Infected with csrss and others

Serascel · November 16, 2011

Hello, first time posting, so im sorry in advanced for any mistakes/errors.

Got infected yesterday or the day before, and malware bytes anti malware PRO isnt detecting anything, but i keep getting random adobe flash installations and random attemps of csrss and svchost.exe to access internet etc..

Posting exactly what the "I'm infected - What do I do now?" sticky sayd.

If I need to paste hijack this or malware Pro let me know.

Thanks.

DDS.txt

Attach.txt

Maniac · November 16, 2011

Hello Serascel! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

Please post them in your next reply.

Serascel · November 16, 2011

Thanks for the Reply, Will do.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by Javier at 11:26:10 on 2011-11-16

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.34.1033.18.8169.3788 [GMT 1:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe

C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe

C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe

C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Windows\system32\IProsetMonitor.exe

E:\LogMeIn\x64\LMIGuardianSvc.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\SysWOW64\PnkBstrA.exe

E:\Tunngle\TnglCtrl.exe

C:\Windows\SysWOW64\UAService7.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

E:\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\VRMHelp.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

E:\HP\Digital Imaging\bin\hpqtra08.exe

E:\HP\HP Software Update\hpwuSchd2.exe

E:\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

E:\Razer\Naga\RazerNagaSysTray.exe

C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pnSvc.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe

E:\HP\Digital Imaging\bin\hpqSTE08.exe

E:\HP\Digital Imaging\bin\hpqbam08.exe

E:\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe

C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe

C:\Program Files (x86)\Java\jre6\bin\javaw.exe

E:\Open Office\program\swriter.exe

E:\Open Office\program\soffice.exe

E:\Open Office\program\soffice.bin

E:\DAEMON Tools Lite\DTLite.exe

C:\Windows\explorer.exe

C:\Windows\system32\notepad.exe

C:\Windows\system32\svchost.exe -k imgsvc

E:\Malwarebytes' Anti-Malware\mbam.exe

E:\Program Files (x86)\Mozilla Firefox\firefox.exe

E:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\msiexec.exe

C:\Windows\System32\svchost.exe -k swprv

E:\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyServer = http=210.107.100.251:8080;https=210.107.100.251:8080;ftp=210.107.100.251:8080

uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll

mWinlogon: Userinit=userinit.exe,

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - E:\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - E:\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [Google Update] "C:\Users\Javier\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [DAEMON Tools Lite] "E:\DAEMON Tools Lite\DTLite.exe" -autorun

mRun: [bCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"

mRun: [HP Software Update] E:\HP\HP Software Update\HPWuSchd2.exe

mRun: [Adobe Reader Speed Launcher] "E:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Malwarebytes' Anti-Malware] "E:\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [Razer Naga Driver] E:\Razer\Naga\RazerNagaSysTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - E:\HP\Digital Imaging\bin\hpqtra08.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

mPolicies-system: EnableLinkedConnections = 1 (0x1)

IE: Free YouTube to MP3 Converter - C:\Users\Javier\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - E:\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

TCP: DhcpNameServer = 87.216.1.65 87.216.1.66

TCP: Interfaces\{0EF470FC-2CA4-4648-8DEA-426EB57A57B4} : DhcpNameServer = 87.216.1.65 87.216.1.66

TCP: Interfaces\{593690F9-0E56-4C39-BAEA-38D547F2DC69} : DhcpNameServer = 7.254.254.254

TCP: Interfaces\{7748365C-5BD9-45C3-9CD2-56B9B7A2EABC} : DhcpNameServer = 95.141.192.4

SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4

BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - E:\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO-X64: HP Print Enhancer - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO-X64: Increase performance and video formats for your HTML5 <video> - No File

BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - E:\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

