-525_WPS Service;c:\program files\D-Link\DWA-525 revA\ANIWConnService.exe [12/29/2011 6:37 PM 40960]

S3 D_Link_DWA-525;D_Link_DWA-525 Service;c:\program files\D-Link\DWA-525 revA\ANIWZCSdS.exe [12/29/2011 6:37 PM 126976]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/22/2010 3:44 AM 1737728]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [2/6/2013 1:48 AM 235216]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [12/10/2011 4:55 AM 18432]

S3 RT80x86;D-Link 802.11n Wireless Driver;c:\windows\system32\drivers\Drt2860.sys [12/29/2011 6:35 PM 1329632]

S3 SavRoam;SAVRoam;c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe [8/19/2005 11:22 AM 124608]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-05 13:04 1630672 ----a-w- c:\program files\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-06-21 07:40]

.

2013-03-08 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 12:13]

.

2013-03-08 c:\windows\Tasks\AdobeAAMUpdater-1.0-MRBOJANGLES-Mr. Bojangles.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-02-12 07:42]

.

2013-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]

.

2013-03-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008Core.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2838019926-1718427338-2428480347-1008UA.job

- c:\documents and settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-08-21 11:02]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2013-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-05 14:43]

.

2009-01-08 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2009-01-08 01:32]

.

2013-03-08 c:\windows\Tasks\User_Feed_Synchronization-{B0CC9A6F-834D-47FF-9C2A-B9379DCECD3B}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 19:58]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Set As Messenger Live Display Picture - c:\program files\MSNShell\Bin\SetMSNDP.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-18674265.sys

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-03-09 07:30

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}]

"ClassGUID"="{4D36E97D-E325-11CE-BFC1-08002BE10318}"

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{4d1e55b2-f16f-11cf-88cb-001111000030}\##?#HID#Vid_046d&Pid_0a0c&MI_03#7&1fc07de5&0&0000#{4d1e55b2-f1*f-11cf-*8cb-001*1100003*}\#]

@="Microsoft\00??ms_mmvid\00\0c???\0e\08\00?\00\03\00\01\00???????\00???\0a\12\00?\00\01\00\01\00?????\00\00\00??7-1-2001\00\00??Video Codecs"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1000)

c:\windows\system32\tvt_gina.dll

c:\program files\Lenovo\Client Security Solution\css_gina_plugin.dll

c:\program files\Lenovo\Client Security Solution\css_wait_bar.dll

c:\program files\Lenovo\Client Security Solution\cssuserdatadispatcher.dll

c:\program files\Lenovo\Client Security Solution\csswait.dll

c:\program files\Common Files\Lenovo\tvt_banner.dll

c:\program files\Lenovo\Client Security Solution\cssdlgpwentry.dll

c:\program files\Lenovo\Client Security Solution\dlganswerprompt.dll

c:\program files\Lenovo\Client Security Solution\tvttsp.dll

c:\program files\Lenovo\Client Security Solution\tcsrpc.dll

c:\program files\Common Files\Lenovo\tvt_res.dll

c:\program files\Lenovo\AwayTask\AwayNotify.dll

.

- - - - - - - > 'explorer.exe'(5168)

c:\windows\system32\SHDOCVW.dll

c:\documents and settings\Mr. Bojangles\Application Data\Dropbox\bin\DropboxExt.17.dll

c:\windows\system32\ntshrui.dll

c:\windows\system32\msi.dll

c:\windows\system32\NETSHELL.dll

c:\windows\system32\credui.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\pelscrll.dll

c:\windows\system32\PELCOMM.dll

c:\windows\system32\PELHOOKS.dll

.

Completion time: 2013-03-09 07:33:51

ComboFix-quarantined-files.txt 2013-03-08 21:33

ComboFix2.txt 2013-03-08 17:51

ComboFix3.txt 2009-09-27 19:15

.

Pre-Run: 6,771,224,576 bytes free

Post-Run: 6,755,426,304 bytes free

.

