Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.Dropper


  • This topic is locked This topic is locked
3 replies to this topic

#1 donnell500

donnell500

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:23 PM

Posted 28 May 2011 - 01:56 PM

Hello,

My Windows 7 64 bit machine has 2 files that ComboFix tries 2 remove but keep returning.

c:\windows\SysWow64\BDSShellRes.dllBDSShellRes.dll.mui
c:\windows\SysWow64\BDSShellRes150.dllBDSShellRes150.dll.mui

When using RAD Studio XE (C++ Builder) to compile one of my projects , it creates a working but infected executable that tries to start itself minutes after rebooting. Other projects compile fine. MBAM says the file is infected with a Trojan.Dropper virus. I submitted it to them for analysis asking if it was a false positive but they responded by saying to update my MBAM definitions and it won't be detected anymore. The problem is that something still tries to start it minutes after a reboot.

I've attached the logs as requested.

Thanks in advance.

Don

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_25
Run by admin at 14:20:14 on 2011-05-28
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.16367.14093 [GMT -4:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
d:\Program Files\ShrewSoft\VPN Client\dtpd.exe
d:\Program Files\ShrewSoft\VPN Client\iked.exe
d:\Program Files\ShrewSoft\VPN Client\ipsecd.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
D:\Program Files (x86)\UltraVNC\WinVNC.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
D:\Program Files (x86)\UltraVNC\WinVNC.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
D:\LCD_Smartie\LCDSmartie.exe
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\XFastUsb\XFastUsb.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
D:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
D:\Program Files (x86)\CyberLink\InstantBurn\Win2K\IBurn.exe
D:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
D:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Windows\system32\SearchIndexer.exe
d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
D:\Program Files (x86)\Mozilla Firefox\firefox.exe
D:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
D:\Temp\FalsePositive\CBHelp\dds.scr
C:\Windows\SysWOW64\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - D:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
mRun: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe
mRun: [UpdatePSTShortCut] "d:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "d:\Program Files (x86)\CyberLink\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
mRun: [UpdatePPShortCut] "d:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "d:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
mRun: [UpdatePDRShortCut] "d:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "d:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
mRun: [UpdateP2GoShortCut] "d:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "d:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
mRun: [UpdateLBPShortCut] "d:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "d:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [RemoteControl8] "d:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "d:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
mRun: [Malwarebytes' Anti-Malware] "d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun: [InstantBurn] d:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe
mRun: [CLMLServer] "d:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
mRun: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun: [Adobe Reader Speed Launcher] "D:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Adobe Acrobat Speed Launcher] "D:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "D:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - D:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: {07D540C6-68F9-492D-B352-5732B19A494F} = 10.250.2.30
TCP: {84D85C77-B996-4411-9489-62D6E6B03EFB} = 192.168.1.1
TCP: {DDC425E8-8712-435C-9D61-07FC79C81417} = 10.242.6.5
TCP: {F4054BC9-5626-4B04-BB2F-F85BA82CEE9D} = 10.242.6.5
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
