Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet Explorer Hijacked - redirects to brosive.com


  • This topic is locked This topic is locked
52 replies to this topic

#1 Rovot

Rovot

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 03 February 2012 - 07:16 AM

my main browser is Chrome but about every 30 minutes or so, Internet Explorer pops us and opens brosive.com and/or therugged.com

I've already tried a few tools but I haven't caught it.

here is my DDS log:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Guillermo at 6:09:20 on 2012-02-03
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3874.1568 [GMT -6:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Tablet\Pen\Pen_TouchService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Windows\TEMP\mrt71F4.tmp\stdrt.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Windows\System32\rundll32.exe
C:\Windows\vsnp2uvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files\PeerBlock\peerblock.exe
C:\Users\Guillermo\Local Settings\Apps\F.lux\flux.exe
C:\Program Files\CrashPlan\CrashPlanTray.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Users\Guillermo\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\CrashPlan\CrashPlanService.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Guillermo\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://asus.msn.com
mDefault_Page_URL = hxxp://asus.msn.com
mStart Page = hxxp://asus.msn.com
mWinlogon: Userinit=userinit.exe,
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
uRun: [Google Update] "C:\Users\Guillermo\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
uRun: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe
uRun: [F.lux] "C:\Users\Guillermo\Local Settings\Apps\F.lux\flux.exe" /noshow
mRun: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
mRun: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
mRun: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
mRun: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe /autostart
StartupFolder: C:\Users\GUILLE~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Guillermo\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CRASHP~1.LNK - C:\Program Files (x86)\CrashPlan\CrashPlanTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\RAINME~1.LNK - C:\Program Files\Rainmeter\Rainmeter.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{4101B8BE-0D8D-48E5-9CCA-DCB5B4279CB3} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{4101B8BE-0D8D-48E5-9CCA-DCB5B4279CB3}\16474777966696 : DhcpNameServer = 192.168.4.1 64.134.255.2 64.134.255.10
TCP: Interfaces\{4101B8BE-0D8D-48E5-9CCA-DCB5B4279CB3}\642756561457374796E675966496E236F6D6D224162766C6977237 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{4101B8BE-0D8D-48E5-9CCA-DCB5B4279CB3}\6627F6E64737964656F5762796E646 : DhcpNameServer = 209.18.47.61 209.18.47.62
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
mRun-x64: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
mRun-x64: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
mRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
mRun-x64: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
mRun-x64: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
mRun-x64: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun-x64: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun-x64: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
mRun-x64: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe /autostart
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys --> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-5-25 17536]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-4-21 1136640]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-3-30 923984]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-3-30 1001808]
R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-4-21 134928]
R2 CrashPlanService;CrashPlan Backup Service;C:\Program Files\CrashPlan\CrashPlanService.exe [2011-3-16 222720]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-8-25 13672]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-12-23 2152152]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-1-27 1153368]
R2 SplashtopRemoteService;Splashtop® Remote Service;C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2011-12-21 529768]
R2 SSUService;Splashtop Software Updater Service;C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2011-11-10 370504]
R2 TabletServicePen;TabletServicePen;C:\Program Files\Tablet\Pen\Pen_Tablet.exe [2012-1-6 6583160]
R2 TouchServicePen;Wacom Consumer Touch Service;C:\Program Files\Tablet\Pen\Pen_TouchService.exe [2012-1-6 528760]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-7-25 2656280]
R3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\system32\DRIVERS\AMPPAL.sys --> C:\Windows\system32\DRIVERS\AMPPAL.sys [?]
R3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\system32\DRIVERS\lgandbus64.sys --> C:\Windows\system32\DRIVERS\lgandbus64.sys [?]
R3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\system32\DRIVERS\lganddiag64.sys --> C:\Windows\system32\DRIVERS\lganddiag64.sys [?]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\system32\DRIVERS\lgandgps64.sys --> C:\Windows\system32\DRIVERS\lgandgps64.sys [?]
