An infection causes IE and Firefox redirect to a different home page

garciamaki · October 13, 2010

Hi, every time I open Internet Explorer or Firefox I get redirected to a different home page -- hxxp://shop.thefreevpn.home.php --. For approximately two seconds I get redirected to a wrong home page, but then something prevent it and I get back to my selected homepage. Even if the browsers get back to the right home page I do not like the idea of my pc being infected with something that is trying to redirect my browsers home pages --maybe the infection goes beyond than simply trying to redirect my browsers--. I have tried many different solutions posted in different forums but I have not been able to remove the problem. Both DDS and Malwarebites log are posted below. The "attach" and "ark" files are attached.

Thanks!

DDS (Ver_10-10-10.03) - NTFSx86

Run by Juan at 18:43:46.91 on Mon 10/11/2010

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.2211 [GMT -4:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Windows\System32\StikyNot.exe

C:\Program Files\NETGEAR\WNDA3100v2\WNDA3100v2.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k HsfXAudioService

C:\Windows\system32\lxducoms.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\NETGEAR\WNDA3100v2\WifiSvc.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Users\Juan\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe

mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui

mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wnda3100v2\WNDA3100v2.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49}

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

TCP: {0E696C8F-DA75-4501-BFAF-71ABA3F46BE7} = 206.248.95.217,206.248.79.242

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\juan\appdata\roaming\mozilla\firefox\profiles\71u4lwgu.default\

FF - prefs.js: browser.startup.homepage - hxxp://shop.thefreevpn.com/home.php

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=

FF - component: c:\users\juan\appdata\roaming\mozilla\firefox\profiles\71u4lwgu.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\drivers\SCMNdisP.sys [2010-9-24 21728]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-28 165584]

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2010-9-10 236088]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-9-10 30112]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-28 17744]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-28 50768]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-28 40384]

R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]

R2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe -service --> c:\windows\system32\lxducoms.exe -service [?]

R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-23 370688]

R2 WSWNDA3100;WSWNDA3100;c:\program files\netgear\wnda3100v2\WifiSvc.exe [2010-9-24 278528]

R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-28 40384]

R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-28 40384]

R3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\drivers\bcmwlhigh6.sys [2010-9-24 699896]

R3 DKRtWrt;DKRtWrt;c:\windows\system32\drivers\DKRtWrt.sys [2010-9-27 45616]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxduserv.exe [2010-9-30 94208]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\drivers\BrSerIb.sys [2009-7-13 265088]

S3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\drivers\BrUsbSIb.sys [2009-7-13 11904]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-10-2 27192]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-9-23 1343400]

=============== Created Last 30 ================

2010-10-11 14:18:34 -------- d-----w- c:\program files\Trend Micro

2010-10-08 14:55:48 6084944 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{8725c3f2-88c6-4b1e-a8c1-d86beabde9d7}\mpengine.dll

2010-10-06 19:09:30 -------- d-----w- c:\program files\EASEUS

2010-10-06 18:22:51 -------- d-----w- c:\progra~2\Sunbelt

2010-10-06 18:22:42 -------- d-----w- c:\users\juan\appdata\roaming\Sunbelt

2010-10-06 18:20:21 -------- d-----w- c:\program files\Sunbelt Software

2010-10-06 15:12:34 -------- d-----w- c:\program files\e-Sword

2010-10-06 15:12:34 -------- d-----w- c:\program files\common files\EzTools

2010-10-06 15:11:49 -------- d-----w- c:\users\juan\appdata\local\Downloaded Installations

2010-10-04 13:19:59 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll

2010-10-04 12:02:12 -------- d-----w- c:\program files\Activision

2010-10-04 11:45:52 230736 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2010-10-04 11:45:34 -------- d-----w- c:\program files\TrueCrypt

2010-10-02 16:32:55 -------- d-----w- c:\program files\COMODO

2010-10-02 16:27:40 -------- d-----w- c:\program files\Alcohol Soft

2010-10-02 16:18:12 436792 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-10-02 14:04:54 -------- d-----w- c:\users\juan\appdata\local\VS Revo Group

2010-10-02 14:04:33 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys

2010-10-02 14:04:32 -------- d-----w- c:\program files\VS Revo Group

2010-10-02 13:39:37 -------- d-----w- c:\progra~2\Lexmark 5600-6600 Series

2010-10-01 22:39:47 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys

2010-10-01 20:23:34 2048 ----a-w- c:\windows\system32\tzres.dll

2010-10-01 20:23:11 13312 ----a-w- c:\program files\internet explorer\iecompat.dll

2010-09-30 12:45:46 -------- d-----w- c:\progra~2\lx_cats

2010-09-30 12:45:03 155648 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\lxdudrpp.dll