mRun-x64: [BCSSync] "D:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\hv9lln5p.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - plugin: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\browser\nppdf32.dll
FF - plugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mv91xx;mv91xx;C:\Windows\system32\DRIVERS\mv91xx.sys --> C:\Windows\system32\DRIVERS\mv91xx.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 AsrAppCharger;AsrAppCharger;C:\Windows\system32\DRIVERS\AsrAppCharger.sys --> C:\Windows\system32\DRIVERS\AsrAppCharger.sys [?]
R1 CLBStor;InstantBurn Storage Helper Driver;C:\Windows\system32\DRIVERS\CLBStor.sys --> C:\Windows\system32\DRIVERS\CLBStor.sys [?]
R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]
R1 vflt;Shrew Soft Lightweight Filter;C:\Windows\system32\DRIVERS\vfilter.sys --> C:\Windows\system32\DRIVERS\vfilter.sys [?]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};Power Control [2011/05/10 06:42:40];D:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [2009-8-28 146928]
R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;C:\Windows\system32\drivers\CLBUDF.sys --> C:\Windows\system32\drivers\CLBUDF.sys [?]
R2 dtpd;ShrewSoft DNS Proxy Daemon;d:\Program Files\ShrewSoft\VPN Client\dtpd.exe -service --> d:\Program Files\ShrewSoft\VPN Client\dtpd.exe -service [?]
R2 iked;ShrewSoft IKE Daemon;d:\Program Files\ShrewSoft\VPN Client\iked.exe -service --> d:\Program Files\ShrewSoft\VPN Client\iked.exe -service [?]
R2 inpoutx64;inpoutx64;C:\Windows\system32\Drivers\inpoutx64.sys --> C:\Windows\system32\Drivers\inpoutx64.sys [?]
R2 ipsecd;ShrewSoft IPSEC Daemon;d:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -service --> d:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -service [?]
R2 MBAMService;MBAMService;D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-5-9 363344]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-5-9 2218600]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-4-8 378472]
R2 uvnc_service;uvnc_service;D:\Program Files (x86)\UltraVNC\winvnc.exe [2011-5-10 1590216]
R2 vpnagent;Cisco AnyConnect VPN Agent;C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2009-12-17 497856]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\system32\Drivers\EtronHub3.sys --> C:\Windows\system32\Drivers\EtronHub3.sys [?]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\system32\Drivers\EtronXHCI.sys --> C:\Windows\system32\Drivers\EtronXHCI.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 PciPPorts;PCI ECP Parallel Port;C:\Windows\system32\DRIVERS\PciPPorts.sys --> C:\Windows\system32\DRIVERS\PciPPorts.sys [?]
R3 RAMDiskVE;RAMDiskVE;C:\Windows\system32\Drivers\RAMDiskVE.sys --> C:\Windows\system32\Drivers\RAMDiskVE.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 scsiscan;SCSI Scanner Driver;C:\Windows\system32\DRIVERS\scsiscan.sys --> C:\Windows\system32\DRIVERS\scsiscan.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-10 136176]
S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-10 136176]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 vnet;Shrew Soft Virtual Adapter;C:\Windows\system32\DRIVERS\virtualnet.sys --> C:\Windows\system32\DRIVERS\virtualnet.sys [?]
S3 VSPerfDrv100;Performance Tools Driver 10.0;D:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-3-18 68440]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-22 61976]
S4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys --> C:\Windows\system32\DRIVERS\RsFx0103.sys [?]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-3-30 427880]
.
=============== Created Last 30 ================
.
2011-05-28 17:56:17 -------- d-sh--w- C:\$RECYCLE.BIN
2011-05-28 07:05:14 0 ---ha-w- C:\Users\admin\AppData\Local\BITB436.tmp
2011-05-28 07:04:29 -------- d-----w- C:\Users\admin\AppData\Local\Diagnostics
2011-05-28 03:46:57 8718160 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B26FCB88-6FD4-49DE-8ECC-B0DF072C94C7}\mpengine.dll
2011-05-26 06:19:19 27648 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\ML1650pc.dll
2011-05-25 12:33:34 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2011-05-24 02:28:56 -------- d-----w- C:\Users\admin\.mplabcomm
2011-05-23 13:31:48 -------- d-----w- C:\Program Files (x86)\Cisco
