Jump to content

i have a virus msbackup.exe its not geting deleted


Recommended Posts

i am posting my hijack this log

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:07:05 PM, on 28-Jul-10

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Program Files\Soluto\soluto.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=Userinit.exe,C:\Program Files\Soluto\soluto.exe /userinit

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

O9 - Extra button: (no name) - {0000036B-C524-4050-81A0-243669A86B9F} - (no file)

O9 - Extra button: (no name) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - (no file)

O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra button: (no name) - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.1.27.dll/206 (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{19B21E10-27ED-4927-9D82-ADF2C4470867}: NameServer = 120.138.96.18 120.138.98.18

O17 - HKLM\System\CS1\Services\Tcpip\..\{19B21E10-27ED-4927-9D82-ADF2C4470867}: NameServer = 120.138.96.18 120.138.98.18

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe

O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Joulemeter Service - Unknown owner - C:\Program Files\Microsoft Research\Joulemeter\JoulemeterService.exe (file missing)

O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Soluto PCGenome Core Service (SolutoService) - Soluto - C:\Program Files\Soluto\SolutoService.exe

O23 - Service: waudit - ASM Software LLC - C:\Windows\ASMBB\win32\waudit.exe

--

End of file - 6917 bytes

Link to post
Share on other sites

Hi,

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
    Click me
    If you can't disable them then just continue on.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Link to post
Share on other sites

as you told i did run scan and attaching the txt file.

Hi,

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
    Click me
    If you can't disable them then just continue on.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

ComboFix.txt

Link to post
Share on other sites

Hi,

Please do not attach your logs as it is harder for me to read them that way. Post them instead:

ComboFix 10-08-11.05 - ankit 31-Jul-10 17:52:20.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1918.1003 [GMT 5.5:30]

Running from: c:\users\ankit\Downloads\ComboFix.exe

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\mslogfiles.txt

c:\program files\Common Files\Microsoft Shared\MSInfo\2010.txt

c:\programdata\pswi_preloaded.exe

C:\svc.log

c:\windows\calcs.exe

c:\windows\encoder.txt

c:\windows\Help\nvwcipess.hlp

c:\windows\sndvols.exe

c:\windows\system32\6cA.dat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_osppsvc

((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-31 )))))))))))))))))))))))))))))))

.

2010-08-06 14:05 . 2010-08-06 14:05 -------- d-----w- c:\users\ankit\AppData\Roaming\BitDefender

2010-08-06 14:03 . 2010-08-06 15:02 -------- d-----w- c:\programdata\BitDefender

2010-08-06 14:03 . 2010-08-06 15:02 -------- d-----w- c:\program files\BitDefender

2010-08-06 14:00 . 2010-08-06 14:00 -------- d-----w- c:\windows\system32\URTTEMP

2010-08-06 13:55 . 2010-08-06 15:02 -------- d-----w- c:\program files\Common Files\BitDefender

2010-08-05 15:28 . 2010-08-05 15:28 235807 ----a-w- c:\windows\system32\sndvol32.exe

2010-08-03 15:43 . 2010-08-03 15:43 -------- d-----w- c:\users\ankit\AppData\Roaming\SunlitGreen

2010-08-03 15:43 . 2010-08-03 15:43 -------- d-----w- c:\program files\SunlitGreen

2010-08-03 15:30 . 2010-08-03 15:35 -------- d-----w- c:\users\ankit\AppData\Roaming\Trillian

2010-08-03 15:30 . 2010-07-30 16:13 -------- d-----w- c:\program files\Trillian

2010-08-02 16:33 . 2010-08-02 16:33 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-08-02 16:32 . 2010-08-02 16:32 -------- d-----w- c:\programdata\Symantec

2010-08-02 16:20 . 2010-08-02 16:20 -------- d-----w- c:\users\ankit\AppData\Local\Tific

2010-08-02 16:20 . 2010-08-02 16:20 -------- d-----w- c:\users\ankit\AppData\Roaming\Tific

2010-08-02 16:20 . 2010-08-06 15:53 -------- d-----w- c:\programdata\Norton

2010-08-02 16:19 . 2010-08-02 16:20 -------- d-----w- c:\programdata\NortonInstaller

2010-08-01 09:20 . 2010-08-01 09:21 -------- d-----w- c:\users\ankit\AppData\Roaming\Armagetron