2010-09-30 12:44:01 40960 ----a-w- c:\windows\system32\lxduvs.dll

2010-09-30 12:44:01 323584 ----a-w- c:\windows\system32\lxduih.exe

2010-09-30 12:44:00 1069056 ----a-w- c:\windows\system32\lxduserv.dll

2010-09-30 12:43:58 761856 ----a-w- c:\windows\system32\lxducomc.dll

2010-09-30 12:43:58 651264 ----a-w- c:\windows\system32\lxdupmui.dll

2010-09-30 12:43:58 577536 ----a-w- c:\windows\system32\lxdulmpm.dll

2010-09-30 12:43:58 376832 ----a-w- c:\windows\system32\lxducomm.dll

2010-09-30 12:43:58 364544 ----a-w- c:\windows\system32\lxduinpa.dll

2010-09-30 12:43:58 339968 ----a-w- c:\windows\system32\lxduiesc.dll

2010-09-30 12:43:57 860160 ----a-w- c:\windows\system32\lxduusb1.dll

2010-09-30 12:43:57 684032 ----a-w- c:\windows\system32\lxduhbn3.dll

2010-09-30 12:43:57 364544 ----a-w- c:\windows\system32\lxducfg.exe

2010-09-30 12:43:57 208896 ----a-w- c:\windows\system32\lxdugrd.dll

2010-09-30 12:42:57 1036288 ----a-w- c:\windows\system32\lxdudrs.dll

2010-09-30 12:42:57 -------- d-----w- c:\progra~2\Ezprint

2010-09-30 12:42:56 81920 ----a-w- c:\windows\system32\lxducaps.dll

2010-09-30 12:42:56 69632 ----a-w- c:\windows\system32\lxducnv4.dll

2010-09-30 12:42:47 -------- d-----w- c:\program files\Lexmark Toolbar

2010-09-30 12:42:43 352256 ----a-w- c:\windows\system32\LXDUwupd.dll

2010-09-30 12:42:43 12288 ----a-w- c:\windows\system32\LXDUwupd.exe

2010-09-30 12:42:18 446464 ----a-w- c:\windows\system32\LXDUhcp.dll

2010-09-30 12:42:18 389120 ----a-w- c:\windows\system32\LXDUinst.dll

2010-09-30 12:42:17 77906 ----a-w- c:\windows\system32\LXDUcfg.dll

2010-09-30 12:42:17 589824 ----a-w- c:\windows\system32\lxducoms.exe

2010-09-30 12:42:17 -------- d-----w- c:\program files\Lexmark 5600-6600 Series

2010-09-30 12:41:06 90112 ----a-w- c:\windows\system32\lxducub.dll

2010-09-30 12:41:06 409600 ----a-w- c:\windows\system32\lxducoin.dll

2010-09-30 12:41:06 200704 ----a-w- c:\windows\system32\lxduinsb.dll

2010-09-30 12:41:05 983121 ----a-w- c:\windows\system32\lxdugf.dll

2010-09-30 12:41:05 77824 ----a-w- c:\windows\system32\lxducu.dll

2010-09-30 12:41:05 544768 ----a-w- c:\windows\system32\lxduutil.dll

2010-09-30 12:41:05 36864 ----a-w- c:\windows\system32\lxducur.dll

2010-09-30 12:41:05 176128 ----a-w- c:\windows\system32\lxduins.dll

2010-09-30 12:41:05 106496 ----a-w- c:\windows\system32\lxduinsr.dll

2010-09-30 12:41:04 147456 ----a-w- c:\windows\system32\lxdujswr.dll

2010-09-30 12:41:00 -------- d-----w- C:\drivers

2010-09-29 02:16:04 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2010-09-29 02:15:49 38848 ----a-w- c:\windows\avastSS.scr

2010-09-28 18:46:48 -------- d-----w- c:\program files\Moffsoft FreeCalc

2010-09-28 12:59:34 -------- d-----r- c:\program files\Skype

2010-09-28 12:49:20 -------- d-----w- c:\users\juan\appdata\local\ElevatedDiagnostics

2010-09-27 21:53:37 -------- d-----w- c:\users\juan\appdata\local\Apps

2010-09-27 19:17:47 -------- d-----r- c:\users\juan\Libros

2010-09-27 19:00:37 -------- d-----w- c:\users\juan\appdata\local\Apple Computer

2010-09-27 19:00:30 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-09-27 19:00:30 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-09-27 18:58:34 -------- d-----w- c:\users\juan\appdata\local\Apple

2010-09-27 18:58:09 -------- d-----w- c:\program files\Bonjour

2010-09-27 16:25:07 45616 ----a-w- c:\windows\system32\drivers\DKRtWrt.sys

2010-09-27 16:24:57 -------- d-----w- c:\program files\common files\Diskeeper Corporation

2010-09-27 16:24:57 -------- d-----w- c:\progra~2\Diskeeper Corporation

2010-09-27 16:24:55 -------- d-----w- c:\program files\Windows Home Server

2010-09-27 16:24:55 -------- d-----w- c:\program files\Diskeeper Corporation

2010-09-27 03:16:28 -------- d-----w- c:\windows\system32\appmgmt

2010-09-27 03:01:17 -------- d-----w- c:\program files\download tool

2010-09-27 03:00:33 -------- d-----w- c:\users\juan\appdata\roaming\uTorrent

2010-09-27 02:51:09 -------- d-----w- c:\program files\RegFixerPro

2010-09-27 02:23:37 -------- d-----w- c:\users\juan\appdata\local\RegFixerPro

2010-09-27 02:19:25 -------- d-----w- c:\program files\common files\RegFixerPro

2010-09-26 12:12:29 89600 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL

2010-09-25 13:33:08 -------- d-----w- c:\users\juan\appdata\local\Adobe

2010-09-25 12:28:20 -------- d-----w- c:\users\juan\appdata\roaming\Malwarebytes

2010-09-25 12:28:13 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-25 12:28:12 -------- d-----w- c:\progra~2\Malwarebytes

2010-09-25 12:28:11 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-25 12:28:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-25 12:14:30 -------- d-----w- c:\windows\pss

2010-09-25 03:55:54 -------- d-----w- c:\windows\system32\es

2010-09-25 03:55:54 -------- d-----w- c:\windows\system32\drivers\umdf\es-ES

2010-09-25 03:55:54 -------- d-----w- c:\windows\system32\0C0A

2010-09-25 03:55:52 -------- d-----w- c:\windows\system32\drivers\es-ES

2010-09-25 03:55:44 -------- d-----w- c:\windows\system32\wbem\es-ES

2010-09-25 03:55:31 -------- d-----w- c:\windows\es-ES

2010-09-25 03:55:15 -------- d-----w- c:\windows\fi-FI

2010-09-25 03:54:58 -------- d-----w- c:\windows\system32\XPSViewer

2010-09-25 03:54:56 -------- d-----w- c:\windows\system32\fi

2010-09-25 03:54:56 -------- d-----w- c:\windows\system32\drivers\umdf\fi-FI

2010-09-25 03:54:56 -------- d-----w- c:\windows\system32\drivers\fi-FI

2010-09-25 03:54:51 -------- d-----w- c:\windows\system32\wbem\fi-FI

2010-09-25 02:31:58 3584 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\es-es\LXKPTPRC.DLL.mui