R3 ANDModem;LGE Android Platform USB Modem;C:\Windows\system32\DRIVERS\lgandmodem64.sys --> C:\Windows\system32\DRIVERS\lgandmodem64.sys [?]
R3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\lgandadb.sys --> C:\Windows\system32\Drivers\lgandadb.sys [?]
R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-3-30 1321296]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 iwdbus;IWD Bus Enumerator;C:\Windows\system32\DRIVERS\iwdbus.sys --> C:\Windows\system32\DRIVERS\iwdbus.sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2012-2-2 17152]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys --> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
R3 pbfilter;pbfilter;C:\Program Files\PeerBlock\pbfilter.sys [2012-1-6 24176]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
R3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys --> C:\Windows\system32\DRIVERS\WDKMD.sys [?]
S2 Adobe Licensing Console;Adobe Licensing Console;C:\Windows\SysWOW64\adbcnsl.exe [2012-1-7 689492]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\system32\DRIVERS\amppal.sys --> C:\Windows\system32\DRIVERS\amppal.sys [?]
S3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\system32\DRIVERS\btmaux.sys --> C:\Windows\system32\DRIVERS\btmaux.sys [?]
S3 btmhsf;btmhsf;C:\Windows\system32\DRIVERS\btmhsf.sys --> C:\Windows\system32\DRIVERS\btmhsf.sys [?]
S3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 iBtFltCoex;iBtFltCoex;C:\Windows\system32\DRIVERS\iBtFltCoex.sys --> C:\Windows\system32\DRIVERS\iBtFltCoex.sys [?]
S3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\system32\drivers\intelaud.sys --> C:\Windows\system32\drivers\intelaud.sys [?]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-5-2 340240]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-02-03 10:33:46 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E0C6DC08-6F8A-45D2-836D-D601F237E674}\offreg.dll
2012-02-03 10:10:41 8602168 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E0C6DC08-6F8A-45D2-836D-D601F237E674}\mpengine.dll
2012-02-03 08:10:27 35712 ----a-w- C:\Windows\SysWow64\drivers\BlackBox.sys
2012-02-03 04:17:12 -------- d-----w- C:\ProgramData\Kaspersky Lab
2012-02-03 03:24:35 -------- d-----w- C:\Users\Guillermo\AppData\Local\Sunbelt Software
2012-02-03 01:38:59 69376 ----a-w- C:\Windows\System32\drivers\Lbd.sys
2012-02-03 00:49:02 -------- d-----w- C:\Program Files (x86)\ESET
2012-02-03 00:45:34 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-02-03 00:45:34 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-02 18:35:22 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-02 02:03:35 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
2012-02-02 01:50:16 -------- d-----w- C:\Program Files (x86)\Lavasoft
2012-02-02 01:46:26 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\SUPERAntiSpyware.com
2012-02-02 01:45:22 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Malwarebytes
2012-02-02 01:45:07 -------- d-----w- C:\ProgramData\Malwarebytes
2012-02-01 18:06:06 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2012-02-01 18:06:06 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2012-02-01 18:06:06 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2012-02-01 18:06:06 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2012-02-01 18:06:06 -------- d-----w- C:\Program Files (x86)\OpenAL
2012-02-01 18:03:04 -------- d-----w- C:\Users\Guillermo\AppData\Local\2DBoy
2012-02-01 18:03:04 -------- d-----w- C:\ProgramData\2DBoy