BHO-X64: HP Smart BHO Class - No File

mRun-x64: [bCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"

mRun-x64: [HP Software Update] E:\HP\HP Software Update\HPWuSchd2.exe

mRun-x64: [Adobe Reader Speed Launcher] "E:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "E:\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [Razer Naga Driver] E:\Razer\Naga\RazerNagaSysTray.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Javier\AppData\Roaming\Mozilla\Firefox\Profiles\f50z0qws.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Users\Javier\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Users\Javier\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\Javier\AppData\Roaming\Mozilla\Firefox\Profiles\f50z0qws.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

FF - plugin: E:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

FF - plugin: E:\Program Files (x86)\Adobe\Reader 9.0\Reader\browser\nppdf32.dll

FF - plugin: E:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AiCharger;ASUS Charger Driver;C:\Windows\system32\DRIVERS\AiCharger.sys --> C:\Windows\system32\DRIVERS\AiCharger.sys [?]

R0 mv91xx;mv91xx;C:\Windows\system32\DRIVERS\mv91xx.sys --> C:\Windows\system32\DRIVERS\mv91xx.sys [?]

R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);C:\Windows\system32\DRIVERS\tdrpm273.sys --> C:\Windows\system32\DRIVERS\tdrpm273.sys [?]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]

R2 afcdpsrv;Acronis Nonstop Backup Service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-7-7 3246040]

R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-3 918144]

R2 asHmComSvc;ASUS HM Com Service;C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-2 915584]

R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2011-7-6 586880]

R2 BCUService;Browser Configuration Utility Service;C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]

R2 DTSAudioService;DTSAudioService;C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe [2011-11-13 210024]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-7-6 13336]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\system32\IProsetMonitor.exe --> C:\Windows\system32\IProsetMonitor.exe [?]

R2 LMIGuardianSvc;LMIGuardianSvc;E:\LogMeIn\x64\LMIGuardianSvc.exe [2011-9-26 375176]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?]

R2 MBAMService;MBAMService;E:\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-14 366152]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-7-6 2255464]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]

R2 TunngleService;TunngleService;E:\Tunngle\TnglCtrl.exe [2011-8-15 741224]

R3 afcdp;afcdp;C:\Windows\system32\DRIVERS\afcdp.sys --> C:\Windows\system32\DRIVERS\afcdp.sys [?]

R3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;C:\Windows\system32\DRIVERS\e1c62x64.sys --> C:\Windows\system32\DRIVERS\e1c62x64.sys [?]

R3 ICCWDT;Intel® Watchdog Timer Driver (Intel® WDT);C:\Windows\system32\DRIVERS\ICCWDT.sys --> C:\Windows\system32\DRIVERS\ICCWDT.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 RzSynapse;Razer Driver;C:\Windows\system32\DRIVERS\RzSynapse.sys --> C:\Windows\system32\DRIVERS\RzSynapse.sys [?]

R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\system32\DRIVERS\tap0901t.sys --> C:\Windows\system32\DRIVERS\tap0901t.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 LMIInfo;LogMeIn Kernel Information Provider;E:\LogMeIn\x64\rainfo.sys [2011-9-16 15928]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2011-11-16 10:20:38 388096 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-16 05:44:47 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-11-15 22:54:10 -------- d-sh--w- C:\Windows\System32\%APPDATA%

2011-11-15 22:48:44 -------- d-sh--w- C:\Users\Javier\AppData\Local\7d1143f4

2011-11-15 06:35:09 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8D31AE10-2CF0-4D2C-A017-A8DA482FCD53}\mpengine.dll

2011-11-15 06:35:09 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8D31AE10-2CF0-4D2C-A017-A8DA482FCD53}\offreg.dll

2011-11-13 10:43:19 -------- d-----w- C:\Windows\SysWow64\RTCOM

2011-11-11 15:53:25 78680 ----a-w- C:\Windows\System32\XAPOFX1_4.dll

2011-11-10 20:53:57 -------- d-----w- C:\Program Files (x86)\Origin Games

2011-11-09 12:33:29 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll

2011-11-09 12:33:29 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll

2011-11-09 12:33:29 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-11-09 12:33:26 3144704 ----a-w- C:\Windows\System32\win32k.sys