- - End Of File - - CFB1E1190463AB046ABF10772746BE2E

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

I want you to try this for firefox and give me a quick update to how things are.

I want you to reset firefox back to defaults, to do this I need you to do this

  • At the top of the Firefox window, click the "Firefox" button,
  • go over to the "Help" sub-menu
    • (on Windows XP, click the Help menu at the top of the Firefox window) and select "Troubleshooting Information".

[*]Click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.

[*]click "Reset Firefox" in the confirmation window that opens.

[*]Firefox will close and be reset. When it's done. Click "Finish" and Firefox will open.

restart the computer and check firefox for me now

Gringo

Link to post
Share on other sites

Eh Gringo!

You tha man! MALWARE REMOVED! and i'm rpetty sure after that my pc is squeaky clean from anything i didnt know i had.

thankyou so much for your assistance with this tell your boss you deserve mroe hollidays mate haha :)

Link to post
Share on other sites

  • Staff

Hello Mr. Bojangles

I would like to see a report that combofix makes.

extra combofix report

  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box


C:\Qoobox\Add-Remove Programs.txt

  • click ok

copy and paste the report into this topic for me to review

Gringo

Link to post
Share on other sites

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office system

AC3Filter (remove only)

Access Help

Activation Assistant for the 2007 Microsoft Office suites

Addictive Drums

Adobe AIR

Adobe Audition CS5.5

Adobe Community Help

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.6)

Alarm 2.0.4

AltoMP3 Gold 5.20

Antares Auto-Tune Evo VST

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASIO4ALL

Bonjour

Business Contact Manager for Outlook 2007 SP1

CamStudio OSS Desktop Recorder

Client Security Solution

Collab

Cool Edit Pro 2.1

D-Link DWA-525

Diskeeper Lite

Dropbox

e-tax 2012

Easy File Undelete

Facebook Video Calling 1.2.0.287

ffdshow [rev 3154] [2009-12-09]

FL Studio 8

Freecorder Toolbar 3.02 Application

Freez iPod Video Converter

GDR 3073 for SQL Server Database Services 2005 ENU (KB954606)

Google Calendar Sync

Google Chrome

Google Earth

Google Update Helper

Guitar Pro 4.0

Help Center

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 2.0 (KB922981)

Hotfix for Microsoft .NET Framework 2.0 (KB923319)

Hotfix for Windows Media Format 11 SDK (KB973442)

Hotfix for Windows XP (KB932716-v2)

Hotfix for Windows XP (KB952287)

IL Download Manager

ImgBurn

Intel® Graphics Media Accelerator Driver

Interlok driver setup x32

InterVideo WinDVD

InterVideo WinDVD Creator 3

iTunes

J2SE Runtime Environment 5.0 Update 6

Java 6 Update 11

Java 6 Update 6

LiveReg (Symantec Corporation)

LiveUpdate 2.6 (Symantec Corporation)

M-Audio FastTrackPro Driver 6.0.7 (x86)

Magic ISO Maker v5.5 (build 0281)

Malwarebytes Anti-Malware version 1.70.0.1100

McAfee Security Scan Plus

Message Center

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Hotfix (KB928366)

Microsoft .NET Framework 2.0

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft National Language Support Downlevel APIs

Microsoft Office 2003 Web Components

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Live Add-in 1.3

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Professional Hybrid 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Small Business Connectivity Components

Microsoft Office Word MUI (English) 2007

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFCLOC_x86

Mouse Suite

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MP4 To MP3 Converter V3.0.4

MSNShell 4

MSVCRT

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB954430)

MSXML 6 Service Pack 2 (KB954459)

MTP Porting Kit

Pack Vista Inspirat 2 1.0

PC-Doctor 5 for Windows

Picasa 3

PoiZone

PokerStars

Productivity Center Supplement for ThinkCentre

QuickTime

RecordNow Audio

RecordNow Copy

RecordNow Data

Remove Multimedia Center

Rescue and Recovery

Security Update for 2007 Microsoft Office System (KB951550)