2012-02-01 16:25:06 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
2012-01-31 05:46:14 -------- d-----w- C:\Users\Guillermo\AppData\Local\Programs
2012-01-29 23:59:31 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-01-27 11:43:21 200976 ----a-w- C:\Windows\SysWow64\drivers\tmcomm.sys
2012-01-27 11:31:52 -------- d-----w- C:\Program Files (x86)\Trend Micro
2012-01-27 07:56:30 -------- d-----w- C:\ProgramData\Soulseek
2012-01-27 07:56:18 -------- d-----w- C:\Program Files (x86)\SoulseekNS
2012-01-27 07:31:41 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2012-01-27 07:31:41 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2012-01-26 06:03:56 -------- d-----w- C:\Users\Guillermo\.config
2012-01-25 18:49:25 -------- d-----w- C:\Program Files (x86)\Steam
2012-01-25 07:27:55 -------- d-----w- C:\ProgramData\Age of Empires 3
2012-01-25 07:20:22 -------- d-----w- C:\Program Files (x86)\Common Files\Microsoft Games
2012-01-25 07:13:08 -------- d-----w- C:\Program Files (x86)\Microsoft Games
2012-01-23 20:14:07 -------- d-----w- C:\Users\Guillermo\riotsGamesLogs
2012-01-23 19:34:58 -------- d-----w- C:\Games
2012-01-23 19:34:28 -------- d-----w- C:\Users\Guillermo\AppData\Local\Black_Tree_Gaming
2012-01-20 00:59:10 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\com.adobe.kuler.Desktop.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2012-01-20 00:59:09 -------- d-----w- C:\Program Files (x86)\Adobe kuler
2012-01-20 00:35:47 -------- d-----w- C:\Program Files\Common Files\Propellerhead Software
2012-01-19 22:50:31 -------- d---a-w- C:\.Trash-1000
2012-01-19 21:40:30 -------- d-----w- C:\Program Files (x86)\Common Files\AnswerWorks 5.0
2012-01-17 19:55:17 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\com.adobe.DC3Module.AdobeADC
2012-01-17 03:34:11 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Foxit Software
2012-01-16 17:19:09 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\LolClient
2012-01-14 19:19:27 467984 ----a-w- C:\Windows\SysWow64\d3dx10_39.dll
2012-01-14 19:19:27 1493528 ----a-w- C:\Windows\SysWow64\D3DCompiler_39.dll
2012-01-14 19:19:25 3851784 ----a-w- C:\Windows\SysWow64\D3DX9_39.dll
2012-01-14 19:14:35 -------- d-----w- C:\Riot Games
2012-01-12 02:51:06 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\REAPER
2012-01-12 02:49:37 -------- d-----w- C:\Program Files\REAPER (x64)
2012-01-11 18:26:24 4200024 ----a-w- C:\Windows\SysWow64\cdintf400.dll
2012-01-11 16:18:26 1572864 ----a-w- C:\Windows\System32\quartz.dll
2012-01-11 16:18:25 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2012-01-11 16:18:25 366592 ----a-w- C:\Windows\System32\qdvd.dll
2012-01-11 16:18:25 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-01-11 16:18:24 1731920 ----a-w- C:\Windows\System32\ntdll.dll
2012-01-11 16:18:24 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
2012-01-11 16:18:23 77312 ----a-w- C:\Windows\System32\packager.dll
2012-01-11 16:18:23 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-01-11 09:03:38 -------- d-----w- C:\Program Files\Common Files\Intuit
2012-01-11 08:59:23 -------- d-----w- C:\Users\Guillermo\AppData\Local\Intuit
2012-01-11 08:55:40 -------- d-----w- C:\Program Files (x86)\Intuit
2012-01-11 08:55:27 -------- d-----w- C:\ProgramData\SQL Anywhere 11
2012-01-11 08:55:26 -------- d-----w- C:\ProgramData\COMMON FILES
2012-01-11 08:55:16 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
2012-01-11 08:47:43 -------- d-----w- C:\Windows\Intuit
2012-01-11 06:06:15 258048 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpfppw73.dll
