Mshta.exe infection

Yesterday, I noticed a few instances of mshta.exe running in my task manager. They fluctuate from 1 to over 10. There are also sometimes 1 or 2 iexplore.exe processes running under SYSTEM (I use Firefox). I scanned with Malwarebytes' Anti Malware yesterday, and it found quite a bit of infections, however, I'm still having the same problem. It found 4 infections of Backdoor.bot, 3 infections of Stolen.data, 3 infections of Trojan.fakealert, 1 infection of Malware.trace, and 1 infection of Hijack.Userinit. Thank you very much!

Hello and welcome. The legitimate Mshta.exe will be found at C:\WINDOWS\System32\mshta.exe
Verify the disk location to make sure it is not malware related. Quite often virus writers use similiar names or place the same names in other folders in an attempt to fool you into thinking it is a good file. This mshta.exe file is a critical Windows file, it is used to open hta file types.

Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal/regular mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Please ask any needed questions,post logs and Let us know how the PC is running now.

Thanks a lot! I did all the steps mentioned here, however, my Malwarebytes' scan crashed while scanning System32 (I tried it two times, it crashed in the same place, I think after vbscript.dll). Before this, it found 2 infections. I verified the location of mshta.exe, and it is indeed in the right place.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/08/2010 at 01:14 AM

Application Version : 4.44.1000

Core Rules Database Version : 5652
Trace Rules Database Version: 3464

Scan type : Complete Scan
Total Scan Time : 05:06:12

Memory items scanned : 258
Memory threats detected : 0
Registry items scanned : 6634
Registry threats detected : 0
File items scanned : 121413
File threats detected : 91

Adware.Tracking Cookie
C:\Documents and Settings\Test\Cookies\test@adecn[4].txt
C:\Documents and Settings\Test\Cookies\test@invitemedia[2].txt
C:\Documents and Settings\Test\Cookies\test@CAJCRDOA.txt
media1.clubpenguin.com [ C:\Documents and Settings\Test\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\JLENZMLC ]
.doubleclick.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
stats.gamestop.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.dmtracker.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.myroitracking.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.adserving.contextualmarketplace.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.adserving.contextualmarketplace.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.apmebf.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.adlegend.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.adlegend.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.gaiainteractive.112.2o7.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.msnportal.112.2o7.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.tripod.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.adtech.de [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.commonsensemedia.org [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
adserver.adreactor.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
adserver.overclock.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.fastclick.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
optimize.indieclick.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
ad.zanox.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.kontera.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.media6degrees.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.bravenet.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
us.sitestat.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
us.sitestat.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.mvtracker.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.mvtracker.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
adult.megaden.net [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
.mediafire.com [ C:\Documents and Settings\Test\Administrator\Application Data\Mozilla\Firefox\Profiles\ffecz3sr.default\cookies.sqlite ]
a.ads2.msads.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
ads2.msads.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
b.ads2.msads.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
cdn.insights.gravity.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
cdn2.themis-media.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
cdn4.specificclick.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
ia.media-imdb.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
media.ign.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
media.mtvnservices.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
media1.break.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
mediaforgews.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
msnbcmedia.msn.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
s0.2mdn.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
secure-us.imrworldwide.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
udn.specificclick.net [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]
www.soundclick.com [ C:\Documents and Settings\Test\Application Data\Macromedia\Flash Player\#SharedObjects\5W7AWC7P ]

Hello, let's do an online scan and then try MBAm again.


ESET

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the ESET Online Scanner button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on Export to text file... to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the Eset Smart Installer icon on your desktop.
• Check the "YES, I accept the Terms of Use"
• Click the Start button.
• Accept any security warnings from your browser.
• Check Scan archives
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push "List of found threats"
• Push "Export to text file", and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the "<<Back" button.
• Push Finish

In your next reply, please include the following:

• Eset Scan Log

NOTE: In some instances if no malware is found there will be no log produced.

ESET found one infection.

C:\WINDOWS\kbkbLA.dll a variant of Win32/Cimag.DJ trojan cleaned by deleting - quarantined

Ok, can you update and rerun MBAM now?

I was able to update MBAM to its newest definitions, but it still crashed in the same place.

Hello, Is this XP? I forgot to say this earlier... about these backdoor and Bots we found.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

This may fix the MBAM error vbscript.dll).
Download MSFT Visual Basic from here
http://www.microsoft.com/downloads/details...;displaylang=en

Instructions


Before starting the download, create a download directory on your computer. If your internet connection is less than 300K, it is recommended that you run the multi-part download by following the "More Information" link at the upper right, then clicking "Download Now."

Click "Download" to begin downloading the single download. When prompted by the download software, choose the option "Save this program to disk" and click OK. Then select the directory you created on your computer.

Run the file from the download directory. When prompted, select the same directory you created on your computer. You will be expanding the contents of the EXE into this directory.

Run SetupSP6.exe from the download directory. When you accept the terms of the electronic End User License Agreement (EULA) the setup software will replace the appropriate files in your Visual Basic 6.0 installation.

Yes, this computer is Windows XP, sorry that I didn't mention it. Luckily, this computer does not contain any sensitive information. I tried to install Visual Basic 6.0, but it always ends quickly with the message "Visual Studio 6.0 Service Pack 6 Setup was not completed successfully."