2011-05-23 13:16:22 -------- d-----w- C:\Users\admin\AppData\Local\Cisco
2011-05-23 13:16:04 -------- d-----w- C:\ProgramData\Cisco
2011-05-22 08:42:29 -------- d-----w- C:\Users\admin\AppData\Local\ElevatedDiagnostics
2011-05-22 00:55:40 -------- d-----w- C:\Users\admin\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-05-22 00:54:58 -------- d-----w- C:\Users\admin\AppData\Roaming\PACE Anti-Piracy
2011-05-22 00:54:58 -------- d-----w- C:\Users\admin\AppData\Roaming\NVIDIA
2011-05-22 00:54:58 -------- d-----w- C:\Users\admin\AppData\Local\PACE Anti-Piracy
2011-05-22 00:54:58 -------- d-----w- C:\ProgramData\PACE Anti-Piracy
2011-05-22 00:33:00 -------- d-----w- C:\ProgramData\ALM
2011-05-22 00:29:41 55280 ------w- C:\Windows\System32\drivers\PxHlpa64.sys
2011-05-22 00:29:41 10224 ------w- C:\Windows\System32\drivers\cdralw2k.sys
2011-05-22 00:29:41 10224 ------w- C:\Windows\System32\drivers\cdr4_xp.sys
2011-05-22 00:29:41 -------- d-----w- C:\Program Files (x86)\My Company Name
2011-05-22 00:29:41 -------- d-----w- C:\Program Files (x86)\Common Files\Sonic Shared
2011-05-22 00:29:41 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
2011-05-20 01:20:45 -------- d-----w- C:\Users\admin\MPLABXProjects
2011-05-20 01:20:45 -------- d-----w- C:\Users\admin\.netbeans
2011-05-20 01:20:43 -------- d-----w- C:\Users\admin\AppData\Roaming\.mplab_ide
2011-05-20 01:20:03 45056 ----a-w- C:\Windows\SysWow64\mchpwinusbdevice.exe
2011-05-20 01:20:03 4388284 ----a-w- C:\Windows\SysWow64\USBAccessLink.dll
2011-05-20 01:20:03 -------- d-----w- C:\MPLAB_msys
2011-05-19 22:07:01 24416 ----a-r- C:\Windows\System32\AdobePDFUI.dll
2011-05-15 08:03:53 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
2011-05-15 01:48:56 -------- d-----w- C:\VueScan
2011-05-15 00:36:49 -------- d-----w- C:\Windows\System32\SPReview
2011-05-15 00:36:09 -------- d-----w- C:\Windows\System32\EventProviders
2011-05-15 00:34:59 94592 ----a-w- C:\Windows\System32\drivers\mountmgr.sys
2011-05-15 00:18:35 88168 ----a-w- C:\Windows\System32\drivers\djsvs.sys
2011-05-13 20:43:14 -------- d-----r- C:\Users\admin\Virtual Machines
2011-05-13 05:04:54 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-05-13 04:39:21 -------- d--h--w- C:\Program Files (x86)\Zero G Registry
2011-05-13 04:38:13 -------- d--h--w- C:\Users\admin\InstallAnywhere
2011-05-11 19:25:40 -------- d-----w- C:\ProgramData\LightScribe
2011-05-11 07:42:19 96768 ----a-w- C:\Windows\System32\fsutil.exe
2011-05-11 07:31:23 -------- d-----w- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2011-05-11 07:30:43 8718160 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-05-11 07:30:12 5562240 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-05-11 07:30:11 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-05-11 07:30:11 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-05-11 07:30:10 214016 ----a-w- C:\Windows\System32\winsrv.dll
2011-05-11 07:29:28 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2011-05-11 07:29:28 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys
2011-05-11 07:29:28 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys
2011-05-11 07:29:28 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
2011-05-11 07:29:28 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys
2011-05-11 07:29:28 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys
2011-05-11 07:29:28 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys
2011-05-11 04:21:26 -------- d-----w- C:\Program Files (x86)\Common Files\Macrovision Shared
2011-05-11 04:20:45 52568 ----a-w- C:\Windows\System32\AdobePDF.dll
2011-05-11 04:00:10 -------- d-----w- C:\Program Files\Microsoft Analysis Services
2011-05-11 04:00:10 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2011-05-10 21:49:01 -------- d-----w- C:\Users\admin\Oracle
2011-05-10 19:29:20 98816 ----a-w- C:\Windows\sed.exe
2011-05-10 19:29:20 89088 ----a-w- C:\Windows\MBR.exe
2011-05-10 19:29:20 256512 ----a-w- C:\Windows\PEV.exe
2011-05-10 19:29:20 161792 ----a-w- C:\Windows\SWREG.exe
2011-05-10 18:19:37 -------- d-----w- C:\Windows\SysWow64\Wat
2011-05-10 18:19:37 -------- d-----w- C:\Windows\System32\Wat
2011-05-10 17:45:58 -------- d-----w- C:\Windows\SysWow64\Adobe