2010-08-01 09:20 . 2010-08-01 09:21 -------- d-----w- c:\program files\Armagetron Advanced

2010-08-01 09:20 . 2010-08-01 09:20 -------- d-----w- c:\programdata\Armagetron

2010-07-31 12:50 . 2010-07-31 12:50 -------- d-----w- C:\Device

2010-07-31 12:41 . 2010-07-31 12:52 -------- d-----w- c:\users\ankit\AppData\Local\temp

2010-07-31 12:41 . 2010-07-31 12:41 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-07-31 12:41 . 2010-07-31 12:41 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp

2010-07-31 12:41 . 2010-07-31 12:41 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2010-07-30 15:15 . 2010-06-19 06:23 37376 ----a-w- c:\windows\system32\rtutils.dll

2010-07-30 15:14 . 2010-06-19 04:07 2326016 ----a-w- c:\windows\system32\win32k.sys

2010-07-29 06:06 . 2010-07-29 06:06 -------- d-----w- c:\users\ankit\AppData\Roaming\SecurityHeroes

2010-07-29 06:05 . 2010-06-29 18:40 2080768 ----a-w- c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\extensions\ozymandias@securityheroes.com\components\ozymandias-ff.dll

2010-07-28 16:34 . 2010-07-28 16:34 388096 ----a-r- c:\users\ankit\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-07-28 16:34 . 2010-07-28 16:34 -------- d-----w- c:\program files\Trend Micro

2010-07-27 12:21 . 2010-06-28 20:39 312912 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2010-07-27 12:21 . 2010-06-28 20:39 99280 ----a-w- c:\windows\system32\drivers\aswFW.sys

2010-07-27 12:21 . 2010-06-28 20:38 188168 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2010-07-27 12:21 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr

2010-07-27 12:21 . 2010-06-28 20:10 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2010-07-27 07:35 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-07-27 07:35 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-07-27 07:35 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-07-27 07:35 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-07-27 07:35 . 2010-06-28 20:32 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2010-07-27 07:35 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-07-27 07:35 . 2010-07-27 07:35 -------- d-----w- c:\programdata\Alwil Software

2010-07-27 07:35 . 2010-07-27 07:35 -------- d-----w- c:\program files\Alwil Software

2010-07-24 14:00 . 2010-08-06 15:53 -------- d-----w- c:\program files\Rainmeter

2010-07-23 14:26 . 2010-04-09 07:24 240008 ----a-w- c:\windows\system32\drivers\netio.sys

2010-07-23 14:11 . 2010-07-23 14:11 -------- d-----w- c:\users\ankit\AppData\Roaming\Download Manager

2010-07-23 13:49 . 2010-07-23 13:49 -------- d-----w- c:\program files\UlisesSoft

2010-07-23 11:22 . 2010-08-06 15:53 -------- d-----w- c:\program files\wamp

2010-07-22 15:34 . 2010-07-22 15:34 -------- d-----w- c:\program files\Apache Software Foundation

2010-07-21 11:46 . 2010-07-21 11:46 -------- d-----w- c:\program files\Common Files\Java

2010-07-21 11:34 . 2010-07-21 11:34 -------- d-----w- c:\users\ankit\AppData\Roaming\Qualys

2010-07-21 11:33 . 2010-07-13 06:47 230720 ----a-w- c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\extensions\{7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D}\plugins\npqbc.dll

2010-07-17 11:32 . 2010-07-17 11:32 -------- d-----w- c:\windows\system32\Wat

2010-07-16 09:54 . 2010-07-17 14:58 -------- d-----w- c:\users\ankit\AppData\Roaming\FileZilla

2010-07-16 09:50 . 2010-07-16 09:50 -------- d-----w- c:\program files\FileZilla FTP Client

2010-07-15 15:32 . 2010-07-15 15:32 -------- d-----w- c:\program files\Unlocker

2010-07-13 15:21 . 2010-07-13 15:23 -------- d-----w- c:\users\ankit\AppData\Roaming\FTWeak

2010-07-11 11:13 . 2010-07-11 11:13 -------- d-----w- c:\program files\iPod

2010-07-11 11:13 . 2010-07-11 11:14 -------- d-----w- c:\program files\iTunes

2010-07-11 11:10 . 2010-07-11 11:10 -------- d-----w- c:\program files\QuickTime

2010-07-11 11:08 . 2010-07-11 11:08 -------- d-----w- c:\program files\Bonjour

2010-07-08 14:55 . 2010-07-08 15:21 -------- d-----w- c:\users\ankit\AppData\Roaming\TeamViewer