OK I think it's being blocked.

Please ensure these items are excluded from your Antivirus AND your Firewall - 12007 error usually means that the download is being blocked -

Exclude Malwarebytes' Anti-Malware's Files and Folders From Other Active Security Programs:

For Windows XP:

•C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
•C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
•C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
•C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
•C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
•C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
•C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
•C:\Windows\System32\drivers\mbam.sys
•C:\Windows\System32\drivers\mbamswissarmy.sys


The FAQ contains examples of setting file exclusions for some known AV products

I use Avast and COMODO, and I added those exceptions for each of them. MBAM still crashed at the same spot. Oh, and about the 12007 error, there is no error message from MBAM, it just crashes with the "Please tell Microsoft about your problem" window.

I suspect a rootkit in the userinit..

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

GMER 1.0.15.15315 - http://www.gmer.net
Rootkit scan 2010-10-16 20:17:43
Windows 5.1.2600 Service Pack 3
Running: v6v3vktk.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x62 0xE6 0x42 0x11 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x0D 0xD5 0x07 0xEF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE9 0x91 0x43 0x7F ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x67 0xAD 0x35 0x38 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFD 0xDC 0x70 0x97 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x15 0x12 0xAA 0xC6 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x62 0xE6 0x42 0x11 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x0D 0xD5 0x07 0xEF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE9 0x91 0x43 0x7F ...

---- Files - GMER 1.0.15 ----

File C:\1168a0798545f322716e\support\idndl.dll 26112 bytes executable
File C:\1168a0798545f322716e\support\nlsdl.dll 24576 bytes executable
File C:\1168a0798545f322716e\support\normaliz.dll 23552 bytes executable
File C:\1168a0798545f322716e\support\normidna.nls 59342 bytes
File C:\1168a0798545f322716e\support\normnfc.nls 45794 bytes
File C:\1168a0798545f322716e\support\normnfd.nls 39284 bytes
File C:\1168a0798545f322716e\support\normnfkc.nls 66384 bytes
File C:\1168a0798545f322716e\support\normnfkd.nls 60294 bytes
File C:\1168a0798545f322716e\support\xmllite.dll 121856 bytes executable
File C:\1168a0798545f322716e\update\eula.rtf 5630 bytes
File C:\1168a0798545f322716e\update\ie8.cat 47422 bytes
File C:\1168a0798545f322716e\update\iecustom.dll 58464 bytes executable
File C:\1168a0798545f322716e\update\iesetup.exe 1113696 bytes executable
File C:\1168a0798545f322716e\update\sqmapi.dll 141408 bytes executable
File C:\1168a0798545f322716e\update\update.exe 755744 bytes executable
File C:\1168a0798545f322716e\update\update.exe.manifest 781 bytes
File C:\1168a0798545f322716e\update\update.inf 1474411 bytes
File C:\1168a0798545f322716e\update\update.ver 10416 bytes
File C:\1168a0798545f322716e\update\updspapi.dll 382496 bytes executable
File C:\f93530c42fe98ba92e5c\support\idndl.dll 26112 bytes executable
File C:\f93530c42fe98ba92e5c\support\nlsdl.dll 24576 bytes executable
File C:\f93530c42fe98ba92e5c\support\normaliz.dll 23552 bytes executable
File C:\f93530c42fe98ba92e5c\support\normidna.nls 59342 bytes
File C:\f93530c42fe98ba92e5c\support\normnfc.nls 45794 bytes
File C:\f93530c42fe98ba92e5c\support\normnfd.nls 39284 bytes
File C:\f93530c42fe98ba92e5c\support\normnfkc.nls 66384 bytes
File C:\f93530c42fe98ba92e5c\support\normnfkd.nls 60294 bytes
File C:\f93530c42fe98ba92e5c\support\xmllite.dll 121856 bytes executable
File C:\f93530c42fe98ba92e5c\update\eula.rtf 5630 bytes
File C:\f93530c42fe98ba92e5c\update\ie8.cat 47422 bytes
File C:\f93530c42fe98ba92e5c\update\iecustom.dll 58464 bytes executable
File C:\f93530c42fe98ba92e5c\update\iesetup.exe 1113696 bytes executable
File C:\f93530c42fe98ba92e5c\update\sqmapi.dll 141408 bytes executable
File C:\f93530c42fe98ba92e5c\update\update.exe 755744 bytes executable
File C:\f93530c42fe98ba92e5c\update\update.exe.manifest 781 bytes
File C:\f93530c42fe98ba92e5c\update\update.inf 1474411 bytes
File C:\f93530c42fe98ba92e5c\update\update.ver 10416 bytes
File C:\f93530c42fe98ba92e5c\update\updspapi.dll 382496 bytes executable
File C:\System Volume Information\MountPointManagerRemoteDatabase 0 bytes
File C:\System Volume Information\tracking.log 40960 bytes

Then there's a HUGE amount of things under System Volume Information, I was trying to fit it, but I was having major difficulties even putting it in multiple posts, but I can try, if I need to. They are all under C:\System Volume Information\_restore