Security Update for 2007 Microsoft Office System (KB951944)

Security Update for 2007 Microsoft Office System (KB958439)

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 2.0 (KB917283)

Security Update for Microsoft Office Excel 2007 (KB958437)

Security Update for Microsoft Office PowerPoint 2007 (KB951338)

Security Update for Microsoft Office Publisher 2007 (KB950114)

Security Update for Microsoft Office system 2007 (KB954326)

Security Update for Microsoft Office system 2007 (KB956828)

Security Update for Microsoft Office Word 2007 (KB956358)

Security Update for Step By Step Interactive Training (KB898458)

Security Update for Step By Step Interactive Training (KB923723)

Security Update for Windows Internet Explorer 7 (KB929969)

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows Media Player 10 (KB936782)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Segoe UI

SkyGazer 4

Skype™ 3.8

Sonic DLA

Sonic Express Labeler

Sonic Icons for Lenovo

Sonic Update Manager

SoundMAX

Spybot - Search & Destroy

Steam

Symantec Client Security

System Migration Assistant

System Update

ThinkVantage Away Manager

ThinkVantage Productivity Center

ThinkVantage System Update Toolbar Button for IE

ThinkVantage Technologies Welcome Message

Toxic Biohazard

Update for Microsoft Office Outlook 2007 (KB952142)

Update for Office 2007 (KB946691)

Update for Outlook 2007 Junk Email Filter (kb959141)

Update for Windows XP (KB951978)

Update for Windows XP (KB955839)

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

VLC media player 2.0.3

Wallpapers

WebFldrs XP

Winamp

Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray

Windows Genuine Advantage Notifications (KB905474)

Windows Internet Explorer 7

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Live Sign-in Assistant

Windows Live Toolbar

Windows Live Upload Tool

Windows Media Connect

Windows Media Format 11 runtime

Windows Media Player 11

Windows Mobile Device Updater Component

Windows XP Service Pack 3

WinRAR archiver

Wisdom-soft ScreenHunter 6.0 Free

Xiph.Org Open Codecs 0.85.17777

XP Themes

Zune

Zune Language Pack (DEU)

Zune Language Pack (ESP)

Zune Language Pack (FRA)

Zune Language Pack (ITA)

Zune Language Pack (NLD)

Zune Language Pack (PTB)

Zune Language Pack (PTG)

Link to post
Share on other sites

  • Staff

Hello

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)

  • Programs to remove

    • Adobe Reader X (10.1.6)
      J2SE Runtime Environment 5.0 Update 6
      Java™ 6 Update 11
      Java™ 6 Update 6
      McAfee Security Scan Plus

  • Please download and install
Revo Uninstaller FreeDouble click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Update Adobe reader

  • Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.
    You can download it from
http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.
  • If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from
here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, be careful not to install anything to do with AskBar.

Clean Out Temp Files

  • This small application you may want to keep and use once a week to keep the computer clean.
    Download CCleaner from here http://www.ccleaner.com/
    • Run the installer to install the application.
    • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
    • Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
    • Click Run Cleaner.
    • Close CCleaner.

: Malwarebytes' Anti-Malware :

I see You have MBAM installed on the computer - that is great!! it is a very good program! I would like you to run a quick scan for me now

  • Double-click mbam icon
  • go to the update tab at the top
  • click on check for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidentally close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

Click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

  • Go Here to download HijackThis program
  • Save HijackThis to your desktop.
  • Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
  • Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
  • copy and paste hijackthis report into the topic

"information and logs"

  • In your next post I need the following
  1. Log From MBAM
  2. report from Hijackthis
  3. let me know of any problems you may have had
  4. How is the computer doing now?