2011-10-31 19:35:02 409 ----a-w- C:\Users\Javier\Tunngle_restart.bat

2011-10-26 14:51:46 -------- d-----w- C:\Program Files (x86)\Battlelog Web Plugins

2011-10-26 09:19:27 -------- d-----r- C:\Users\Javier\Dropbox

2011-10-26 09:18:26 -------- d-----w- C:\Users\Javier\AppData\Roaming\Dropbox

2011-10-25 19:59:31 -------- d-----w- C:\Users\Javier\AppData\Roaming\Origin

2011-10-25 19:59:30 -------- d-----w- C:\Users\Javier\AppData\Local\Origin

2011-10-25 19:59:25 -------- d-----w- C:\ProgramData\Origin

2011-10-25 13:55:53 21504 ----a-w- C:\Windows\jestertb.dll

2011-10-21 15:43:10 -------- d-----w- C:\Users\Javier\AppData\Local\LogMeIn

2011-10-21 15:43:09 87456 ----a-w- C:\Windows\System32\LMIRfsClientNP.dll

2011-10-21 15:43:09 72216 ----a-w- C:\Windows\System32\drivers\LMIRfsDriver.sys

2011-10-21 15:43:09 59776 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\LMIproc.dll

2011-10-21 15:43:09 34688 ----a-w- C:\Windows\System32\LMIport.dll

2011-10-21 15:43:08 80768 ----a-w- C:\Windows\System32\LMIinit.dll

2011-10-21 15:43:07 -------- d-----w- C:\ProgramData\LogMeIn

2011-10-19 19:35:52 270912 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys

2011-10-19 19:35:26 -------- d-----w- C:\Users\Javier\AppData\Roaming\DAEMON Tools Lite

2011-10-19 19:35:21 -------- d-----w- C:\ProgramData\DAEMON Tools Lite

2011-10-18 21:10:15 136568 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut3_AF179E0CC236405CA1EFA46CF947F194.exe

2011-10-18 21:10:15 136568 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut2_D6607052B9DB47B4AF253647598126AE.exe

2011-10-18 21:10:15 136568 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut1_49B41568AE25455B9AB2C3635A6F635C.exe

2011-10-18 21:10:15 136568 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\ARPPRODUCTICON.exe

2011-10-18 21:09:18 300408 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe

2011-10-18 21:09:18 136568 ----a-r- C:\Users\Javier\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe

2011-10-17 12:53:00 1698408 ----a-w- C:\Windows\RtlExUpd.dll

.

==================== Find3M ====================

.

2011-11-15 14:47:06 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2011-11-15 14:47:06 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2011-11-13 19:18:49 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2011-10-27 02:28:27 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2011-10-18 18:53:14 2957544 ----a-w- C:\Windows\System32\drivers\RTKVHD64.sys

2011-10-18 17:10:30 99432 ----a-w- C:\Windows\System32\RCoInst64.dll

2011-10-18 12:55:50 331880 ----a-w- C:\Windows\System32\RtlCPAPI64.dll

2011-10-18 12:47:22 1914472 ----a-w- C:\Windows\System32\RtkApi64.dll

2011-10-18 10:05:00 2528872 ----a-w- C:\Windows\System32\RtPgEx64.dll

2011-10-17 16:30:38 3213928 ----a-w- C:\Windows\System32\RtkAPO64.dll

2011-10-14 12:43:48 1873920 ----a-w- C:\Windows\System32\RCoRes64.dat

2011-10-13 06:34:54 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-09-22 22:41:00 3074368 ----a-w- C:\Windows\System32\nvsvcr.dll