2010-09-25 02:30:19 6084944 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\backup\mpengine.dll

2010-09-25 02:12:30 3584 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\fi-fi\LXKPTPRC.DLL.mui

2010-09-25 02:11:21 84992 ----a-w- c:\windows\system32\drivers\sdbus.sys

2010-09-25 02:11:21 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2010-09-25 01:41:55 1286456 ----a-w- c:\windows\system32\ntdll.dll

2010-09-25 01:41:54 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys

2010-09-25 01:41:53 41984 ----a-w- c:\windows\system32\drivers\usbehci.sys

2010-09-25 01:41:53 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys

2010-09-25 01:41:45 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2010-09-25 01:41:45 85504 ----a-w- c:\windows\system32\secproc_ssp.dll

2010-09-25 01:41:45 369152 ----a-w- c:\windows\system32\secproc.dll

2010-09-25 01:41:45 365568 ----a-w- c:\windows\system32\secproc_isv.dll

2010-09-25 01:41:45 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe

2010-09-25 01:41:45 320512 ----a-w- c:\windows\system32\RMActivate.exe

2010-09-25 01:41:44 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2010-09-25 01:41:44 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

2010-09-24 20:09:07 -------- d-----w- c:\progra~2\MSScanAppDataDir

2010-09-24 20:07:38 30568 ----a-w- c:\windows\system32\mdimon.dll

2010-09-24 20:07:38 30512 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll

2010-09-24 19:45:55 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2010-09-24 19:45:05 -------- d-----w- c:\program files\Microsoft Expression

2010-09-24 19:15:21 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll

2010-09-24 19:15:21 32656 ----a-w- c:\windows\system32\msonpmon.dll

2010-09-24 19:13:50 -------- d-----w- c:\windows\PCHEALTH

2010-09-24 19:11:40 -------- d-----w- c:\users\juan\appdata\local\Microsoft Help

2010-09-24 16:27:38 91376 ----a-w- c:\windows\system32\bcmwlcoi.dll

2010-09-24 16:27:38 699896 ----a-w- c:\windows\system32\drivers\bcmwlhigh6.sys

2010-09-24 16:27:38 3862528 ----a-w- c:\windows\system32\bcmihvsrv.dll

2010-09-24 16:27:38 3551232 ----a-w- c:\windows\system32\bcmihvui.dll

2010-09-24 16:27:37 1176312 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll

2010-09-24 16:27:36 96784 ----a-w- c:\windows\system32\Packet.dll

2010-09-24 16:27:36 53299 ----a-w- c:\windows\system32\pthreadVC.dll

2010-09-24 16:27:36 50704 ----a-w- c:\windows\system32\drivers\npf.sys

2010-09-24 16:27:36 281104 ----a-w- c:\windows\system32\wpcap.dll

2010-09-24 16:27:36 21728 ----a-w- c:\windows\system32\drivers\SCMNdisP.sys

2010-09-24 16:27:36 -------- d-----w- c:\program files\NETGEAR

2010-09-24 02:19:04 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-09-24 02:19:04 -------- d-----w- c:\progra~2\Spybot - Search & Destroy

2010-09-24 01:14:51 -------- d-----w- c:\windows\system32\Wat

2010-09-24 00:55:29 -------- d-----w- c:\program files\Synaptics

2010-09-24 00:51:26 -------- d-----w- c:\program files\CONEXANT

2010-09-24 00:46:09 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-09-24 00:46:09 465408 ----a-w- c:\windows\system32\psisdecd.dll

2010-09-24 00:46:09 417792 ----a-w- c:\windows\system32\msdri.dll

2010-09-24 00:46:09 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-09-24 00:46:09 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-09-24 00:32:40 257024 ----a-w- c:\windows\system32\msv1_0.dll

2010-09-24 00:31:57 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2010-09-24 00:31:57 49472 ----a-w- c:\windows\system32\netfxperf.dll

2010-09-24 00:31:57 297808 ----a-w- c:\windows\system32\mscoree.dll

2010-09-24 00:31:57 295264 ----a-w- c:\windows\system32\PresentationHost.exe

2010-09-24 00:31:57 1130824 ----a-w- c:\windows\system32\dfshim.dll

2010-09-24 00:25:56 740864 ----a-w- c:\windows\system32\inetcomm.dll

2010-09-24 00:25:56 1619968 ----a-w- c:\program files\windows mail\msoe.dll

2010-09-24 00:25:55 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2010-09-24 00:25:55 224256 ----a-w- c:\windows\system32\schannel.dll

2010-09-24 00:25:55 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2010-09-24 00:25:55 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-09-24 00:25:54 37376 ----a-w- c:\windows\system32\rtutils.dll

2010-09-24 00:25:53 34816 ----a-w- c:\windows\system32\msasn1.dll

2010-09-24 00:25:12 70656 ----a-w- c:\windows\system32\fontsub.dll

2010-09-24 00:25:12 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-09-24 00:25:12 293888 ----a-w- c:\windows\system32\atmfd.dll

2010-09-23 23:44:16 -------- d-----w- c:\users\juan\appdata\local\Google

2010-09-23 23:09:33 -------- d-----w- c:\windows\Panther

2010-09-23 23:09:18 -------- d-sh--w- C:\Boot

2010-09-23 22:20:22 -------- d-----w- c:\windows\system32\wbem\Performance

2010-09-23 21:02:52 -------- d-----w- c:\progra~2\NVIDIA Corporation

2010-09-23 21:02:50 -------- d-----w- c:\program files\NVIDIA Corporation

2010-09-23 19:50:57 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-09-23 19:49:03 -------- d-----w- c:\progra~2\Comodo