2012-01-11 06:06:04 -------- d-----w- C:\Program Files\Common Files\EPSON
2012-01-11 06:06:02 -------- d-----w- C:\ProgramData\EPSON
2012-01-11 06:05:36 82944 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPP9I.DLL
2012-01-11 06:05:36 27648 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPD9I.DLL
2012-01-10 18:06:19 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Intuit
2012-01-10 18:05:21 -------- d-----w- C:\Users\Guillermo\AppData\Local\IsolatedStorage
2012-01-10 18:05:19 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
2012-01-10 18:02:35 -------- d-----w- C:\Program Files (x86)\TurboTax
2012-01-10 18:02:13 -------- d-----w- C:\ProgramData\Intuit
2012-01-09 22:43:48 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2012-01-09 18:33:06 -------- d-----r- C:\Users\Guillermo\Dropbox
2012-01-09 06:11:03 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Sublime Text 2
2012-01-09 06:10:56 -------- d-----w- C:\Program Files\Sublime Text 2
2012-01-09 01:54:53 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Waldorf
2012-01-09 01:53:42 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Arturia
2012-01-09 00:27:55 44544 ----a-w- C:\Windows\System32\themeservice.dll.backup
2012-01-09 00:27:55 2851840 ----a-w- C:\Windows\System32\themeui.dll.backup
2012-01-09 00:27:54 332288 ----a-w- C:\Windows\System32\uxtheme.dll.backup
2012-01-09 00:10:28 -------- d-----w- C:\ProgramData\CustoPackTools
2012-01-09 00:10:10 -------- d-----w- C:\Program Files (x86)\CustoPackTools
2012-01-08 23:32:38 -------- d-----w- C:\Users\Guillermo\AppData\Local\eLicenser
2012-01-08 23:14:10 163840 ----a-w- C:\Windows\SysWow64\ArtFfct.dll
2012-01-08 23:14:03 -------- d-----w- C:\ProgramData\Arturia
2012-01-08 23:14:03 -------- d-----w- C:\Program Files (x86)\Arturia
2012-01-08 23:07:41 2892 ----a-w- C:\Windows\SysWow64\audcon.sys
2012-01-08 23:07:41 -------- d-----w- C:\ProgramData\Syncrosoft
2012-01-08 23:06:50 1695232 ----a-w- C:\Windows\System32\synsoacc.dll
2012-01-08 23:06:50 -------- d-----w- C:\ProgramData\eLicenser
2012-01-08 23:06:50 -------- d-----w- C:\Program Files (x86)\Syncrosoft
2012-01-08 23:06:50 -------- d-----w- C:\Program Files (x86)\eLicenser
2012-01-08 23:06:44 86016 ----a-w- C:\Windows\SysWow64\SYNSOPOS.exe
2012-01-08 23:06:44 1261568 ----a-w- C:\Windows\SysWow64\SYNSOACC.dll
2012-01-08 23:00:04 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Image-Line
2012-01-08 22:54:00 -------- d-----w- C:\Users\Guillermo\AppData\Local\Native Instruments
2012-01-08 22:51:48 -------- dc-h--w- C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
2012-01-08 22:51:16 -------- d-----w- C:\Program Files\Common Files\Native Instruments
2012-01-08 22:51:15 -------- d-----w- C:\Program Files (x86)\Common Files\Native Instruments
2012-01-08 22:51:08 -------- dc-h--w- C:\ProgramData\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2012-01-08 22:51:06 -------- d-----w- C:\ProgramData\Native Instruments
2012-01-08 22:51:06 -------- d-----w- C:\Program Files\Native Instruments
2012-01-08 22:18:11 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Rainmeter
2012-01-08 22:13:58 -------- d-----w- C:\Users\Guillermo\AppData\Local\ASUS
2012-01-08 22:04:53 -------- d-----w- C:\Program Files\Rainmeter
2012-01-08 21:55:38 -------- d-----w- C:\Program Files (x86)\RocketDock
2012-01-08 21:40:09 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2012-01-08 21:40:09 1700352 ----a-w- C:\Windows\SysWow64\gdiplus.dll
