Jump to content

possible hijack attempt through wininit.exe?


Recommended Posts

I have had 6 in total,these are from protection logs where MBAM blocked them

 

7/11/2014 9:27:55 PM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 37.221.166.78, 49152, Inbound, C:\Windows\System32\wininit.exe,
Detection, 7/11/2014 9:27:55 PM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 37.221.166.78, 49152, Inbound, C:\Windows\System32\wininit.exe

 

7/12/2014 1:12:26 AM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 37.221.166.78, 49152, Inbound, C:\Windows\System32\wininit.exe,
Detection, 7/12/2014 1:12:26 AM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 37.221.166.78, 49152, Inbound, C:\Windows\System32\wininit.exe

 

7/13/2014 9:24:23 PM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 94.102.49.168, 49152, Inbound, C:\Windows\System32\wininit.exe,
Detection, 7/13/2014 9:24:23 PM, SYSTEM, STAIND-PC, Protection, Malicious Website Protection, IP, 94.102.49.168, 49152, Inbound, C:\Windows\System32\wininit.exe

 

The first was attempted while I was using Steam and the second popped up when using Firefox.The only thing I have done differently was change my IP from private to public only

 

while playing multiplayer on assassin's creed rev a few times,IP was changed back right after done playing every time

 

Attached are the Farbar logs,TY in advance

 

 

Link to post
Share on other sites

  • Replies 54
  • Created
  • Last Reply

Top Posters In This Topic

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 
 
 
 
Scan with aswMBR

Please download aswMBR ( 4.5MB ) to your desktop.
  • Double click the aswMBR.exe icon, and click Run.
  • There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
  • When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
  • Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
  • Click the Scan button to start the scan once the update has finished downloading
  • On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.


Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).

Link to post
Share on other sites

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-07-14 12:47:03
-----------------------------
12:47:03.952    OS Version: Windows x64 6.0.6002 Service Pack 2
12:47:03.952    Number of processors: 4 586 0x203
12:47:03.953    ComputerName: STAIND-PC  UserName: Staind
12:47:06.808    Initialize success
12:47:06.809    VM: initialized successfully
12:47:06.819    VM: Amd CPU BiosDisabled
12:47:09.264    VM: disk I/O ahcix64s.sys
12:55:09.252    AVAST engine defs: 14071400
12:55:37.683    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000061
12:55:37.687    Disk 0 Vendor: ST375063 HP24 Size: 715404MB BusType: 8
12:55:38.277    Disk 0 MBR read successfully
12:55:38.281    Disk 0 MBR scan
12:55:38.288    Disk 0 unknown MBR code
12:55:38.295    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       701518 MB offset 63
12:55:38.350    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        13884 MB offset 1436709015
12:55:38.466    Disk 0 scanning C:\Windows\system32\drivers
12:56:12.045    Service scanning
12:56:59.079    Modules scanning
12:56:59.090    Disk 0 trace - called modules:
12:56:59.111    ntoskrnl.exe CLASSPNP.SYS disk.sys vsflt53.sys acpi.sys storport.sys hal.dll ahcix64s.sys
12:56:59.118    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800931d060]
12:56:59.125    3 CLASSPNP.SYS[fffffa6001377c33] -> nt!IofCallDriver -> [0xfffffa800931b520]
12:56:59.132    5 vsflt53.sys[fffffa60008becfd] -> nt!IofCallDriver -> [0xfffffa8007db3040]
12:56:59.139    7 acpi.sys[fffffa600081efde] -> nt!IofCallDriver -> \Device\00000061[0xfffffa8007db0060]
12:57:03.086    AVAST engine scan C:\Windows
12:57:16.533    AVAST engine scan C:\Windows\system32
13:06:38.466    AVAST engine scan C:\Windows\system32\drivers
13:07:19.154    AVAST engine scan C:\Users\Staind
13:12:22.782    AVAST engine scan C:\ProgramData
13:16:14.707    Scan finished successfully
13:20:42.350    Disk 0 MBR has been saved successfully to "C:\Users\Staind\Desktop\Desktop\MBR.dat"
13:20:42.358    The log file has been saved successfully to "C:\Users\Staind\Desktop\Desktop\aswMBR.txt"

 

Link to post
Share on other sites

Thanks for reply Marius,also forgot to mention that I have already scanned with MBAM,MBAR,TDSS killer,Norton 360 and Eset online scanner,still came up with nothing thats why I'm here

 

after still getting incoming from wininit

Link to post
Share on other sites

Combofix

Combofix should only be run when adviced by a team member!

Link


Important - Save the file to your desktop!


  • Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
  • Run Combofix.exe



When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.