2011-09-16 13:10:24 35616 ----a-w- C:\Windows\System32\lmimirr.dll

2011-09-16 13:10:24 14624 ----a-w- C:\Windows\System32\lmimirr2.dll

2011-09-16 13:10:24 11552 ----a-w- C:\Windows\System32\drivers\lmimirr.sys

2011-09-15 12:17:06 235 ----a-w- C:\Windows\SysWow64\nxEuUninstall.bat

2011-09-15 12:17:05 446464 ----a-w- C:\Windows\NEXON_EU_DownloaderUpdater.exe

2011-09-02 13:21:40 221024 ----a-w- C:\Windows\System32\SFNHK64.dll

2011-09-02 13:21:38 78688 ----a-w- C:\Windows\System32\SFAPO64.dll

2011-09-02 13:21:36 81248 ----a-w- C:\Windows\System32\SFCOM64.dll

2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll

2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll

2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-08-31 15:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-08-27 05:37:49 861696 ----a-w- C:\Windows\System32\oleaut32.dll

2011-08-27 05:37:48 331776 ----a-w- C:\Windows\System32\oleacc.dll

2011-08-27 04:26:27 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll

2011-08-27 04:26:27 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll

2011-08-23 16:00:24 603984 ----a-w- C:\Windows\System32\KAAPORT64.dll

.

============= FINISH: 11:26:20,02 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 06/07/2011 23:25:18

System Uptime: 15/11/2011 5:14:56 (30 hours ago)

.

Motherboard: ASUSTeK Computer INC. | | P8P67 EVO

Processor: Intel® Core i7-2600 CPU @ 3.40GHz | LGA1155 | 3401/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 56 GiB total, 26,42 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 932 GiB total, 553,198 GiB free.

F: is FIXED (NTFS) - 466 GiB total, 333,497 GiB free.

G: is FIXED (NTFS) - 932 GiB total, 534,768 GiB free.

H: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: USB\VID_0CF3&PID_3000\6&DF2EE03&0&7

Manufacturer:

Name:

PNP Device ID: USB\VID_0CF3&PID_3000\6&DF2EE03&0&7

Service:

.

==== System Restore Points ===================

.

RP167: 15/11/2011 7:34:55 - Windows Update

RP168: 16/11/2011 11:20:35 - Installed HiJackThis

.

==== Installed Programs ======================

.

4500_Help

Acrobat.com

Acronis True Image Home 2011

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.4.6

AI Suite II

Any Video Converter 3.2.5

Apple Application Support

Apple Software Update

ASUS Ai Charger

Bandisoft MPEG-1 Decoder

Bastion

Battlefield 3™

Battlefield: Bad Company 2

Battlelog Web Plugins

BPD_HPSU

bpd_scan

BPDSoftware

BPDSoftware_Ini

Browser Configuration Utility

BufferChm

CDisplay 1.8

CustomerResearchQFolder

DAEMON Tools Lite

Dawn of Fantasy

Dead Island

Destination Component

DeviceDiscovery

DeviceManagementQFolder

DocMgr

DocProc

DocProcQFolder

Dungeon Defenders

ESN Sonar

eSupportQFolder

Fax

Fraps (remove only)

Free YouTube to MP3 Converter version 3.10.11.923

Google Chrome

GPBaseService

Herramienta de carga de Windows Live

HiJackThis

HP Update

HPProductAssistant

Instalación de DivX

Intel® Management Engine Components

Intel® Rapid Storage Technology

Intel® Watchdog Timer Driver (Intel® WDT)

IrfanView (remove only)

J4500

Java Auto Updater

Java 6 Update 26

JDownloader 0.9

JMicron JMB36X Driver

LogMeIn

Malwarebytes' Anti-Malware version 1.51.2.1300

MarketResearch

marvell 91xx console driver

Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170)

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft XNA Framework Redistributable 3.1

Mozilla Firefox 8.0 (x86 es-ES)

MSI Afterburner 2.1.0

MSI Kombustor 2.0.0

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Naga Firmware Updater 1.13

NVIDIA 3D Vision Controller Driver

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

OpenOffice.org 3.3

OpenVPN 2.2.0

Origin

Plus Pack for Acronis True Image Home 2011

Pokemon World Online version 1.81

Portal

ProductContext

PunkBuster Services

QuickTime

RaidCall

Razer Naga

Realtek High Definition Audio Driver

Red Orchestra 2: Heroes of Stalingrad

Renesas Electronics USB 3.0 Host Controller Driver

Scan

Section 8: Prejudice

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

SmartWebPrintingOC

SolutionCenter

Status

Steam

System Requirements Lab CYRI

TeamSpeak 3 Client

Toolbox

TrayApp

Tunngle beta

Unity Web Player

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

VC80CRTRedist - 8.0.50727.4053

VLC media player 1.1.11

WebReg

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Messenger

Windows Movie Maker 2.6

WinRAR archiver

.