2010-09-23 19:40:10 -------- d-sh--w- c:\windows\Installer

2010-09-23 19:40:03 -------- d-----w- c:\progra~2\Alwil Software

2010-09-23 19:31:06 172032 ----a-w- c:\windows\system32\wintrust.dll

2010-09-23 19:31:01 132608 ----a-w- c:\windows\system32\cabview.dll

2010-09-23 19:25:37 -------- d-sh--w- C:\Recovery

==================== Find3M ====================

2010-09-11 03:41:40 285480 ----a-w- c:\windows\system32\guard32.dll

2010-09-08 15:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 15:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-08-21 05:32:37 316928 ----a-w- c:\windows\system32\spoolsv.exe

2010-07-29 06:30:49 197632 ----a-w- c:\windows\system32\ir32_32.dll

2010-07-29 06:30:34 82944 ----a-w- c:\windows\system32\iccvid.dll

2010-07-27 22:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-07-27 22:44:10 75040 ----a-w- c:\windows\system32\jdns_sd.dll

2010-07-27 22:44:10 197920 ----a-w- c:\windows\system32\dnssdX.dll

2010-07-27 22:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 18:46:07.51 ===============

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4811

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

10/13/2010 9:41:32 AM

mbam-log-2010-10-13 (09-41-32).txt

Scan type: Quick scan

Objects scanned: 146541

Time elapsed: 6 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Attach.rar

ark.rar

Gammo · October 15, 2010

Hi,

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
Click me
If you can't disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

garciamaki · October 16, 2010

Hi,
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
Click me
If you can't disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Hi Gammo, after running the ComboFix I still have the same problem mentioned in the original post. I should mention that after ComboFix rebooted my pc I was not able to open any of the applications in my pc. After doing a manual reboot everything start to work normally again, don't know if this is a normal thing whenever you use ComboFix... I attached the ComboFix Log.

Thanks for your help!

ComboFix.txt

Gammo · October 16, 2010

Hi,

Please do not attach your logs as it is harder for me to read them that way. Post them instead:

ComboFix 10-10-15.03 - Juan 10/16/2010 10:30:56.2.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.2275 [GMT -4:00]

Running from: c:\users\Juan\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\wpcap.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2010-09-16 to 2010-10-16 )))))))))))))))))))))))))))))))

.

2010-10-16 14:38 . 2010-10-16 14:38 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-10-16 14:29 . 2010-10-16 14:29 -------- d-----w- C:\32788R22FWJFW

2010-10-16 14:02 . 2009-11-06 12:37 699896 ----a-w- c:\windows\system32\drivers\bcmwlhigh6.sys

2010-10-16 14:02 . 2007-01-19 22:20 21728 ----a-w- c:\windows\system32\drivers\SCMNdisP.sys

2010-10-16 14:02 . 2010-10-16 14:02 -------- d-----w- c:\program files\NETGEAR

2010-10-16 14:02 . 2010-10-16 14:02 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-10-15 21:10 . 2010-10-15 21:10 -------- d-----w- c:\programdata\FLEXnet

2010-10-15 21:07 . 2010-10-15 21:07 -------- d-----w- c:\program files\Common Files\Macrovision Shared

2010-10-15 21:07 . 2008-04-07 09:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll

2010-10-15 17:42 . 2010-10-15 17:42 -------- d-----w- c:\program files\YouTube Downloader

2010-10-15 17:39 . 2010-10-15 17:39 -------- d-----w- c:\programdata\McAfee

2010-10-15 12:28 . 2010-10-15 21:08 -------- d-----w- c:\program files\Common Files\Adobe

2010-10-11 14:18 . 2010-10-11 14:18 -------- d-----w- c:\program files\Trend Micro

2010-10-08 14:55 . 2010-09-16 14:24 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8725C3F2-88C6-4B1E-A8C1-D86BEABDE9D7}\mpengine.dll

2010-10-06 19:09 . 2010-10-06 19:09 -------- d-----w- c:\program files\EASEUS

2010-10-06 18:22 . 2010-10-06 18:22 -------- d-----w- c:\programdata\Sunbelt

2010-10-06 18:20 . 2010-10-06 18:58 -------- d-----w- c:\program files\Sunbelt Software

2010-10-06 15:12 . 2010-10-13 12:58 -------- d-----w- c:\program files\e-Sword

2010-10-06 15:12 . 2010-10-06 15:12 -------- d-----w- c:\program files\Common Files\EzTools

2010-10-04 13:19 . 2008-10-27 14:04 514384 ----a-w- c:\windows\system32\XAudio2_3.dll

2010-10-04 12:02 . 2010-10-15 20:50 -------- d-----w- c:\program files\Activision

2010-10-04 11:45 . 2010-10-04 11:45 230736 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2010-10-04 11:45 . 2010-10-04 11:45 -------- d-----w- c:\program files\TrueCrypt

2010-10-02 16:32 . 2010-10-02 16:32 -------- d-----w- c:\program files\COMODO

2010-10-02 16:27 . 2010-10-02 16:27 -------- d-----w- c:\program files\Alcohol Soft

2010-10-02 16:18 . 2010-10-02 16:18 436792 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-10-02 14:04 . 2009-12-30 16:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys

2010-10-02 14:04 . 2010-10-02 14:04 -------- d-----w- c:\program files\VS Revo Group

2010-10-02 13:39 . 2010-10-02 13:39 -------- d-----w- c:\programdata\Lexmark 5600-6600 Series

2010-10-01 22:39 . 2009-11-20 19:26 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys

2010-10-01 20:23 . 2010-06-19 06:15 2048 ----a-w- c:\windows\system32\tzres.dll

2010-10-01 20:23 . 2010-08-27 05:30 13312 ----a-w- c:\program files\Internet Explorer\iecompat.dll

2010-09-30 12:45 . 2010-10-06 17:04 -------- d-----w- c:\programdata\lx_cats

2010-09-30 12:45 . 2010-02-04 08:54 155648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxdudrpp.dll

2010-09-30 12:44 . 2010-02-04 08:54 40960 ----a-w- c:\windows\system32\lxduvs.dll