Note: When receiving an error message containing ""Illegal operation attempted on a registry key that has been marked for deletion" simply restart your computer to fix this.

Link to post
Share on other sites

I have ran Combofix in the past before with no problems however this time several apps that run with combofix crashed,don't know how important they are please let me know if I need to change something or rescan

 

the ones that crashed are NirCmd,setpath.3xe,rmbr.3xe,handle viewer has stopped working,anyway combofix finished scan which is posted below

 

 

 

ComboFix 14-07-15.04 - Staind 07/15/2014  13:37:48.1.4 - x64
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.8183.6282 [GMT -5:00]
Running from: c:\users\Staind\Desktop\Desktop\ComboFix.exe
AV: Norton 360 *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton 360 *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton 360 *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\windows\SysWow64\SETB545.tmp
.
.
(((((((((((((((((((((((((   Files Created from 2014-06-15 to 2014-07-15  )))))))))))))))))))))))))))))))
.
.
2014-07-15 18:59 . 2014-07-15 18:59    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-07-14 04:51 . 2014-07-14 04:55    --------    d-----w-    C:\FRST
2014-07-12 11:06 . 2014-07-12 11:07    --------    d-----w-    c:\program files (x86)\FileASSASSIN
2014-07-12 06:57 . 2014-07-12 06:57    --------    d-----w-    c:\program files (x86)\ESET
2014-07-10 08:02 . 2014-06-07 02:45    599040    ----a-w-    c:\windows\system32\vbscript.dll
2014-07-10 07:59 . 2014-06-07 01:41    1871872    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-10 07:59 . 2014-06-07 01:41    120832    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-10 07:59 . 2014-06-07 01:41    206336    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-10 07:59 . 2014-06-07 00:33    2777088    ----a-w-    c:\windows\system32\win32k.sys
2014-07-10 07:59 . 2014-06-07 00:22    10240    ----a-w-    c:\program files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe
2014-07-10 07:59 . 2014-06-06 08:59    506880    ----a-w-    c:\windows\SysWow64\qedit.dll
2014-07-10 07:59 . 2014-06-06 07:13    620032    ----a-w-    c:\windows\system32\qedit.dll
2014-07-10 07:59 . 2014-05-30 07:10    404992    ----a-w-    c:\windows\system32\drivers\afd.sys
2014-07-09 01:43 . 2014-07-09 03:02    --------    d-----w-    c:\users\Staind\AppData\Roaming\HandBrake
2014-07-09 01:43 . 2014-07-09 01:43    --------    d-----w-    c:\program files\Handbrake
2014-07-09 01:04 . 2014-07-09 01:23    --------    d-----w-    c:\windows\system32\drivers\N360x64\1504000.00D
2014-07-08 18:33 . 2014-07-08 18:33    --------    d-----w-    c:\windows\system32\drivers\NSTx64\7DE07030.00C
2014-06-20 14:45 . 2014-06-20 14:45    --------    d-----w-    c:\users\Staind\.thumbnails
2014-06-20 14:45 . 2014-06-20 14:53    --------    d-----w-    c:\users\Staind\AppData\Local\gtk-2.0
2014-06-20 14:40 . 2014-06-20 14:40    --------    d-----w-    c:\users\Staind\AppData\Local\fontconfig
2014-06-20 14:40 . 2014-06-20 15:07    --------    d-----w-    c:\users\Staind\.gimp-2.8
2014-06-20 14:40 . 2014-06-20 14:40    --------    d-----w-    c:\users\Staind\AppData\Local\gegl-0.2
2014-06-20 14:34 . 2014-06-20 15:08    --------    d-----w-    c:\program files\GIMP 2
2014-06-19 12:38 . 2014-06-19 12:38    --------    d-----w-    c:\program files (x86)\Common Files\Java
2014-06-19 12:34 . 2014-06-19 12:34    98216    ----a-w-    c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-06-19 12:33 . 2014-06-19 12:33    --------    d-----w-    c:\program files (x86)\Java
2014-06-19 12:26 . 2014-06-19 12:26    --------    d-----w-    c:\program files (x86)\Auslogics
2014-06-18 21:35 . 2014-06-18 21:35    --------    d-----w-    c:\program files (x86)\GameSpy Arcade
2014-06-18 20:39 . 2014-06-18 20:39    122584    ----a-w-    c:\windows\system32\drivers\67FC4E72.sys
2014-06-16 19:39 . 2014-06-16 19:39    --------    d-----w-    c:\programdata\EA Core
2014-06-16 19:39 . 2014-06-16 19:39    --------    d-----w-    c:\programdata\EA Logs
2014-06-16 16:55 . 2014-05-14 23:49    3774821    ----a-w-    c:\windows\system32\nvcoproc.bin
2014-06-16 16:31 . 2014-06-16 16:31    --------    d-----w-    C:\NVIDIA
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-15 18:21 . 2014-04-08 01:39    122584    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-07-12 02:58 . 2014-04-09 06:44    91352    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2014-07-10 08:02 . 2006-11-02 12:35    96441528    ----a-w-    c:\windows\system32\mrt.exe