==== Event Viewer Messages From Past Week ========

.

15/11/2011 8:39:03, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2.

15/11/2011 5:16:34, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.

13/11/2011 23:03:32, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

13/11/2011 11:43:24, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk3\DR3.

10/11/2011 21:11:44, Error: Microsoft-Windows-BitLocker-Driver [24620] - Encrypted volume check: Volume information on cannot be read.

.

==== End Of File ===========================

Maniac · November 16, 2011

Step 1

Now it's time to clean the cache of Java, because of malware. Malware that could be found in this cache directory are not associated with the Java that was downloaded and installed on the system. A cache directory is aa temporary storage location. When the browser runs an applet or application, Java stores files into its cache directory for better performance.

Click Start => Control Panel.

Double-click the Java icon in the control panel. The Java Control Panel appears.

Click Settings under Temporary Internet Files. The Temporary Files Settings dialog box appears.

Click Delete Files. The Delete Temporary Files dialog box appears.

Click OK on Delete Temporary Files window. Note: This deletes all the Downloaded Applications and Applets from the cache.

Click OK on Temporary Files Settings window. Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.

Step 2

Please follow the instructions here to download and run ComboFix tool:

www.bleepingcomputer.com/combofix/how-to-use-combofix#use

Please post the log.txt when you are ready.

Serascel · November 16, 2011

Did both, just one slight problem, after combofix atempted to restart the computer it actually shuted it down, when it turned it on, it gave me the txt file properly.

Also, im getting the following error message on various program startups: "Illegal operation attempted on a registry key that has been marked for deletion"

ComboFix 11-11-15.06 - Javier 16/11/2011 17:25:09.1.8 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.34.1033.18.8169.5722 [GMT 1:00]

Running from: e:\documents\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\assembly\tmp\U

c:\windows\assembly\tmp\U\000000c0.@

c:\windows\assembly\tmp\U\000000cb.@

c:\windows\assembly\tmp\U\000000cf.@

c:\windows\assembly\tmp\U\80000000.@

c:\windows\assembly\tmp\U\800000c0.@

c:\windows\assembly\tmp\U\800000cb.@

c:\windows\assembly\tmp\U\800000cf.@

c:\windows\jestertb.dll

c:\windows\system32\consrv.dll

F:\Autorun.inf

G:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

2011-11-16 16:27 . 2011-11-16 16:27 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2011-11-16 16:27 . 2011-11-16 16:27 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-16 10:20 . 2011-11-16 10:20 388096 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-16 05:09 . 2011-11-16 05:09 -------- d-----w- c:\windows\system32\Macromed

2011-11-15 22:54 . 2011-11-15 22:54 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-11-15 22:48 . 2011-11-15 22:48 -------- d-sh--w- c:\users\Javier\AppData\Local\7d1143f4

2011-11-15 06:35 . 2011-11-15 06:35 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8D31AE10-2CF0-4D2C-A017-A8DA482FCD53}\offreg.dll

2011-11-15 06:35 . 2011-10-07 04:16 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8D31AE10-2CF0-4D2C-A017-A8DA482FCD53}\mpengine.dll

2011-11-13 10:43 . 2011-11-13 10:43 -------- d-----w- c:\windows\SysWow64\RTCOM

2011-11-11 15:53 . 2010-02-04 09:01 78680 ----a-w- c:\windows\system32\XAPOFX1_4.dll

2011-11-10 20:53 . 2011-11-10 20:53 -------- d-----w- c:\program files (x86)\Origin Games