2011-05-10 17:00:28 -------- d-----w- C:\ProgramData\Xceed Software
2011-05-10 16:46:29 -------- d-----w- C:\Users\admin\AppData\Local\Google
2011-05-10 16:44:20 -------- d-----w- C:\Users\admin\AppData\Roaming\Subversion
2011-05-10 16:43:26 -------- d-----w- C:\Users\admin\AppData\Roaming\AutomatedQA
2011-05-10 16:43:26 -------- d-----w- C:\ProgramData\AutomatedQA
2011-05-10 16:43:23 -------- d-----w- C:\Users\admin\AppData\Local\Embarcadero
2011-05-10 16:40:12 -------- d-----w- C:\Users\admin\AppData\Local\AutomatedQA
2011-05-10 16:38:05 -------- d-----w- C:\Users\admin\AppData\Local\Microsoft Help
2011-05-10 16:37:47 -------- dc-h--w- C:\ProgramData\{24490CF3-C9E8-479D-A4FB-DF7579FE6FB8}
2011-05-10 16:35:14 1290752 ----a-w- C:\Windows\SysWow64\Rave90VCL150.bpl
2011-05-10 16:34:52 475136 ----a-w- C:\Windows\SysWow64\CodeSiteExpressVcl150.bpl
2011-05-10 16:34:52 40448 ----a-w- C:\Windows\SysWow64\CSPlugInSupport120.bpl
2011-05-10 16:34:52 22528 ----a-w- C:\Windows\SysWow64\CodeSitePlugIns120.bpl
2011-05-10 16:34:52 1995776 ----a-w- C:\Windows\SysWow64\vcl120.bpl
2011-05-10 16:34:52 1092608 ----a-w- C:\Windows\SysWow64\rtl120.bpl
2011-05-10 16:34:52 -------- d-----w- C:\ProgramData\Raize
2011-05-10 16:34:00 150528 ----a-w- C:\Windows\SysWow64\TLBINF32.dll
2011-05-10 16:34:00 -------- d-----w- C:\ProgramData\VSoft
2011-05-10 16:33:57 -------- d-----w- C:\Program Files (x86)\Common Files\VSoft
2011-05-10 16:28:05 -------- dc-h--w- C:\ProgramData\{F032A669-4CBD-4617-B8D8-AE720D835654}
2011-05-10 16:27:42 -------- d-----w- C:\Users\admin\AppData\Roaming\Embarcadero
2011-05-10 16:27:42 -------- d-----w- C:\ProgramData\Embarcadero
2011-05-10 16:27:35 -------- d-----w- C:\Program Files (x86)\Common Files\Borland Shared
2011-05-10 16:22:16 -------- d--h--w- C:\ProgramData\{7DE921C9-42C8-4DA3-8A44-043C3349FD1D}
2011-05-10 16:03:23 -------- d-----w- C:\Users\admin\AppData\Local\SourceGear
2011-05-10 15:49:47 -------- d-----w- C:\Users\admin\AppData\Roaming\Microsoft Corporation
2011-05-10 15:47:21 78872 ----a-w- C:\Windows\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2011-05-10 15:47:21 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2011-05-10 15:47:18 79896 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2011-05-10 15:47:18 111640 ----a-w- C:\Windows\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2011-05-10 15:47:00 -------- d-----w- C:\Windows\System32\RsFx
2011-05-10 15:45:02 -------- d-----w- C:\Program Files\Microsoft SQL Server
2011-05-10 15:44:52 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2011-05-10 15:44:21 -------- d-----w- C:\Program Files\Microsoft Synchronization Services
2011-05-10 15:44:21 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition
2011-05-10 15:44:17 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2011-05-10 15:44:17 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-05-10 15:43:40 -------- d-----w- C:\ProgramData\PreEmptive Solutions
2011-05-10 15:42:29 -------- d-----w- C:\Program Files (x86)\Microsoft ASP.NET
2011-05-10 15:42:26 -------- d-----w- C:\Program Files\IIS
2011-05-10 15:42:26 -------- d-----w- C:\Program Files (x86)\IIS
2011-05-10 15:42:00 2420672 ----a-w- C:\ProgramData\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2011-05-10 15:40:49 -------- d-----w- C:\Windows\SysWow64\1033
2011-05-10 15:40:43 -------- d-----w- C:\Program Files (x86)\Microsoft F#
2011-05-10 15:40:43 -------- d-----w- C:\Program Files (x86)\HTML Help Workshop
2011-05-10 15:40:43 -------- d-----w- C:\Program Files (x86)\Common Files\Merge Modules
2011-05-10 15:34:14 -------- d-----w- C:\Windows\System32\1033
2011-05-10 15:34:14 -------- d-----w- C:\Program Files\Microsoft Visual Studio 10.0
2011-05-10 15:34:14 -------- d-----w- C:\Program Files\Microsoft Help Viewer
2011-05-10 15:33:41 -------- d-----w- C:\Windows\PCHEALTH
2011-05-10 15:27:31 -------- d-----w- C:\Users\admin\AppData\Roaming\uTorrent
2011-05-10 14:36:29 -------- d-----w- C:\Users\admin\AppData\Roaming\UltraVNC
2011-05-10 13:57:25 -------- d-----w- C:\Users\admin\.datastudio
2011-05-10 13:01:46 974336 ----a-w- C:\Windows\System32\WFS.exe
2011-05-10 13:01:46 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