2014-07-09 03:38 . 2012-10-21 06:47    699056    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-09 03:38 . 2012-10-21 06:47    71344    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-01 16:52 . 2013-12-30 23:26    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.xtr
2014-07-01 16:52 . 2013-12-30 06:55    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.exe
2014-06-30 16:41 . 2013-12-30 06:55    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.ex0
2014-06-27 03:57 . 2013-12-30 06:54    75136    ----a-w-    c:\windows\SysWow64\PnkBstrA.exe
2014-06-03 03:35 . 2014-06-03 03:35    177752    ----a-w-    c:\windows\system32\drivers\SYMEVENT64x86.SYS
2014-05-20 02:44 . 2014-01-09 17:57    16003912    ----a-w-    c:\windows\SysWow64\nvwgf2um.dll
2014-05-20 02:44 . 2014-01-09 06:19    61216    ----a-w-    c:\windows\system32\OpenCL.dll
2014-05-20 02:44 . 2014-01-09 06:19    52056    ----a-w-    c:\windows\SysWow64\OpenCL.dll
2014-05-20 02:44 . 2014-01-09 06:07    3109248    ----a-w-    c:\windows\system32\nvapi64.dll
2014-05-20 02:44 . 2014-01-09 06:07    17480432    ----a-w-    c:\windows\system32\nvd3dumx.dll
2014-05-20 01:25 . 2014-01-09 06:26    6769096    ----a-w-    c:\windows\system32\nvcpl.dll
2014-05-20 01:25 . 2014-01-09 06:26    3514144    ----a-w-    c:\windows\system32\nvsvc64.dll
2014-05-20 01:25 . 2014-01-09 06:26    927520    ----a-w-    c:\windows\system32\nvvsvc.exe
2014-05-20 01:25 . 2014-01-09 06:26    62808    ----a-w-    c:\windows\system32\nvshext.dll
2014-05-20 01:25 . 2014-01-09 06:26    387528    ----a-w-    c:\windows\system32\nvmctray.dll
2014-05-12 12:26 . 2014-04-09 06:44    64216    ----a-w-    c:\windows\system32\drivers\mwac.sys
2014-05-12 12:25 . 2014-04-09 06:44    25816    ----a-w-    c:\windows\system32\drivers\mbam.sys
2014-04-26 18:21 . 2014-06-11 05:51    622592    ----a-w-    c:\windows\system32\usp10.dll
2014-04-26 16:01 . 2014-06-11 05:51    502784    ----a-w-    c:\windows\SysWow64\usp10.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"DiscWizardMonitor.exe"="c:\program files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe" [2011-06-30 2638152]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-05-07 256896]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe -det [2008-9-8 430080]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\09367228.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\33093670.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\44423320.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\57292475.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\95997042.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2014-07-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-21 03:38]
.
2014-07-01 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 16:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagate Scheduler2 Service"="c:\program files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe" [2011-06-30 395152]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-30 2199840]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=bestbuy&pf=cndt
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{A495917D-9C23-4FD5-A3F4-6F09307009D3}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{C7C0F69C-DB1E-4D0A-84AC-B708C2A4200F}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\users\Staind\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.dubb\
FF - prefs.js: browser.startup.homepage - about:blank
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM-Run-SmartMenu - c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\21.4.0.13\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\21.4.0.13\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NCO]
"ImagePath"="\"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe\" /s \"NCO\" /m \"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.3.12\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms"
"ImagePath"="\SystemRoot\System32\Drivers\N360x64\1504000.00D\SYMTDIV.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton 360\Engine\21.4.0.13;c:\program files (x86)\Norton 360\Engine64\21.4.0.13"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1932874015-3037005083-3990507107-1000\Software\SecuROM\License information*]
"datasecu"=hex:53,94,f6,ca,f3,19,46,56,6b,0c,e1,2a,62,88,ab,35,c4,56,4c,5b,78,
   ca,28,39,76,74,b3,a2,d6,ee,97,b9,53,32,8d,f5,58,a2,74,0e,f9,2c,05,d4,d8,67,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Completion time: 2014-07-15  14:04:23
ComboFix-quarantined-files.txt  2014-07-15 19:04
.
Pre-Run: 342,771,388,416 bytes free
Post-Run: 342,644,891,648 bytes free
.
- - End Of File - - 4125FB569801E5A51683B2ECD008F00E
 