2010-09-30 12:44 . 2010-02-04 08:29 323584 ----a-w- c:\windows\system32\lxduih.exe

2010-09-30 12:44 . 2010-02-04 08:53 1069056 ----a-w- c:\windows\system32\lxduserv.dll

2010-09-30 12:43 . 2010-02-04 08:53 651264 ----a-w- c:\windows\system32\lxdupmui.dll

2010-09-30 12:43 . 2010-02-04 08:53 364544 ----a-w- c:\windows\system32\lxduinpa.dll

2010-09-30 12:43 . 2010-02-04 08:53 339968 ----a-w- c:\windows\system32\lxduiesc.dll

2010-09-30 12:43 . 2010-02-04 08:53 577536 ----a-w- c:\windows\system32\lxdulmpm.dll

2010-09-30 12:43 . 2010-02-04 08:53 376832 ----a-w- c:\windows\system32\lxducomm.dll

2010-09-30 12:43 . 2010-02-04 08:53 761856 ----a-w- c:\windows\system32\lxducomc.dll

2010-09-30 12:43 . 2010-02-04 08:53 860160 ----a-w- c:\windows\system32\lxduusb1.dll

2010-09-30 12:43 . 2010-02-04 08:53 684032 ----a-w- c:\windows\system32\lxduhbn3.dll

2010-09-30 12:43 . 2010-02-04 08:41 208896 ----a-w- c:\windows\system32\lxdugrd.dll

2010-09-30 12:43 . 2010-02-04 08:29 364544 ----a-w- c:\windows\system32\lxducfg.exe

2010-09-30 12:42 . 2010-09-30 12:42 -------- d-----w- c:\programdata\Ezprint

2010-09-30 12:42 . 2010-02-04 08:52 1036288 ----a-w- c:\windows\system32\lxdudrs.dll

2010-09-30 12:42 . 2010-02-04 08:52 81920 ----a-w- c:\windows\system32\lxducaps.dll

2010-09-30 12:42 . 2010-02-04 08:35 69632 ----a-w- c:\windows\system32\lxducnv4.dll

2010-09-30 12:42 . 2010-09-30 12:42 -------- d-----w- c:\program files\Lexmark Toolbar

2010-09-30 12:42 . 2009-04-28 08:57 352256 ----a-w- c:\windows\system32\LXDUwupd.dll

2010-09-30 12:42 . 2009-04-28 08:56 12288 ----a-w- c:\windows\system32\LXDUwupd.exe

2010-09-30 12:42 . 2009-05-20 20:56 446464 ----a-w- c:\windows\system32\LXDUhcp.dll

2010-09-30 12:42 . 2009-05-20 18:57 389120 ----a-w- c:\windows\system32\LXDUinst.dll

2010-09-30 12:42 . 2010-09-30 13:56 -------- d-----w- c:\program files\Lexmark 5600-6600 Series

2010-09-30 12:42 . 2010-02-04 08:29 589824 ----a-w- c:\windows\system32\lxducoms.exe

2010-09-30 12:42 . 2008-02-21 09:12 77906 ----a-w- c:\windows\system32\LXDUcfg.dll

2010-09-30 12:41 . 2009-10-15 20:32 409600 ----a-w- c:\windows\system32\lxducoin.dll

2010-09-30 12:41 . 2009-07-14 08:04 200704 ----a-w- c:\windows\system32\lxduinsb.dll

2010-09-30 12:41 . 2009-07-14 08:04 90112 ----a-w- c:\windows\system32\lxducub.dll

2010-09-30 12:41 . 2009-07-14 08:06 106496 ----a-w- c:\windows\system32\lxduinsr.dll

2010-09-30 12:41 . 2009-07-14 08:06 36864 ----a-w- c:\windows\system32\lxducur.dll

2010-09-30 12:41 . 2009-07-14 08:02 77824 ----a-w- c:\windows\system32\lxducu.dll

2010-09-30 12:41 . 2009-07-14 08:02 176128 ----a-w- c:\windows\system32\lxduins.dll

2010-09-30 12:41 . 2009-07-14 07:59 544768 ----a-w- c:\windows\system32\lxduutil.dll

2010-09-30 12:41 . 2008-03-06 04:56 983121 ----a-w- c:\windows\system32\lxdugf.dll

2010-09-30 12:41 . 2009-07-14 08:06 147456 ----a-w- c:\windows\system32\lxdujswr.dll

2010-09-30 12:41 . 2010-09-30 12:41 -------- d-----w- C:\drivers

2010-09-29 02:16 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-09-29 02:16 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-09-29 02:16 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-09-29 02:16 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-09-29 02:16 . 2010-09-07 14:47 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2010-09-29 02:15 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr

2010-09-29 02:15 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe

2010-09-29 02:15 . 2010-09-29 02:15 -------- d-----w- c:\program files\Alwil Software

2010-09-28 18:46 . 2010-09-28 18:46 -------- d-----w- c:\program files\Moffsoft FreeCalc

2010-09-28 12:59 . 2010-09-28 12:59 -------- d-----r- c:\program files\Skype

2010-09-28 12:59 . 2010-09-28 12:59 -------- d-----w- c:\programdata\Skype

2010-09-27 19:00 . 2009-05-18 17:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-09-27 19:00 . 2008-04-17 16:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-09-27 18:59 . 2010-09-27 18:59 -------- d-----w- c:\program files\iPod

2010-09-27 18:59 . 2010-09-27 19:00 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-09-27 18:59 . 2010-09-27 19:00 -------- d-----w- c:\program files\iTunes

2010-09-27 16:25 . 2010-09-27 19:00 -------- dc----w- c:\windows\system32\DRVSTORE

2010-09-27 16:25 . 2009-12-10 18:48 45616 ----a-w- c:\windows\system32\drivers\DKRtWrt.sys

2010-09-27 16:24 . 2010-09-27 16:24 -------- d-----w- c:\programdata\Diskeeper Corporation