2011-05-10 13:01:46 287744 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-05-10 13:01:46 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2011-05-10 13:01:46 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2011-05-10 13:01:46 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2011-05-10 12:53:30 -------- d-----w- C:\Users\admin\AppData\Roaming\CoreFTP
2011-05-10 12:14:14 450560 ----a-w- C:\Windows\SysWow64\fbclient.dll
2011-05-10 11:45:55 -------- d-----w- C:\Users\admin\AppData\Local\Power2Go
2011-05-10 11:42:30 -------- d-----w- C:\Program Files (x86)\Common Files\CyberLink
2011-05-10 11:41:57 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2011-05-10 11:41:57 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2011-05-10 11:41:57 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2011-05-10 11:38:01 376304 ----a-w- C:\Windows\System32\drivers\CLBUDF.sys
2011-05-10 11:38:00 24560 ----a-w- C:\Windows\System32\drivers\CLBStor.sys
2011-05-10 11:37:54 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-05-10 11:37:54 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-05-10 11:37:54 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-05-10 11:37:53 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-05-10 11:10:02 31808 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS
2011-05-09 17:43:59 -------- d-----w- C:\Users\admin\AppData\Roaming\Malwarebytes
2011-05-09 17:43:57 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-09 17:43:57 -------- d-----w- C:\ProgramData\Malwarebytes
2011-05-09 17:43:54 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-05-09 16:39:30 -------- d-----w- C:\Program Files\MOSCHIP
2011-05-09 08:35:18 -------- d-----w- C:\Windows\Panther
2011-05-09 08:27:22 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
2011-05-09 08:25:51 -------- d-----w- C:\NVIDIA
2011-05-09 08:24:13 -------- d-----w- C:\Temp
2011-05-09 08:16:59 -------- d-----w- C:\Windows\System32\appmgmt
2011-05-09 08:14:39 -------- d-----w- C:\ProgramData\Norton
2011-05-09 08:13:47 -------- d-----w- C:\ProgramData\NortonInstaller
2011-05-09 08:13:43 -------- d--h--w- C:\ProgramData\{8533ADFA-85F0-4dc1-946A-2A0BA58E78E3}
2011-05-09 08:13:42 -------- d-----w- C:\Users\admin\AppData\Roaming\DeviceVm
2011-05-09 08:13:19 729088 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2011-05-09 08:13:19 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2011-05-09 08:13:19 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2011-05-09 08:13:19 311428 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2011-05-09 08:13:19 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2011-05-09 08:13:19 192512 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2011-05-09 08:13:19 188548 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2011-05-09 08:13:19 -------- d-----w- C:\Program Files (x86)\Creative
2011-05-09 08:11:59 15936 ----a-w- C:\Windows\System32\drivers\FNETURPX.SYS
2011-05-09 08:11:59 -------- d-----w- C:\ProgramData\FNET
2011-05-09 08:11:59 -------- d-----w- C:\Program Files (x86)\XFastUsb
2011-05-09 08:11:54 -------- d-----w- C:\Program Files (x86)\ASRock Utility
2011-05-09 08:11:51 15368 ----a-w- C:\Windows\System32\drivers\AsrAppCharger.sys
2011-05-09 08:11:51 -------- d-----w- C:\Program Files\ASRock Utility
2011-05-09 08:09:20 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
2011-05-09 08:09:17 56344 ----a-w- C:\Windows\System32\drivers\HECIx64.sys
2011-05-09 08:09:07 -------- d-----w- C:\Program Files (x86)\Marvell
2011-05-09 08:07:59 80984 ----a-w- C:\Windows\System32\MBWrp64.dll
2011-05-09 08:05:59 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll
2011-05-09 08:05:57 -------- d-----w- C:\Intel
2011-05-09 05:26:16 -------- d-----w- C:\Users\admin\Unigine Heaven
2011-05-09 05:18:02 15008 ----a-w- C:\Windows\System32\drivers\inpoutx64.sys
2011-05-08 18:30:38 3026 ----a-w- C:\Windows\SysWow64\drivers\hwinterfacex64.sys
2011-05-08 18:25:12 -------- d-----w- C:\Users\admin\AppData\Local\Mozilla
2011-05-08 18:06:58 -------- d-----w- C:\Users\admin\AppData\Local\Adobe
2011-05-08 17:50:36 270720 ------w- C:\Windows\System32\MpSigStub.exe
.
==================== Find3M ====================
.