Link to post
Share on other sites

Started combofix in safe mode and safe mode with command prompt,ran as admin,when scan started it said "access denied.admin permissions are needed to use the selected options.use an admin command prompt to complete these tasks"

 

at the start and towards the end,again let me know if I need to do anything else or scan again

Link to post
Share on other sites

ComboFix 14-07-15.04 - Staind 07/16/2014   3:24.2.4 - x64 MINIMAL
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.8183.7430 [GMT -5:00]
Running from: c:\users\Staind\Desktop\Desktop\ComboFix.exe
AV: Norton 360 *Enabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton 360 *Enabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton 360 *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2014-06-16 to 2014-07-16  )))))))))))))))))))))))))))))))
.
.
2014-07-16 08:33 . 2014-07-16 08:33    --------    d-----w-    c:\users\UpdatusUser\AppData\Local\temp
2014-07-16 08:33 . 2014-07-16 08:33    --------    d-----w-    c:\users\Staind\AppData\Local\temp
2014-07-16 08:33 . 2014-07-16 08:33    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-07-16 06:51 . 2014-07-16 06:51    --------    d-----w-    c:\program files (x86)\Common Files\Java
2014-07-16 06:50 . 2014-07-10 01:03    98216    ----a-w-    c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-07-14 04:51 . 2014-07-14 04:55    --------    d-----w-    C:\FRST
2014-07-12 11:06 . 2014-07-12 11:07    --------    d-----w-    c:\program files (x86)\FileASSASSIN
2014-07-12 06:57 . 2014-07-12 06:57    --------    d-----w-    c:\program files (x86)\ESET
2014-07-10 08:02 . 2014-06-07 02:45    599040    ----a-w-    c:\windows\system32\vbscript.dll
2014-07-10 07:59 . 2014-06-07 01:41    1871872    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-10 07:59 . 2014-06-07 01:41    120832    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-10 07:59 . 2014-06-07 01:41    206336    ----a-w-    c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-10 07:59 . 2014-06-07 00:33    2777088    ----a-w-    c:\windows\system32\win32k.sys
2014-07-10 07:59 . 2014-06-07 00:22    10240    ----a-w-    c:\program files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe
2014-07-10 07:59 . 2014-06-06 08:59    506880    ----a-w-    c:\windows\SysWow64\qedit.dll
2014-07-10 07:59 . 2014-06-06 07:13    620032    ----a-w-    c:\windows\system32\qedit.dll
2014-07-10 07:59 . 2014-05-30 07:10    404992    ----a-w-    c:\windows\system32\drivers\afd.sys
2014-07-09 01:43 . 2014-07-09 03:02    --------    d-----w-    c:\users\Staind\AppData\Roaming\HandBrake
2014-07-09 01:43 . 2014-07-09 01:43    --------    d-----w-    c:\program files\Handbrake
2014-07-09 01:04 . 2014-07-09 01:23    --------    d-----w-    c:\windows\system32\drivers\N360x64\1504000.00D
2014-07-08 18:33 . 2014-07-08 18:33    --------    d-----w-    c:\windows\system32\drivers\NSTx64\7DE07030.00C
2014-06-20 14:45 . 2014-06-20 14:45    --------    d-----w-    c:\users\Staind\.thumbnails
2014-06-20 14:45 . 2014-06-20 14:53    --------    d-----w-    c:\users\Staind\AppData\Local\gtk-2.0
2014-06-20 14:40 . 2014-06-20 14:40    --------    d-----w-    c:\users\Staind\AppData\Local\fontconfig
2014-06-20 14:40 . 2014-06-20 15:07    --------    d-----w-    c:\users\Staind\.gimp-2.8
2014-06-20 14:40 . 2014-06-20 14:40    --------    d-----w-    c:\users\Staind\AppData\Local\gegl-0.2
2014-06-20 14:34 . 2014-06-20 15:08    --------    d-----w-    c:\program files\GIMP 2
2014-06-19 12:33 . 2014-07-16 06:50    --------    d-----w-    c:\program files (x86)\Java
2014-06-19 12:26 . 2014-06-19 12:26    --------    d-----w-    c:\program files (x86)\Auslogics
2014-06-18 21:35 . 2014-06-18 21:35    --------    d-----w-    c:\program files (x86)\GameSpy Arcade
2014-06-18 20:39 . 2014-06-18 20:39    122584    ----a-w-    c:\windows\system32\drivers\67FC4E72.sys
2014-06-16 19:39 . 2014-06-16 19:39    --------    d-----w-    c:\programdata\EA Core
2014-06-16 19:39 . 2014-06-16 19:39    --------    d-----w-    c:\programdata\EA Logs
2014-06-16 16:55 . 2014-05-14 23:49    3774821    ----a-w-    c:\windows\system32\nvcoproc.bin
2014-06-16 16:31 . 2014-06-16 16:31    --------    d-----w-    C:\NVIDIA
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-16 04:30 . 2014-04-08 01:39    122584    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-07-12 02:58 . 2014-04-09 06:44    91352    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2014-07-10 08:02 . 2006-11-02 12:35    96441528    ----a-w-    c:\windows\system32\mrt.exe
2014-07-09 03:38 . 2012-10-21 06:47    699056    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-09 03:38 . 2012-10-21 06:47    71344    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-01 16:52 . 2013-12-30 23:26    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.xtr