2010-07-08 14:54 . 2010-07-08 14:54 -------- d-----w- c:\program files\TeamViewer

2010-07-08 11:27 . 2010-07-08 11:27 189920 ---ha-w- c:\windows\system32\mlfcache.dat

2010-07-08 10:07 . 2010-07-08 10:07 -------- d-----w- c:\users\ankit\AppData\Local\ESET

2010-07-08 09:41 . 2010-07-08 09:41 41216 ----a-w- c:\windows\system32\drivers\KHCAP.sys

2010-07-08 09:41 . 2010-07-08 09:41 -------- d-----w- c:\windows\ASMBB

2010-07-08 08:13 . 2010-07-08 08:13 -------- d-----w- c:\program files\ESET

2010-07-07 13:53 . 2010-07-08 05:21 -------- d-----w- c:\users\ankit\AppData\Local\Yahoo

2010-07-07 13:50 . 2010-07-07 13:53 -------- d-----w- c:\users\ankit\AppData\Roaming\Yahoo!

2010-07-07 13:44 . 2010-07-29 15:46 -------- d-----w- c:\programdata\Yahoo!

2010-07-07 13:44 . 2010-06-01 04:58 607544 ----a-w- c:\programdata\Yahoo!\YUpdater\yupdater.exe

2010-07-07 13:32 . 2010-07-29 15:46 -------- d-----w- c:\program files\Yahoo!

2010-07-03 13:24 . 2010-07-27 15:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2010-07-03 13:24 . 2010-07-04 08:11 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-07-02 13:24 . 2010-04-27 06:26 19496 ----a-w- c:\windows\system32\drivers\AppleCharger.sys

2010-07-02 13:24 . 2010-04-06 11:00 31272 ----a-w- c:\windows\system32\AppleChargerSrv.exe

2010-07-02 05:25 . 2010-07-02 05:25 -------- d-----w- c:\users\www

2010-07-02 05:25 . 2010-07-02 05:25 -------- d-----w- c:\users\ankit\www

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-07 14:48 . 2010-05-29 15:04 -------- d-----w- c:\users\ankit\AppData\Roaming\ApexDC++

2010-08-06 13:22 . 2010-04-14 01:45 -------- d-----w- c:\program files\CCleaner

2010-07-30 18:00 . 2010-04-02 02:46 -------- d-----w- c:\users\ankit\AppData\Roaming\vlc

2010-07-30 16:19 . 2010-04-01 21:04 -------- d-----w- c:\users\ankit\AppData\Roaming\DC++

2010-07-30 15:15 . 2010-04-02 19:44 -------- d-----w- c:\users\ankit\AppData\Roaming\BitComet

2010-07-30 15:05 . 2010-05-14 17:53 -------- d-----w- c:\users\ankit\AppData\Roaming\uTorrent

2010-07-29 15:49 . 2010-05-29 15:55 -------- d-----w- c:\program files\VS Revo Group

2010-07-29 15:43 . 2010-06-25 15:36 188152 ----a-w- c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\FlashGot.exe

2010-07-29 06:30 . 2010-07-30 15:15 197632 ----a-w- c:\windows\system32\ir32_32.dll

2010-07-29 06:30 . 2010-07-30 15:15 82944 ----a-w- c:\windows\system32\iccvid.dll

2010-07-29 03:41 . 2010-04-03 16:41 2516 --sha-w- c:\programdata\KGyGaAvL.sys

2010-07-29 03:41 . 2010-04-03 16:41 2516 --sha-w- c:\programdata\KGyGaAvL.sys

2010-07-27 07:16 . 2010-07-27 07:16 157008 ----a-w- c:\users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-27 05:56 . 2010-04-01 21:11 157008 ----a-w- c:\users\ankit\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-21 11:46 . 2010-05-04 07:46 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-21 11:45 . 2010-07-21 11:45 49152 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll

2010-07-21 11:45 . 2010-07-21 11:45 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll

2010-07-21 11:45 . 2010-07-21 11:45 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll

2010-07-21 11:45 . 2010-07-21 11:45 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll

2010-07-21 11:45 . 2010-07-21 11:45 45056 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll

2010-07-21 11:45 . 2010-07-21 11:45 40960 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll

2010-07-21 11:45 . 2010-07-21 11:45 341600 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

2010-07-21 11:45 . 2010-07-21 11:45 308808 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll

2010-07-21 11:45 . 2010-07-21 11:45 14848 ----a-w- c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

2010-07-21 11:45 . 2010-04-04 15:02 -------- d-----w- c:\program files\Common Files\Real

2010-07-21 11:45 . 2010-07-21 11:45 -------- d-----w- c:\program files\Common Files\xing shared

2010-07-21 11:44 . 2010-04-04 15:02 -------- d-----w- c:\program files\Real

2010-07-20 05:52 . 2010-04-14 01:40 -------- d-----w- c:\program files\MSECACHE

2010-07-19 05:40 . 2010-04-10 20:17 -------- d-----w- c:\program files\Microsoft

2010-07-19 05:39 . 2010-06-27 05:51 -------- d-----w- c:\program files\DynDNS Updater

2010-07-17 10:38 . 2010-05-14 17:53 -------- d-----w- c:\program files\uTorrent

2010-07-11 11:13 . 2010-04-01 21:08 -------- d-----w- c:\program files\Common Files\Apple

2010-07-09 18:23 . 2010-06-12 16:39 -------- d-----w- c:\programdata\boost_interprocess

2010-07-09 08:23 . 2010-05-09 05:58 -------- d-----w- c:\programdata\regid.1986-12.com.adobe

2010-07-09 08:17 . 2010-04-14 05:45 -------- d-----w- c:\program files\Common Files\Adobe

2010-07-06 07:27 . 2010-04-01 21:27 -------- d-----w- c:\program files\ATI

2010-07-06 07:27 . 2010-04-01 21:27 -------- d-----w- c:\program files\ATI Technologies

2010-07-06 06:43 . 2010-04-01 21:28 -------- d-----w- c:\users\ankit\AppData\Roaming\ATI

2010-07-06 06:09 . 2010-05-29 15:04 -------- d-----w- c:\program files\ApexDC++

2010-07-02 13:24 . 2010-04-02 01:26 -------- d-----w- c:\program files\GIGABYTE

2010-07-02 13:24 . 2010-04-01 21:26 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-01 04:56 . 2010-05-24 18:39 -------- d-----w- c:\users\ankit\AppData\Roaming\Youtube Downloader HD

2010-06-30 06:25 . 2010-07-30 15:15 978432 ----a-w- c:\windows\system32\wininet.dll

2010-06-27 05:57 . 2010-06-27 05:57 -------- d-----w- c:\program files\No-IP

2010-06-27 05:51 . 2010-06-27 05:51 -------- d-----w- c:\users\ankit\AppData\Roaming\Kana Solution

2010-06-26 05:05 . 2010-04-10 20:16 -------- d-----w- c:\program files\Windows Live

2010-06-25 05:44 . 2010-05-01 13:27 -------- d-----w- c:\users\ankit\AppData\Roaming\Windows Live Writer

2010-06-22 02:47 . 2010-07-30 15:15 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-22 02:47 . 2010-07-30 15:15 307200 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-06-22 02:47 . 2010-07-30 15:15 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-06-19 14:41 . 2010-06-19 14:41 6544 ------w- C:\bootsqm.dat

2010-06-19 06:33 . 2010-07-30 15:15 3955080 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-06-19 06:33 . 2010-07-30 15:15 3899784 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-06-16 05:48 . 2010-07-30 15:15 224256 ----a-w- c:\windows\system32\schannel.dll

2010-06-15 14:31 . 2010-06-15 14:31 72504 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe

2010-06-14 06:12 . 2010-07-30 15:15 1286016 ----a-w- c:\windows\system32\drivers\tcpip.sys

2010-06-10 15:21 . 2010-06-10 15:21 900608 ----a-r- c:\users\ankit\AppData\Roaming\Microsoft\Installer\{7AAA27E4-CDB3-49C0-AA2D-41827C001BA3}\StartMenuIcon.exe

2010-06-09 15:31 . 2010-06-09 15:32 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2010-06-09 15:31 . 2010-06-09 15:31 138184 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2010-06-09 15:31 . 2010-06-09 15:31 183112 ----a-w- c:\windows\system32\PnkBstrB.exe