2011-05-15 00:38:38 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-05-15 00:38:38 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-05-08 18:48:34 96768 ----a-w- C:\Windows\System32\drivers\PciPPorts.sys
2011-05-08 18:48:34 77312 ----a-w- C:\Windows\System32\PciPorts.dll
2011-05-08 18:48:34 68608 ----a-w- C:\Windows\System32\drivers\PciIsaSerial.sys
2011-05-08 18:48:34 122880 ----a-w- C:\Windows\System32\drivers\PciSPorts.sys
2011-04-09 06:58:56 142336 ----a-w- C:\Windows\System32\poqexec.exe
2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
2011-04-08 06:19:38 117864 ----a-w- C:\Windows\System32\nvmctray.dll
2011-04-08 06:19:36 797288 ----a-w- C:\Windows\System32\easyUpdatusAPIU64.dll
2011-04-08 06:19:36 61032 ----a-w- C:\Windows\System32\nvshext.dll
2011-04-08 06:19:36 1012328 ----a-w- C:\Windows\System32\nvvsvc.exe
2011-04-08 06:19:26 6338152 ----a-w- C:\Windows\System32\nvcpl.dll
2011-04-08 06:19:08 3041384 ----a-w- C:\Windows\System32\nvsvc64.dll
2011-03-12 12:08:49 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-03-12 11:23:45 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-03-11 06:41:37 189824 ----a-w- C:\Windows\System32\drivers\storport.sys
2011-03-11 06:41:34 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys
2011-03-11 06:41:34 1659776 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2011-03-11 06:41:34 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys
2011-03-11 06:41:26 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys
2011-03-11 06:41:12 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys
2011-03-11 06:41:12 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys
2011-03-11 06:34:51 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
2011-03-11 06:34:50 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2011-03-11 06:33:29 2565632 ----a-w- C:\Windows\System32\esent.dll
2011-03-11 05:33:59 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
2011-03-11 05:33:59 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
2011-03-11 05:33:09 1699328 ----a-w- C:\Windows\SysWow64\esent.dll
2011-03-11 05:31:07 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe
2011-03-08 06:29:32 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-03-08 05:28:29 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2011-03-04 06:19:28 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:19:27 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 15:59:24 29288 ----a-w- C:\Windows\System32\nvhdap64.dll
2011-03-03 15:59:18 174184 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys
2011-03-03 15:59:17 1359976 ----a-w- C:\Windows\System32\nvhdagenco642040.dll
2011-03-03 06:24:16 183296 ----a-w- C:\Windows\System32\dnsrslvr.dll
2011-03-03 06:21:57 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe
2011-03-03 05:36:16 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe
2011-03-03 03:52:08 3135488 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 14:20:23.17 ===============

I renamed these two files in the c:\windows\SysWow64 folder and ComboFix no longer had any file deletion issues upon completion.

BDSShellRes.dll
BDSShellRes150.dll

No viruses found in them either (verified by ComboFix, MalwareBytes, and VirusTotal.com)

Strange.

Thanks

Don

EDIT: Posts merged ~Budapest

Attached Files


Edited by Budapest, 30 May 2011 - 01:18 AM.


BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:01:23 PM

Posted 09 June 2011 - 10:23 AM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :)

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Running OTL

We need to create a FULL OTL Report
  • Please download OTL from here:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:01:23 PM

Posted 11 June 2011 - 08:23 AM

Do you still need help with your machine?

If the instructions are unclear or something isn't working, please let me know before proceeding.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:01:23 PM

Posted 12 June 2011 - 11:50 AM

Due to lack of feedback this thread will now be closed. If you still require assistance, and would like to have your thread re-opened, please feel free to send me a Private Message (PM) being sure to include a link to your topic, and I'd be happy to re-open it.


Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users