2014-07-01 16:52 . 2013-12-30 06:55    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.exe
2014-06-30 16:41 . 2013-12-30 06:55    280976    ----a-w-    c:\windows\SysWow64\PnkBstrB.ex0
2014-06-27 03:57 . 2013-12-30 06:54    75136    ----a-w-    c:\windows\SysWow64\PnkBstrA.exe
2014-06-03 03:35 . 2014-06-03 03:35    177752    ----a-w-    c:\windows\system32\drivers\SYMEVENT64x86.SYS
2014-05-20 02:44 . 2014-01-09 17:57    16003912    ----a-w-    c:\windows\SysWow64\nvwgf2um.dll
2014-05-20 02:44 . 2014-01-09 06:19    61216    ----a-w-    c:\windows\system32\OpenCL.dll
2014-05-20 02:44 . 2014-01-09 06:19    52056    ----a-w-    c:\windows\SysWow64\OpenCL.dll
2014-05-20 02:44 . 2014-01-09 06:07    3109248    ----a-w-    c:\windows\system32\nvapi64.dll
2014-05-20 02:44 . 2014-01-09 06:07    17480432    ----a-w-    c:\windows\system32\nvd3dumx.dll
2014-05-20 01:25 . 2014-01-09 06:26    6769096    ----a-w-    c:\windows\system32\nvcpl.dll
2014-05-20 01:25 . 2014-01-09 06:26    3514144    ----a-w-    c:\windows\system32\nvsvc64.dll
2014-05-20 01:25 . 2014-01-09 06:26    927520    ----a-w-    c:\windows\system32\nvvsvc.exe
2014-05-20 01:25 . 2014-01-09 06:26    62808    ----a-w-    c:\windows\system32\nvshext.dll
2014-05-20 01:25 . 2014-01-09 06:26    387528    ----a-w-    c:\windows\system32\nvmctray.dll
2014-05-12 12:26 . 2014-04-09 06:44    64216    ----a-w-    c:\windows\system32\drivers\mwac.sys
2014-05-12 12:25 . 2014-04-09 06:44    25816    ----a-w-    c:\windows\system32\drivers\mbam.sys
2014-04-26 18:21 . 2014-06-11 05:51    622592    ----a-w-    c:\windows\system32\usp10.dll
2014-04-26 16:01 . 2014-06-11 05:51    502784    ----a-w-    c:\windows\SysWow64\usp10.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\program files (x86)\Hewlett-Packard\KBD\KbdStub.EXE" [2008-07-21 12288]
"HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]
"TSMAgent"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296]
"CLMLServer for HP TouchSmart"="c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736]
"DVDAgent"="c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"DiscWizardMonitor.exe"="c:\program files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe" [2011-06-30 2638152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe -det [2008-9-8 430080]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2014-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-21 03:38]
.
2014-07-01 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 16:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartMenu"="c:\program files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [bU]
"Seagate Scheduler2 Service"="c:\program files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe" [2011-06-30 395152]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-04-30 2199840]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=bestbuy&pf=cndt
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{A495917D-9C23-4FD5-A3F4-6F09307009D3}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{C7C0F69C-DB1E-4D0A-84AC-B708C2A4200F}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\users\Staind\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.dubb\
FF - prefs.js: browser.startup.homepage - about:blank
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-09367228.sys
SafeBoot-33093670.sys
SafeBoot-44423320.sys
SafeBoot-57292475.sys
SafeBoot-95997042.sys
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\21.4.0.13\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\21.4.0.13\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NCO]
"ImagePath"="\"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe\" /s \"NCO\" /m \"c:\program files (x86)\Norton Identity Safe\Engine\2014.7.3.12\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{8AAF211B-043E02A9-05040000}]
"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC_x64.pkms"
"ImagePath"="\SystemRoot\System32\Drivers\N360x64\1504000.00D\SYMTDIV.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton 360\Engine\21.4.0.13;c:\program files (x86)\Norton 360\Engine64\21.4.0.13"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1932874015-3037005083-3990507107-1000\Software\SecuROM\License information*]
"datasecu"=hex:53,94,f6,ca,f3,19,46,56,6b,0c,e1,2a,62,88,ab,35,c4,56,4c,5b,78,
   ca,28,39,76,74,b3,a2,d6,ee,97,b9,53,32,8d,f5,58,a2,74,0e,f9,2c,05,d4,d8,67,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Completion time: 2014-07-16  03:36:33
ComboFix-quarantined-files.txt  2014-07-16 08:36
ComboFix2.txt  2014-07-15 19:04
.
Pre-Run: 329,629,085,696 bytes free
Post-Run: 329,503,875,072 bytes free
.
- - End Of File - - D18E834299BA37513DC2E2719E6429C9
 