2011-11-09 12:33 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-09 12:33 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll

2011-11-09 12:33 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-09 12:33 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys

2011-10-31 19:35 . 2011-10-31 19:34 409 ----a-w- c:\users\Javier\Tunngle_restart.bat

2011-10-26 14:51 . 2011-11-10 20:52 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins

2011-10-26 09:19 . 2011-11-16 11:01 -------- d-----r- c:\users\Javier\Dropbox

2011-10-26 09:18 . 2011-11-16 16:37 -------- d-----w- c:\users\Javier\AppData\Roaming\Dropbox

2011-10-25 19:59 . 2011-10-25 19:59 -------- d-----w- c:\users\Javier\AppData\Roaming\Origin

2011-10-25 19:59 . 2011-10-25 19:59 -------- d-----w- c:\users\Javier\AppData\Local\Origin

2011-10-25 19:59 . 2011-10-26 09:50 -------- d-----w- c:\programdata\Origin

2011-10-21 15:43 . 2011-10-21 15:43 -------- d-----w- c:\users\Javier\AppData\Local\LogMeIn

2011-10-21 15:43 . 2011-09-26 16:17 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2011-10-21 15:43 . 2011-09-26 16:16 59776 ----a-w- c:\windows\system32\Spool\prtprocs\x64\LMIproc.dll

2011-10-21 15:43 . 2011-09-26 16:16 34688 ----a-w- c:\windows\system32\LMIport.dll

2011-10-21 15:43 . 2011-09-16 13:10 72216 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys

2011-10-21 15:43 . 2011-09-26 16:16 80768 ----a-w- c:\windows\system32\LMIinit.dll

2011-10-21 15:43 . 2011-11-16 16:36 -------- d-----w- c:\programdata\LogMeIn

2011-10-19 19:35 . 2011-10-19 19:36 270912 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys

2011-10-19 19:35 . 2011-11-16 05:32 -------- d-----w- c:\users\Javier\AppData\Roaming\DAEMON Tools Lite

2011-10-19 19:35 . 2011-10-19 19:35 -------- d-----w- c:\programdata\DAEMON Tools Lite

2011-10-18 21:10 . 2011-10-18 21:10 136568 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut3_AF179E0CC236405CA1EFA46CF947F194.exe

2011-10-18 21:10 . 2011-10-18 21:10 136568 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut2_D6607052B9DB47B4AF253647598126AE.exe

2011-10-18 21:10 . 2011-10-18 21:10 136568 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\NewShortcut1_49B41568AE25455B9AB2C3635A6F635C.exe

2011-10-18 21:10 . 2011-10-18 21:10 136568 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{ED4108A9-60FD-4F18-AF42-122219977773}\ARPPRODUCTICON.exe

2011-10-18 21:10 . 2011-10-18 21:10 -------- d-----w- c:\program files (x86)\Razer

2011-10-18 21:09 . 2011-10-18 21:09 300408 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ARPPRODUCTICON.exe

2011-10-18 21:09 . 2011-10-18 21:09 136568 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{5A336D74-E680-4986-96F4-E9CEBC784F56}\ShortcutUpdater_DF0BD54B5FA14948AAC4D5BDB1FBFCF2.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-15 14:47 . 2011-07-06 20:57 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

2011-11-15 14:47 . 2011-07-06 20:06 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2011-11-13 19:18 . 2011-07-06 20:06 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

2011-10-27 02:28 . 2011-07-06 20:06 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe

2011-10-15 08:53 . 2011-09-24 19:51 1533248 ----a-w- c:\windows\system32\nvdispco64.dll

2011-10-15 08:53 . 2011-09-24 19:51 1454400 ----a-w- c:\windows\system32\nvgenco64.dll

2011-10-15 08:53 . 2011-07-06 16:18 8791360 ----a-w- c:\windows\system32\nvwgf2umx.dll

2011-10-15 08:53 . 2011-07-06 16:18 7041856 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

2011-10-15 08:53 . 2011-07-06 16:18 2808128 ----a-w- c:\windows\system32\nvapi64.dll