2010-06-09 15:26 . 2010-06-09 15:26 -------- d--h--r- c:\users\ankit\AppData\Roaming\SecuROM

2010-06-09 15:25 . 2010-06-09 15:25 -------- d-----w- c:\users\ankit\AppData\Roaming\Leadertech

2010-06-08 06:02 . 2010-07-30 15:15 1233920 ----a-w- c:\windows\system32\msxml3.dll

2010-06-07 12:03 . 2010-06-07 12:03 49016 ----a-w- c:\windows\system32\sirenacm.dll

2010-06-07 11:49 . 2010-06-07 11:49 297328 ----a-w- c:\windows\WLXPGSS.SCR

2010-06-06 15:34 . 2010-05-03 07:36 -------- d-----w- c:\users\ankit\AppData\Roaming\Dropbox

2010-06-06 15:29 . 2010-05-03 07:36 91387 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\Uninstall.exe

2010-06-05 17:15 . 2010-04-22 16:00 -------- d-----w- c:\program files\Microsoft Visual Studio 10.0

2010-06-05 17:14 . 2010-04-22 16:00 -------- d-----w- c:\program files\Microsoft SDKs

2010-06-05 17:12 . 2010-04-22 16:02 547296 ----a-w- c:\programdata\Microsoft\VWDExpress\10.0\1033\ResourceCache.dll

2010-06-05 17:10 . 2010-05-30 15:30 -------- d-----w- c:\program files\Valve

2010-06-05 17:09 . 2010-06-01 15:32 -------- d-----w- c:\program files\Opera

2010-06-05 16:36 . 2010-06-05 16:36 -------- d-----w- c:\program files\Recuva

2010-06-05 16:35 . 2010-06-05 16:35 -------- d-----w- c:\program files\Speccy

2010-06-05 16:20 . 2010-04-01 21:10 -------- d-----w- c:\users\ankit\AppData\Roaming\Apple Computer

2010-06-04 15:54 . 2010-05-28 18:32 -------- d-----w- c:\programdata\Soluto

2010-06-04 15:49 . 2010-04-23 06:51 -------- d-----w- c:\program files\Microsoft Silverlight

2010-06-04 15:45 . 2010-06-04 15:24 -------- d-----w- c:\users\ankit\AppData\Roaming\Nero

2010-06-04 15:31 . 2010-06-04 15:31 -------- d-----w- c:\program files\Soluto

2010-06-04 15:24 . 2010-05-28 18:32 892680 ----a-w- c:\programdata\Soluto\Installer\SolutoInstaller.exe

2010-06-04 15:20 . 2010-06-04 15:08 -------- d-----w- c:\program files\Common Files\Nero

2010-06-04 15:17 . 2010-06-04 15:09 -------- d-----w- c:\program files\Nero

2010-06-04 15:14 . 2010-06-04 15:08 -------- d-----w- c:\programdata\Nero

2010-06-02 08:11 . 2010-06-04 15:31 179144 ----a-w- c:\windows\system32\drivers\PCGenFAM.sys

2010-06-02 06:49 . 2010-04-01 21:26 -------- d-----w- c:\program files\Common Files\InstallShield

2010-06-01 16:12 . 2010-06-01 16:12 -------- d-----w- c:\users\ankit\AppData\Roaming\adma

2010-06-01 14:41 . 2010-06-01 14:41 -------- d-----w- c:\programdata\InstallShield

2010-05-29 19:07 . 2010-05-29 19:07 223440 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2010-05-28 02:53 . 2010-05-28 02:53 21553824 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\Dropbox.exe

2010-05-28 01:03 . 2010-05-28 01:03 94208 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

2010-05-27 07:24 . 2010-06-18 03:38 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-05-27 03:49 . 2010-06-18 03:38 293888 ----a-w- c:\windows\system32\atmfd.dll

2010-05-26 07:29 . 2010-05-26 07:29 213376 ----a-w- c:\windows\system32\LIVESSP.DLL

2010-05-26 07:09 . 2010-05-26 07:09 17816 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2010-05-23 12:20 . 2010-06-25 15:40 73216 ----a-w- c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll

2010-05-21 08:44 . 2010-04-01 20:44 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-05-18 11:05 . 2010-05-18 11:05 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-05-18 11:05 . 2010-05-18 11:05 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-05-18 03:39 . 2010-05-21 06:22 880640 ----a-w- c:\windows\PenyuLocker.exe