Link to post
Share on other sites

Windows Repair (all-in-one)

Download Windows Repair (All in One) from this site

Install the program then run it.

NOTE 1. In Windows Vista, 7 and 8 right click on the program, click "Run As Administrator".
NOTE 2. Disable your antivirus program before running Windows Repair.

Go to Step 2 and click on Check button next to 1. See If Check Disk Is Needed.
If the tool indicates that the Check Disk is needed click on Do It button next to 2. Check Disk.
In that case make sure you restart computer.

p22004342.gif


Once the above is done go to Step 3 and allow it to run System File Check by clicking on Do It button:

p22004343.gif


Go to Step 4 and under "System Restore" click on Create button:

p22004346.gif


Go to Start Repairs tab and click Start button.

Leave all checkmarks as they're.
NOTE for Windows 8 users. Reset Registry Permissions is NOT checked by design.

Click on Start button.

p22004347.gif

Post Windows Repair log which is located in the following folder:
64-bit systems - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
32-bit systems - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

Link to post
Share on other sites

System Variables
--------------------------------------------------------------------------------
OS: Windows Vista Home Premium
OS Architecture: 64-bit
OS Version: 6.0.6002
OS Service Pack: Service Pack 2
Computer Name: STAIND-PC
Windows Drive: C:\
Windows Path: C:\Windows
Current Profile:
Current Profile SID: S-1-5-21-1932874015-3037005083-3990507107-1000
Current Profile Classes: S-1-5-21-1932874015-3037005083-3990507107-1000_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Staind\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:30:21

Process Count: 67
Commit Total: 1.80 GB
Commit Limit: 16.04 GB
Commit Peak: 1.99 GB
Handle Count: 21140
Kernel Total: 487.07 MB
Kernel Paged: 399.41 MB
Kernel Non Paged: 87.65 MB
System Cache: 3.94 GB
Thread Count: 879
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 7.99 GB
Memory Used: 1.81 GB(22.705%)
Memory Avail.: 6.18 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 7.99 GB
Memory Used: 1.56 GB(19.4738%)
Memory Avail.: 6.44 GB
--------------------------------------------------------------------------------

Starting Repairs...
   Start (7/16/2014 3:18:20 PM)

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (7/16/2014 3:18:28 PM)
   Running Repair Under Current User Account
   Done (7/16/2014 3:22:12 PM)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (7/16/2014 3:22:12 PM)
   Running Repair Under System Account
   Done (7/16/2014 3:22:16 PM)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (7/16/2014 3:22:16 PM)
   Running Repair Under System Account
   Done (7/16/2014 3:22:19 PM)

03 - Reset Service Permissions
   Start (7/16/2014 3:22:19 PM)
   Running Repair Under System Account
   Done (7/16/2014 3:22:24 PM)

04 - Register System Files
   Start (7/16/2014 3:22:24 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:24:28 PM)

05 - Repair WMI
   Start (7/16/2014 3:24:28 PM)

   Starting Security Center So We Can Export The Security Info.

   Exporting Antivirus Info...
   Norton 360 Exported.

   Exporting AntiSpyware Info...
   Norton 360 Exported.
   Windows Defender Exported.

   Exporting 3rd Party Firewall Info...
   Norton 360 Exported.