2011-10-15 08:53 . 2011-07-06 16:18 2458432 ----a-w- c:\windows\SysWow64\nvapi.dll

2011-10-13 06:34 . 2011-07-06 20:13 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-09-22 22:41 . 2011-01-07 18:49 3074368 ----a-w- c:\windows\system32\nvsvcr.dll

2011-09-16 13:10 . 2011-09-16 13:10 35616 ----a-w- c:\windows\system32\lmimirr.dll

2011-09-16 13:10 . 2011-09-16 13:10 14624 ----a-w- c:\windows\system32\lmimirr2.dll

2011-09-16 13:10 . 2011-09-16 13:10 11552 ----a-w- c:\windows\system32\drivers\lmimirr.sys

2011-09-15 12:17 . 2011-09-15 12:17 235 ----a-w- c:\windows\SysWow64\nxEuUninstall.bat

2011-09-15 12:17 . 2011-09-15 12:17 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe

2011-09-01 05:24 . 2011-10-13 01:00 2309120 ----a-w- c:\windows\system32\jscript9.dll

2011-09-01 05:17 . 2011-10-13 01:00 1389056 ----a-w- c:\windows\system32\wininet.dll

2011-09-01 05:12 . 2011-10-13 01:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-01 02:35 . 2011-10-13 01:00 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-09-01 02:28 . 2011-10-13 01:00 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2011-09-01 02:22 . 2011-10-13 01:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-08-31 17:12 . 2011-10-17 12:53 1698408 ----a-w- c:\windows\RtlExUpd.dll

2011-08-31 15:00 . 2011-07-06 17:08 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-27 05:37 . 2011-10-12 22:41 861696 ----a-w- c:\windows\system32\oleaut32.dll

2011-08-27 05:37 . 2011-10-12 22:41 331776 ----a-w- c:\windows\system32\oleacc.dll

2011-08-27 04:26 . 2011-10-12 22:41 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll

2011-08-27 04:26 . 2011-10-12 22:41 233472 ----a-w- c:\windows\SysWow64\oleacc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 94208 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-02-02 3872080]

"DAEMON Tools Lite"="e:\daemon tools lite\DTLite.exe" [2011-08-02 4910912]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-26 375000]

"HP Software Update"="e:\hp\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"Adobe Reader Speed Launcher"="e:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"Malwarebytes' Anti-Malware"="e:\malwarebytes' anti-malware\mbamgui.exe" [2011-08-31 449608]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-18 421736]

"Razer Naga Driver"="e:\razer\Naga\RazerNagaSysTray.exe" [2011-04-12 953232]

.

c:\users\Javier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Javier\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-10-31 24241928]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - e:\hp\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]

R2 MBAMService;MBAMService;e:\malwarebytes' anti-malware\mbamservice.exe [2011-08-31 366152]

R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]

R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2009-07-14 27136]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 MSICDSetup;MSICDSetup;D:\CDriver64.sys [x]

R3 ncvet.dll;ncvet.dll;c:\windows\Temp\ncvet.dll [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 X6va005;X6va005;c:\users\Javier\AppData\Local\Temp\0052F5A.tmp [x]

S0 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [x]

S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]

S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]

S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-07-07 3246040]

S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]

S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]

S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]

S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-26 223464]

S2 DTSAudioService;DTSAudioService;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe [2011-05-31 210024]

S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [x]

S2 LMIGuardianSvc;LMIGuardianSvc;e:\logmein\x64\LMIGuardianSvc.exe [2011-09-26 375176]

S2 LMIInfo;LogMeIn Kernel Information Provider;e:\logmein\x64\RaInfo.sys [2011-09-16 15928]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]

S2 TunngleService;TunngleService;e:\tunngle\TnglCtrl.exe [2011-08-09 741224]

S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]

S3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]

S3 ICCWDT;Intel® Watchdog Timer Driver (Intel® WDT);c:\windows\system32\DRIVERS\ICCWDT.sys [x]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 RzSynapse;Razer Driver;c:\windows\system32\DRIVERS\RzSynapse.sys [x]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3641578468-56870901-2788665423-1000Core.job

- c:\users\Javier\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-06 23:38]

.