Gringo

Link to post
Share on other sites

#MBAM

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.03.10.07

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 7.0.5730.11

Mr. Bojangles :: MRBOJANGLES [administrator]

3/11/2013 11:16:52 AM

mbam-log-2013-03-11 (11-16-52).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 241343

Time elapsed: 9 minute(s), 15 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

#HIJACK THIS

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:31:20 AM, on 3/11/2013

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\D-Link\DWA-525 revA\ANIWConnService.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Google\Update\1.3.21.135\GoogleCrashHandler.exe

C:\WINDOWS\system32\netdde.exe

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

c:\Program Files\Zune\ZuneBusEnum.exe

C:\Program Files\Common Files\Lenovo\Logger\logmon.exe

c:\Program Files\Zune\ZuneWlanCfgSvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Lenovo\Client Security Solution\cssauth.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\D-Link\DWA-525 revA\AirNCFG.exe

C:\Program Files\D-Link\DWA-525 revA\WZCSLDR2.exe

C:\WINDOWS\system32\M-AudioTaskBarIcon.exe

C:\WINDOWS\system32\ICO.EXE

C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe

C:\WINDOWS\system32\FSRremoS.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe

C:\WINDOWS\system32\Pelmiced.exe

C:\Documents and Settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe

C:\WINDOWS\System32\cmd.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\Mr. Bojangles\My Documents\Downloads\HijackThis.exe

C:\WINDOWS\notepad.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\taskkill.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"

O4 - HKLM\..\Run: [D-Link D-Link DWA-525] C:\Program Files\D-Link\DWA-525 revA\AirNCFG.exe

O4 - HKLM\..\Run: [WZCSLDR2] C:\Program Files\D-Link\DWA-525 revA\WZCSLDR2.exe

O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\system32\M-AudioTaskBarIcon.exe

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [Facebook Update] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe

O4 - Startup: startup concealer outlook.vbs

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Set As Messenger Live Display Picture - C:\Program Files\MSNShell\Bin\SetMSNDP.htm

O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: System Update - {DA320635-F48C-4613-8325-D75A933C549E} - C:\Program Files\Lenovo\System Update\sulauncher.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: AwayNotify - C:\Program Files\Lenovo\AwayTask\AwayNotify.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: D_Link_DWA-525 Service (D_Link_DWA-525) - Wireless Service - C:\Program Files\D-Link\DWA-525 revA\ANIWZCSdS.exe

O23 - Service: D_Link_DWA-525_WPS Service (D_Link_DWA-525_WPS) - Unknown owner - C:\Program Files\D-Link\DWA-525 revA\ANIWConnService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE

O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

O23 - Service: ThinkVantage Registry Monitor Service - Unknown owner - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

--

End of file - 12775 bytes

Had no issues. Computer seems to be running great :))

Link to post
Share on other sites

  • Staff

Greetings

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded start-up entries:

This part of the fix is purely optional

These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

  • Run HijackThis (rightclick and run as admin)
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    • O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe
      O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
      O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
      O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
      O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
      O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
      O4 - HKCU\..\Run: [Facebook Update] "C:\Documents and Settings\Mr. Bojangles\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
      O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Mr. Bojangles\Application Data\Dropbox\bin\Dropbox.exe
      O4 - Startup: startup concealer outlook.vbs

[*] Close all open windows and browsers/email, etc...

[*] Click on the "Fix Checked" button

[*] When completed, close the application.

  • NOTE**You can research each of those lines
>here< and see if you want to keep them or not
just copy the name between the brackets and paste into the search space
O4 - HKLM\..\Run: [IntelliPoint]

Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scanner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • click on the Run ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
    • Click Start

    [*]When asked, allow the add/on to be installed

    • Click Start

    [*]Make sure that the option Remove found threats is unticked

    [*]Click on Advanced Settings, ensure the options

    • Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.

    [*]Click Scan

    [*]wait for the virus definitions to be downloaded

    [*]Wait for the scan to finish

When the scan is complete

  • If no threats were found
    • put a checkmark in "Uninstall application on close"
    • close program
    • report to me that nothing was found

  • If threats were found
    • click on "list of threats found"
    • click on "export to text file" and save it as ESET SCAN and save to the desktop
    • Click on back
    • put a checkmark in "Uninstall application on close"
    • click on finish
    • close program
    • copy and paste the report here

Gringo

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.