2010-09-27 16:24 . 2010-09-27 16:24 -------- d-----w- c:\program files\Common Files\Diskeeper Corporation

2010-09-27 16:24 . 2010-09-27 16:24 -------- d-----w- c:\program files\Windows Home Server

2010-09-27 16:24 . 2010-09-27 16:24 -------- d-----w- c:\program files\Diskeeper Corporation

2010-09-27 03:01 . 2010-09-27 03:01 -------- d-----w- c:\program files\download tool

2010-09-27 02:51 . 2010-09-27 02:51 -------- d-----w- c:\program files\RegFixerPro

2010-09-27 02:19 . 2010-09-27 02:19 -------- d-----w- c:\program files\Common Files\RegFixerPro

2010-09-26 12:12 . 2009-06-22 22:58 89600 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\HPZPPLHN.DLL

2010-09-25 13:33 . 2010-09-25 13:33 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-09-25 12:28 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-25 12:28 . 2010-09-25 12:28 -------- d-----w- c:\programdata\Malwarebytes

2010-09-25 12:28 . 2010-09-25 12:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-25 12:28 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\es

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\drivers\UMDF\es-ES

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\0C0A

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\drivers\es-ES

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\wbem\es-ES

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\es-ES

2010-09-25 03:55 . 2010-09-25 03:55 -------- d-----w- c:\windows\fi-FI

2010-09-25 03:54 . 2010-09-25 03:55 -------- d-----w- c:\windows\system32\XPSViewer

2010-09-25 03:54 . 2010-09-25 03:54 -------- d-----w- c:\windows\system32\drivers\fi-FI

2010-09-25 03:54 . 2010-09-25 03:54 -------- d-----w- c:\windows\system32\fi

2010-09-25 03:54 . 2010-09-25 03:54 -------- d-----w- c:\windows\system32\drivers\UMDF\fi-FI

2010-09-25 03:54 . 2010-09-25 03:54 -------- d-----w- c:\windows\system32\wbem\fi-FI

2010-09-25 02:31 . 2009-07-13 22:37 3584 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\es-ES\LXKPTPRC.DLL.mui

2010-09-25 02:28 . 2010-10-02 12:37 -------- d-----w- c:\program files\Microsoft Silverlight

2010-09-25 02:12 . 2009-07-13 22:33 3584 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\fi-FI\LXKPTPRC.DLL.mui

2010-09-25 02:11 . 2009-10-10 02:57 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2010-09-25 02:11 . 2009-10-10 02:31 84992 ----a-w- c:\windows\system32\drivers\sdbus.sys

2010-09-25 01:41 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll

2010-09-25 01:41 . 2009-09-26 05:58 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys

2010-09-25 01:41 . 2009-10-24 04:00 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys

2010-09-25 01:41 . 2009-10-24 03:58 41984 ----a-w- c:\windows\system32\drivers\usbehci.sys

2010-09-25 01:41 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2010-09-25 01:41 . 2010-01-18 23:29 85504 ----a-w- c:\windows\system32\secproc_ssp.dll

2010-09-25 01:41 . 2010-01-18 23:29 365568 ----a-w- c:\windows\system32\secproc_isv.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-05-28 1721640]

"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-09-11 2500552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

NETGEAR WNDA3100v2 Smart Wizard.lnk - c:\program files\NETGEAR\WNDA3100v2\WNDA3100v2.exe [2010-10-16 3280896]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\acaptuser32.dll

[HKLM\~\startupfolder\C:^Users^Juan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\Juan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 03:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-09-23 08:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]

2010-02-04 09:10 131752 ----a-w- c:\program files\Lexmark 5600-6600 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-09-24 06:10 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxdumon.exe]

2010-02-04 09:10 676520 ----a-w- c:\program files\Lexmark 5600-6600 Series\lxdumon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-09-08 15:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxduserv.exe [2010-02-04 94208]

R2 WSWNDA3100;WSWNDA3100;c:\program files\NETGEAR\WNDA3100v2\WifiSvc.exe [2009-11-04 278528]

R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [2009-07-14 265088]

R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [2009-07-13 11904]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-24 1343400]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-02 436792]

S0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\DRIVERS\scmndisp.sys [2007-01-19 21728]

S1 aswSP;aswSP; [x]

S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-09-11 236088]

S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-09-11 30112]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992]

S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [2010-02-04 589824]

S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\DRIVERS\bcmwlhigh6.sys [2009-11-06 699896]

S3 DKRtWrt;DKRtWrt;c:\windows\system32\DRIVERS\DKRtWrt.sys [2009-12-10 45616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HsfXAudioService REG_MULTI_SZ HsfXAudioService

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\71u4lwgu.default\

FF - prefs.js: browser.startup.homepage - hxxp://shop.thefreevpn.com/home.php

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=

FF - component: c:\users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\71u4lwgu.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(548)

c:\windows\system32\guard32.dll

- - - - - - - > 'Explorer.exe'(2220)

c:\windows\system32\EXPLORERFRAME.dll

c:\windows\system32\guard32.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\COMODO\COMODO Internet Security\cmdagent.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\windows\system32\WLANExt.exe

c:\windows\system32\conhost.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

c:\windows\system32\taskhost.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\conhost.exe

c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe

c:\windows\system32\sppsvc.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Completion time: 2010-10-16 10:45:40 - machine was rebooted

ComboFix-quarantined-files.txt 2010-10-16 14:45

ComboFix2.txt 2010-10-16 13:39

Pre-Run: 120,256,507,904 bytes free

Post-Run: 119,823,523,840 bytes free

- - End Of File - - 8F4649A1D39C1D421807E3498F085C0F

Gammo · October 16, 2010

Hi,

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:dir
c:\program files\RegFixerPro /s /md5
c:\users\juan\appdata\local\RegFixerPro /s /md5
c:\program files\common files\RegFixerPro /s /md5
c:\program files\download tool /s /md5