2011-11-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3641578468-56870901-2788665423-1000UA.job

- c:\users\Javier\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-06 23:38]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 97792 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 97792 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 97792 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02 97792 ----a-w- c:\users\Javier\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogMeIn GUI"="e:\logmein\x64\LogMeInSystray.exe" [2011-09-16 57928]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]

"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-10-14 2278504]

"combofix"="c:\combofix\CF18287.3XE" [2010-11-21 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyServer = http=210.107.100.251:8080;https=210.107.100.251:8080;ftp=210.107.100.251:8080

IE: Free YouTube to MP3 Converter - c:\users\Javier\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 87.216.1.65 87.216.1.66

FF - ProfilePath - c:\users\Javier\AppData\Roaming\Mozilla\Firefox\Profiles\f50z0qws.default\

FF - prefs.js: network.proxy.type - 0

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]

"ImagePath"="\??\c:\users\Javier\AppData\Local\Temp\0052F5A.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\windows\SysWOW64\PnkBstrA.exe

c:\windows\SysWOW64\UAService7.exe

c:\program files (x86)\ASUS\AI Suite II\AsRoutineController.exe

c:\program files (x86)\ASUS\AI Suite II\DIGI+ VRM\VRMHelp.exe

.

**************************************************************************

.

Completion time: 2011-11-16 17:38:11 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-16 16:38

.

Pre-Run: 27.760.738.304 bytes free

Post-Run: 27.251.183.616 bytes free

.

- - End Of File - - B649878B80E94D96DE64365F604BE967

Maniac · November 16, 2011

Also, im getting the following error message on various program startups: "Illegal operation attempted on a registry key that has been marked for deletion"

Reboot your computer and then will be fine.

Serascel · November 16, 2011

Reboot your computer and then will be fine.

Yeah did that, now its fine.

Should I do anything else or is that it? computer still feels a bit slugish.

Maniac · November 16, 2011

Meanwhile, please open www.virustotal.com and upload the following file:

C:\Windows\NEXON_EU_DownloaderUpdater.exe

When the scan finished, please copy&paste the link.

Serascel · November 16, 2011

http://www.virustotal.com/file-scan/reanalysis.html?id=fdf6a15e87b9028f6c38620a77e5cc5f82582d3dd0c09e81dabb8d35621c0b61-1321464906

Thanks.

Maniac · November 16, 2011

Thanks!

Open Notepad and copy and paste the text in the code box below into it:

Folder::
c:\users\Javier\AppData\Local\7d1143f4

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

In your next post here, please include ComboFix.txt and let me know how are things there.

Serascel · November 16, 2011

Things seem to be getting better, no sluginesh anymore, at least for now.

Also not getting anymore blocked attempts by malware bytes.

Thanks.

ComboFix 11-11-15.06 - Javier 16/11/2011 20:12:30.2.8 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.34.1033.18.8169.5103 [GMT 1:00]

Running from: e:\documents\ComboFix.exe

Command switches used :: e:\documents\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Javier\AppData\Local\7d1143f4

c:\users\Javier\AppData\Local\7d1143f4\@

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

2011-11-16 19:14 . 2011-11-16 19:14 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2011-11-16 19:14 . 2011-11-16 19:14 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-16 17:20 . 2011-11-16 17:20 -------- d-----w- c:\users\Javier\AppData\Roaming\Download Manager

2011-11-16 10:20 . 2011-11-16 10:20 388096 ----a-r- c:\users\Javier\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-16 05:09 . 2011-11-16 05:09 -------- d-----w- c:\windows\system32\Macromed

2011-11-15 22:54 . 2011-11-15 22:54 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-11-15 06:35 . 2011-11-16 17:16 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8D31AE10-2CF0-4D2C-A017-A8DA482FCD53}\offreg.dll