2010-05-09 16:00 . 2010-07-27 07:15 38784 ----a-w- c:\users\Administrator\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2010-04-25 11:12 . 2010-04-22 09:03 88 --sha-r- c:\windows\System32\9A9BBB0C61.sys

2010-04-25 11:12 . 2010-04-22 09:03 2516 --sha-w- c:\windows\System32\KGyGaAvL.sys

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

2009-11-04 04:12 556432 ----a-w- c:\progra~1\MICROS~2\Office14\URLREDIR.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2010-05-28 01:03 94208 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2010-05-28 01:03 94208 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2010-05-28 01:03 94208 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2010-05-28 01:03 94208 ----a-w- c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]

@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"

[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]

2010-06-28 20:59 153184 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-07-21 202256]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\system32\userinit.exe,c:\program files\Soluto\soluto.exe /userinit"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2010-06-01 04:47 5252408 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]

2010-05-10 08:42 439568 ----a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2009-08-18 11:15 7711264 ------w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 06:14 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-07-21 11:44 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"FTweakFCleaner"=c:\program files\FCleaner\FCleaner.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SwitchBoard"=c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

R0 PCGenFAM;PCGenFAM;c:\windows\system32\DRIVERS\PCGenFAM.sys [2010-06-02 179144]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 Joulemeter Service;Joulemeter Service;c:\program files\Microsoft Research\Joulemeter\JoulemeterService.exe [x]

R3 ALSysIO;ALSysIO;c:\users\ankit\AppData\Local\Temp\ALSysIO.sys [x]

R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [2010-04-06 31272]

R3 KHCAP;KHCap Packet Driver (KHCAP);c:\windows\system32\drivers\KHCAP.sys [2010-07-08 41216]

R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [2010-04-11 266544]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-04-29 20952]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2009-10-29 30603640]

R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]

R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]

R3 RDPDISPM;RDPDISPM;c:\windows\system32\DRIVERS\rdpdispm.sys [2010-02-09 15488]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-17 1343400]

R3 waudit;waudit;c:\windows\ASMBB\win32\waudit.exe [2010-07-08 1056768]

R4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]

R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]

R4 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]

R4 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R4 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]

R4 wlcrasvc;Windows Live Devices remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-06-04 49504]

S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2010-06-28 12112]

S0 aswNdis2;avast! Firewall Core Firewall Service; [x]

S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 19496]

S1 aswFW;avast! TDI Firewall driver; [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]

S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [2010-06-28 119200]

S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2010-06-02 338464]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-30 187392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

iissvcs REG_MULTI_SZ w3svc was

apphost REG_MULTI_SZ apphostsvc

.

Contents of the 'Scheduled Tasks' folder

2010-07-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1685506746-2323859148-3346240965-1000Core.job

- c:\users\ankit\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 21:03]

2010-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1685506746-2323859148-3346240965-1000UA.job

- c:\users\ankit\AppData\Local\Google\Update\GoogleUpdate.exe [2010-04-01 21:03]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.in/

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

TCP: {19b21e10-27ed-4927-9d82-adf2c4470867} = 120.138.96.18 120.138.98.18

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

FF - ProfilePath - c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxps://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - component: c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\components\FFGlobalExtension.dll

FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\progra~1\MICROS~2\Office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\MICROS~2\Office14\NPSPWRAP.DLL

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: c:\users\ankit\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\users\ankit\AppData\Roaming\Mozilla\Firefox\Profiles\utfjvt6f.default\extensions\{7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D}\plugins\npqbc.dll

FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

SafeBoot-MCODS

MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\msseces.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(4072)

c:\users\ankit\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

c:\progra~1\SPYBOT~1\SDHelper.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\windows\system32\conhost.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\PSIService.exe

c:\program files\Common Files\Protexis\License Service\PsiService_2.exe

.

**************************************************************************

.

Completion time: 2010-07-31 18:27:08 - machine was rebooted

ComboFix-quarantined-files.txt 2010-07-31 12:57

Pre-Run: 22,237,933,568 bytes free

Post-Run: 23,450,058,752 bytes free

- - End Of File - - FF627E11BEA0A140B1C78A26EAED00F5

Link to post
Share on other sites

Hi,

Download TFC to your desktop

  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start Malwarebytes' Anti-Malware

  • Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
  • Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.