   Running Repair Under Current User Account
   Done (7/16/2014 3:36:21 PM)

06 - Repair Windows Firewall
   Start (7/16/2014 3:36:21 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:37:11 PM)

07 - Repair Internet Explorer
   Start (7/16/2014 3:37:11 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:39:48 PM)

08 - Repair MDAC/MS Jet
   Start (7/16/2014 3:39:48 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:40:18 PM)

09 - Repair Hosts File
   Start (7/16/2014 3:40:18 PM)
   Running Repair Under System Account
   Done (7/16/2014 3:40:21 PM)

10 - Remove Policies Set By Infections
   Start (7/16/2014 3:40:21 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:40:28 PM)

11 - Repair Start Menu Icons Removed By Infections
   Start (7/16/2014 3:40:28 PM)
   Running Repair Under System Account
   Done (7/16/2014 3:40:31 PM)

12 - Repair Icons
   Start (7/16/2014 3:40:31 PM)
   Running Repair Under Current User Account
   Done (7/16/2014 3:40:35 PM)

13 - Repair Winsock & DNS Cache
   Start (7/16/2014 3:40:35 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:41:40 PM)

15 - Repair Proxy Settings
   Start (7/16/2014 3:41:41 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:41:47 PM)

17 - Repair Windows Updates
   Start (7/16/2014 3:41:47 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:43:40 PM)

18 - Repair CD/DVD Missing/Not Working
   Start (7/16/2014 3:43:40 PM)
   iTunes not found, not applying UpperFilters iTunes Reg Key
   Done (7/16/2014 3:43:40 PM)

19 - Repair Volume Shadow Copy Service
   Start (7/16/2014 3:43:40 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:44:28 PM)

21 - Repair MSI (Windows Installer)
   Start (7/16/2014 3:44:28 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:44:53 PM)

23.01 - Repair bat Association
   Start (7/16/2014 3:44:53 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:00 PM)

23.02 - Repair cmd Association
   Start (7/16/2014 3:45:00 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:06 PM)

23.03 - Repair com Association
   Start (7/16/2014 3:45:06 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:12 PM)

23.04 - Repair Directory Association
   Start (7/16/2014 3:45:12 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:19 PM)

23.05 - Repair Drive Association
   Start (7/16/2014 3:45:19 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:25 PM)

23.06 - Repair exe Association
   Start (7/16/2014 3:45:25 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:31 PM)

23.07 - Repair Folder Association
   Start (7/16/2014 3:45:31 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:38 PM)

23.08 - Repair inf Association
   Start (7/16/2014 3:45:38 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:44 PM)

23.09 - Repair lnk (Shortcuts) Association
   Start (7/16/2014 3:45:44 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:50 PM)

23.10 - Repair msc Association
   Start (7/16/2014 3:45:50 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:45:57 PM)

23.11 - Repair reg Association
   Start (7/16/2014 3:45:57 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:46:03 PM)

23.12 - Repair scr Association
   Start (7/16/2014 3:46:03 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:46:10 PM)

24 - Repair Windows Safe Mode
   Start (7/16/2014 3:46:10 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:46:16 PM)

25 - Repair Print Spooler
   Start (7/16/2014 3:46:16 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:46:36 PM)

26 - Restore Important Windows Services
   Start (7/16/2014 3:46:36 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:47:08 PM)

27 - Set Windows Services To Default Startup
   Start (7/16/2014 3:47:08 PM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (7/16/2014 3:47:33 PM)

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.0

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.0

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.0

Cleaning up empty logs...

All Selected Repairs Done.
   Done (7/16/2014 3:47:34 PM)
   Total Repair Time: 00:29:16


...YOU MUST RESTART YOUR SYSTEM...
   Running Repair Under Current User Account
 

Link to post
Share on other sites

Reboot into normal mode.

 

 

Full System Scan with Malwarebytes Antimalware


  • If not existing, please download
Malwarebytes Anti-Malware to your desktop. Double-click the downloaded setup file and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following:

  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.

[*]Click Finish.



If the program is already installed:

  • Run Malwarebytes Antimalware
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.


  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

 

 

 

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

Link to post
Share on other sites

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 7/17/2014
Scan Time: 2:05:53 AM
Logfile: MBAM.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.17.04
Rootkit Database: v2014.07.14.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows Vista Service Pack 2
CPU: x64
File System: NTFS
User: Staind

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 332068
Time Elapsed: 17 min, 24 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

--------------------------------------------------

ESET Online Scanner

 

C:\Users\Staind\New prog-Matinance\ccsetup404.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Staind\New prog-Matinance\disk-defrag-setup.exe    Win32/InstallMonetizer.AQ potentially unwanted application
C:\Users\Staind\New prog-Matinance\rcsetup148.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Staind\New prog-Matinance\misc prog\avc-free.exe    Win32/OpenCandy potentially unsafe application
 

Link to post
Share on other sites

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe
  • Hit Scan and wait for the scan to finish.
  • Confirm the message but don´t uncheck anything.
  • Hit Clean
  • When the run is finished, it will open up a text file
  • Please post its contents within your next reply
  • You´ll find the log file at C:\AdwCleaner[s1].txt also




Delete junk with JRT

thisisujrt.gif Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.