:filefind
*FreeVPN*

:folderfind
*FreeVPN*

:regfind
FreeVPN

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

garciamaki · October 16, 2010

Hi,
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
:dir
c:\program files\RegFixerPro /s /md5
c:\users\juan\appdata\local\RegFixerPro /s /md5
c:\program files\common files\RegFixerPro /s /md5
c:\program files\download tool /s /md5

:filefind
*FreeVPN*

:folderfind
*FreeVPN*

:regfind
FreeVPN
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Hi, SystemLook Log is here:

SystemLook 04.09.10 by jpshortstuff

Log created at 14:17 on 16/10/2010 by Juan

Administrator - Elevation successful

========== dir ==========

c:\program files\RegFixerPro - Parameters: "/s /md5"

---Files---

algo.ico --a---- 3126 bytes [02:51 27/09/2010] [06:11 24/09/2009] 69F719840F32B1AE4E188F9539FA21BB

Common Tools.dll --a---- 144896 bytes [02:51 27/09/2010] [23:50 19/10/2009] 58782D3634415B4FF9F6B5D56DD468DE

RegFixerPro.exe --a---- 1024000 bytes [02:51 27/09/2010] [02:23 21/01/2010] AC634FCA927D43B519BB167FEF9FF433

Uninst0.dat --a---- 1644 bytes [02:51 27/09/2010] [02:51 27/09/2010] 4232DD504713B21340C41C775D0C57F8

Uninst0.exe --a---- 44544 bytes [02:51 27/09/2010] [02:51 27/09/2010] 5CF14BE42C4C57C7A56051F09774E60F

No folders found.

c:\users\juan\appdata\local\RegFixerPro - Parameters: "/s /md5"

---Files---

None found.

c:\users\juan\appdata\local\RegFixerPro\RegFixerPro.exe_Url_fbxrrdm1h3ig020piwksriqoewnby5u2 d------ [02:55 27/09/2010]

c:\users\juan\appdata\local\RegFixerPro\RegFixerPro.exe_Url_fbxrrdm1h3ig020piwksriqoewnby5u2\1.3.3672.40301 d------ [02:55 27/09/2010]

user.config --a---- 2041 bytes [02:55 27/09/2010] [01:36 12/10/2010] 9F70E1B9AC8D895E032D5311F04575FC

c:\users\juan\appdata\local\RegFixerPro\regfixerprod.exe_Url_zvmq3pv1punquzctpswwc5njxtlmbr5m d------ [02:23 27/09/2010]

c:\users\juan\appdata\local\RegFixerPro\regfixerprod.exe_Url_zvmq3pv1punquzctpswwc5njxtlmbr5m\1.3.3674.1993 d------ [02:23 27/09/2010]

user.config --a---- 2041 bytes [02:23 27/09/2010] [02:23 27/09/2010] 87831CD3CCB9629E29A9D30F21E6102C

c:\program files\common files\RegFixerPro - Parameters: "/s /md5"

---Files---

None found.

c:\program files\common files\RegFixerPro\Backups d------ [02:19 27/09/2010]

2010_09_26_225328.xml --a---- 42092 bytes [02:53 27/09/2010] [02:53 27/09/2010] FAC270C8C9F90A609A8E56C15658C623

2010_09_26_225423.xml --a---- 1629 bytes [02:54 27/09/2010] [02:54 27/09/2010] 61AE22E0C7AACFAB74983CFAA58C1723

2010_09_26_225516.xml --a---- 1629 bytes [02:55 27/09/2010] [02:55 27/09/2010] 61AE22E0C7AACFAB74983CFAA58C1723

2010_09_27_160950.xml --a---- 12972 bytes [20:09 27/09/2010] [20:09 27/09/2010] 4A54AF6F48BED4A047093DE636E0C800

2010_09_27_161049.xml --a---- 1629 bytes [20:10 27/09/2010] [20:10 27/09/2010] 61AE22E0C7AACFAB74983CFAA58C1723

2010_09_27_182952.xml --a---- 1629 bytes [22:29 27/09/2010] [22:29 27/09/2010] 61AE22E0C7AACFAB74983CFAA58C1723

2010_09_28_180340.xml --a---- 24388 bytes [22:03 28/09/2010] [22:03 28/09/2010] 73FDC1BCF14091D6FD519674776C2B1A

2010_09_28_184555.xml --a---- 2202 bytes [22:45 28/09/2010] [22:45 28/09/2010] 6D4CD0814BE2DE895D1250900318B51E

2010_10_02_103349.xml --a---- 25730 bytes [14:33 02/10/2010] [14:33 02/10/2010] 51C3A27AC414B479CF8052FDF2D23C05

2010_10_11_213632.xml --a---- 62716 bytes [01:36 12/10/2010] [01:36 12/10/2010] 94EBCE14E1511D1FB6A49FE41192B273

c:\program files\common files\RegFixerPro\Logs d------ [02:19 27/09/2010]

2010_09_26_222014.txt --a---- 22045 bytes [02:20 27/09/2010] [02:20 27/09/2010] 24BE6B743CCBD7F6861489BF4609F629

2010_09_26_225301.txt --a---- 22044 bytes [02:53 27/09/2010] [02:53 27/09/2010] C5A72FA0A008DB660AFFFC02240953FD

2010_09_26_225357.txt --a---- 3266 bytes [02:53 27/09/2010] [02:53 27/09/2010] 064DEDAC509574210F0BF9C418340F57

2010_09_26_225445.txt --a---- 3266 bytes [02:54 27/09/2010] [02:54 27/09/2010] CA15A7CC137A8E4B487CA69FA5E44318

2010_09_26_225539.txt --a---- 3266 bytes [02:55 27/09/2010] [02:55 27/09/2010] 53035431EF08F995203589DFAB2A4819

2010_09_27_160905.txt --a---- 5449 bytes [20:09 27/09/2010] [20:09 27/09/2010] 611CC9CBC4929F500BDAB7AD17352D16