SecurityCheck

Reboot your system before starting!

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

Link to post
Share on other sites

# AdwCleaner v3.216 - Report created 17/07/2014 at 14:27:50
# Updated 17/07/2014 by Xplode
# Operating System : Windows Vista Home Premium Service Pack 2 (64 bits)
# Username : Staind - STAIND-PC
# Running from : C:\Users\Staind\Desktop\adwcleaner_3.216.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\Users\Staind\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.dubb\searchplugins\safesearch.xml

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16561


-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Staind\AppData\Roaming\Mozilla\Firefox\Profiles\febeprof.dubb\prefs.js ]


*************************

AdwCleaner[R0].txt - [1054 octets] - [17/07/2014 14:27:50]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1114 octets] ##########
 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista Home Premium x64
Ran by Staind on Thu 07/17/2014 at 14:43:50.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{98832D62-C884-40EE-88AE-B04E2D1B479F}



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Staind\AppData\Roaming\mozilla\firefox\profiles\febeprof.dubb\minidumps [39 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 07/17/2014 at 15:03:31.93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

 Results of screen317's Security Check version 0.99.85  
 Windows Vista Service Pack 2 x64 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Norton 360    
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 60  
 Adobe Flash Player     14.0.0.145  
 Adobe Reader 10.1.10 Adobe Reader out of Date!  
 Mozilla Firefox (30.0)
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````
 

Link to post
Share on other sites

Your system is clean now! :)

 

 

Adobe Reader out of date

Your Adobe Reader is outdated. We will fix this.


  • Get the actual software from here. Important: Uncheck any optional software (for example Google Chrome, etc.) offered.
  • Run setup and follow the instructions.
  • Click upon Start-->control panel-->add/remove programs.
  • Search for and remove any older reader versions.

 

 

 

Uninstall our tools using delfix

Please follow these steps in order:

  1. In the case we used Defogger to turn off your CD emulation software. You can start it again and use the Enable button.
  2. In the case we used Combofix. Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time. You shall be noted that Combofix has been removed.
  3. In any case please download delfix to your desktop.
    • Close all other programms and start delfix.
    • Please check all the boxes and run the tool.
    • delfix will now delete all found traces of our removal process

[*] If there is still something left please delete it manualy.





Delete System Restore Points

To ensure your System Restore Points are free of malware, we will delete all of them but the most recent or create a new one.

On Windows Vista: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows 7/8: Please follow these instructions to delete all but the most common System Protection Restore Points.
On Windows XP: Please follow these instructions to delete all but the most common System Protection Restore Points.




Temp File Cleaner

We need to download Temp File Cleaner (TFC) by OldTimer:

  • Please download TFC.exe by Oldtimer at one of the two links: Link 1 Link 2
  • Save and close all running applications
  • Double-click on TFC.exe to run the program
  • Click on Start to begin the cleaning process note: this program may close running applications, make your screen disappear temporarily, or require a reboot of your PC - this is normal and part of the cleanup
  • When the scan is complete, if you were not asked to reboot the computer, please do so now

More Information can be found about the tool here: http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

 

 

 

Recommendations: How to protect yourself

  • System Updates
    Please ensure to have automatic updates activated in your control panel.
    For further information and a tutorial, see this Microsoft Support article.
  • Protection
    What you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.
    Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.
    • To keep your browser free of advertising, you may install the Adblock Plus browser extension.
      It will filter unwanted advertising out of the website´s content.
    • To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.
      It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.
      In addition, before accessing a dangerous classified web site, a warning screen is displayed.

    [*]Up to date Software
    Keep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:

    [*]Backup
    Hardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system. [*]Behaviour
    The commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help if you aren´t careful enough.

    • While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware.
    • Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything.
    • When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system.
    • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
      They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.



Link to post
Share on other sites

That can have multiple reasons.

Something tried to address a system file on your computer on a random port.

The origin of the IP is in Kuala Lumpur, Malaysia.

 

It could have been malicious, but also a misleaded tcp connection because several system files were faulty on your computer.

Link to post
Share on other sites

TY for answer,like I said before scanned with 5 scanner before coming here and wanted to rule out trojan as that is what i suspected was the culprit,but since everything came out clean I am at a loss,anything else you know of I could try to find

cause?

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.