2010_09_27_161019.txt --a---- 3264 bytes [20:10 27/09/2010] [20:10 27/09/2010] 0B87E074920E72A9B85B697D381B2B78

2010_09_27_182927.txt --a---- 3265 bytes [22:29 27/09/2010] [22:29 27/09/2010] 54559D79C03E3398EE487D310B264FBD

2010_09_28_180316.txt --a---- 7931 bytes [22:03 28/09/2010] [22:03 28/09/2010] 2D7A42187E74BF6CB4E681AB5A8045B5

2010_09_28_180404.txt --a---- 3265 bytes [22:04 28/09/2010] [22:04 28/09/2010] ABBB0BAEA249C56F483616CDF904FBB3

2010_09_28_184511.txt --a---- 3564 bytes [22:45 28/09/2010] [22:45 28/09/2010] A1ED31AA39904F408D2AA5F6296C81F8

2010_10_02_103325.txt --a---- 14588 bytes [14:33 02/10/2010] [14:33 02/10/2010] 6276069F378DA239CFF4A5D9B4B6A2FB

2010_10_11_213523.txt --a---- 13403 bytes [01:35 12/10/2010] [01:35 12/10/2010] F9FABBD6DFF121C73AF080C212E51074

c:\program files\download tool - Parameters: "/s /md5"

---Files---

uTorrent.exe --a---- 328056 bytes [03:01 27/09/2010] [03:01 27/09/2010] 008F2FE191618133A68F1AC190DC6044

No folders found.

========== filefind ==========

Searching for "*FreeVPN*"

C:\Users\Juan\Documents\Juan Alberto\Recursos & Referencias\Tecnologia\freeVPN.txt --a---- 7 bytes [12:01 26/09/2010] [12:22 01/07/2010] F55AC1ED2A85FF7F8E20AC52C7BB35AD

========== folderfind ==========

Searching for "*FreeVPN*"

No folders found.

========== regfind ==========

Searching for "FreeVPN"

No data found.

-= EOF =-

Gammo · October 16, 2010

Hi,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

Folder::
c:\program files\RegFixerPro
c:\users\juan\appdata\local\RegFixerPro
c:\program files\common files\RegFixerPro

FireFox::
FF - ProfilePath - c:\users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\71u4lwgu.default\
FF - prefs.js: browser.startup.homepage - hxxp://shop.thefreevpn.com/home.php

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

garciamaki · October 17, 2010

Hi,
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the codebox below into it:
Folder::
c:\program files\RegFixerPro
c:\users\juan\appdata\local\RegFixerPro
c:\program files\common files\RegFixerPro

FireFox::
FF - ProfilePath - c:\users\Juan\AppData\Roaming\Mozilla\Firefox\Profiles\71u4lwgu.default\
FF - prefs.js: browser.startup.homepage - hxxp://shop.thefreevpn.com/home.php
Save this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Hello, it seems that the problem is gone. Firefox is not being redirected to the "http://shop.thefreevpn.com/home.php" thing anymore. Does this mean that my pc is clean now? What was the name of that malware or trojan or whatever it was? I want to be sure the pc is completely clean, so here it is, the latest ComboFix log as required. Thanks!

ComboFix 10-10-15.03 - Juan 10/16/2010 19:16:59.3.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.2019 [GMT -4:00]

Running from: c:\users\Juan\Desktop\ComboFix.exe

Command switches used :: c:\users\Juan\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\common files\RegFixerPro

c:\program files\common files\RegFixerPro\Backups\2010_09_26_225328.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_26_225423.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_26_225516.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_27_160950.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_27_161049.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_27_182952.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_28_180340.xml

c:\program files\common files\RegFixerPro\Backups\2010_09_28_184555.xml

c:\program files\common files\RegFixerPro\Backups\2010_10_02_103349.xml

c:\program files\common files\RegFixerPro\Backups\2010_10_11_213632.xml

c:\program files\common files\RegFixerPro\Logs\2010_09_26_222014.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_26_225301.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_26_225357.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_26_225445.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_26_225539.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_27_160905.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_27_161019.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_27_182927.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_28_180316.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_28_180404.txt

c:\program files\common files\RegFixerPro\Logs\2010_09_28_184511.txt

c:\program files\common files\RegFixerPro\Logs\2010_10_02_103325.txt

c:\program files\common files\RegFixerPro\Logs\2010_10_11_213523.txt

c:\program files\RegFixerPro

c:\program files\RegFixerPro\algo.ico

c:\program files\RegFixerPro\Common Tools.dll

c:\program files\RegFixerPro\RegFixerPro.exe

c:\program files\RegFixerPro\Uninst0.dat

c:\program files\RegFixerPro\Uninst0.exe

c:\users\juan\appdata\local\RegFixerPro

c:\users\juan\appdata\local\RegFixerPro\RegFixerPro.exe_Url_fbxrrdm1h3ig020piwksriqoewnby5u2\1.3.3672.40301\user.config

c:\users\juan\appdata\local\RegFixerPro\regfixerprod.exe_Url_zvmq3pv1punquzctpswwc5njxtlmbr5m\1.3.3674.1993\user.config

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\wpcap.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2010-09-16 to 2010-10-16 )))))))))))))))))))))))))))))))

.

2010-10-16 23:31 . 2010-10-16 23:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-10-16 23:14 . 2010-10-16 23:15 -------- d-----w- C:\32788R22FWJFW

2010-10-16 14:59 . 2009-11-06 12:37 699896 ----a-w- c:\windows\system32\drivers\bcmwlhigh6.sys

2010-10-16 14:59 . 2007-01-19 22:20 21728 ----a-w- c:\windows\system32\drivers\SCMNdisP.sys

2010-10-16 14:59 . 2010-10-16 14:59 -------- d-----w- c:\program files\NETGEAR

2010-10-16 14:59 . 2010-10-16 14:59 -------- d--h--w- c:\program files\InstallShield Installation Information