2012-01-08 21:40:09 1060864 ----a-w- C:\Windows\SysWow64\mfc71.dll
2012-01-08 20:25:36 86016 ----a-w- C:\Windows\unvise32.exe
2012-01-08 20:25:08 -------- d-----w- C:\Program Files (x86)\GForce
2012-01-08 18:12:37 -------- d-----w- C:\Users\Guillermo\AppData\Local\PMB Files
2012-01-08 18:12:36 -------- d-----w- C:\ProgramData\PMB Files
2012-01-08 18:11:27 -------- d-----w- C:\Program Files (x86)\Pando Networks
2012-01-08 17:07:02 -------- d-----w- C:\Users\Guillermo\AppData\Local\Skyrim
2012-01-08 16:57:59 2475352 ----a-w- C:\Windows\System32\D3DX9_42.dll
2012-01-08 16:52:29 -------- d-----w- C:\Program Files (x86)\The Elder Scrolls V Skyrim
2012-01-08 08:13:29 -------- d-----w- C:\Users\Guillermo\AppData\Local\VS Revo Group
2012-01-08 08:13:26 -------- d-----w- C:\Program Files\VS Revo Group
2012-01-08 07:44:54 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Bradsoft.com
2012-01-08 07:44:45 -------- d-----w- C:\Program Files (x86)\TopStyle 4
2012-01-08 06:07:30 -------- d-----w- C:\Program Files (x86)\Foxit Software
2012-01-08 05:41:29 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
2012-01-08 05:40:08 -------- d-----w- C:\ProgramData\ALM
2012-01-08 05:30:35 8602168 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-08 05:09:32 384 ----a-w- C:\Windows\SysWow64\checkOS.bat
2012-01-08 04:44:25 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Ableton
2012-01-08 04:44:25 -------- d-----w- C:\ProgramData\Ableton
2012-01-08 04:43:04 233472 ----a-w- C:\Windows\SysWow64\REX Shared Library.dll
2012-01-08 04:43:03 368640 ----a-w- C:\Windows\SysWow64\ReWire.dll
2012-01-08 04:40:34 -------- d-----w- C:\Program Files (x86)\Ableton
2012-01-08 04:39:19 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
2012-01-08 04:20:33 -------- d-----w- C:\Program Files (x86)\The KMPlayer
2012-01-08 04:15:33 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Zeon
2012-01-08 04:12:41 -------- d-----w- C:\Program Files (x86)\Common Files\Steam
2012-01-08 03:43:41 -------- d-----w- C:\Program Files\CCleaner
2012-01-07 19:47:22 -------- d-----w- C:\ProgramData\CrashPlan
2012-01-07 19:47:22 -------- d-----w- C:\Program Files\CrashPlan
2012-01-07 19:46:56 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\CrashPlan
2012-01-07 19:27:29 -------- d-----w- C:\Program Files (x86)\ASIO4ALL v2
2012-01-07 19:27:08 1554944 ----a-w- C:\Windows\SysWow64\vorbis.acm
2012-01-07 19:27:05 -------- d-----w- C:\Program Files (x86)\Outsim
2012-01-07 19:24:06 -------- d-----w- C:\Program Files (x86)\Image-Line
2012-01-07 19:23:34 689492 ----a-w- C:\Windows\SysWow64\adbcnsl.exe
2012-01-07 17:51:45 -------- d-----w- C:\Program Files (x86)\VideoLAN
2012-01-07 06:59:22 34304 ----a-w- C:\Windows\System32\drivers\lgandmodem64.sys
2012-01-07 06:59:22 31744 ----a-w- C:\Windows\System32\drivers\lgandadb.sys
2012-01-07 06:59:22 27648 ----a-w- C:\Windows\System32\drivers\lganddiag64.sys
2012-01-07 06:59:22 27136 ----a-w- C:\Windows\System32\drivers\lgandgps64.sys
2012-01-07 06:59:22 19456 ----a-w- C:\Windows\System32\drivers\lgandbus64.sys
2012-01-07 06:59:22 1919968 ----a-w- C:\Windows\System32\wdfcoinstaller01005.dll
2012-01-07 06:59:22 -------- d-----w- C:\Program Files (x86)\LG Electronics
2012-01-07 06:18:46 -------- d-----w- C:\Windows\SysWow64\Wat
2012-01-07 06:18:46 -------- d-----w- C:\Windows\System32\Wat
2012-01-07 03:28:24 -------- d-----w- C:\ProgramData\Splashtop
2012-01-07 03:28:09 -------- d-----w- C:\Program Files (x86)\Splashtop
2012-01-07 03:27:47 -------- d-----w- C:\Users\Guillermo\AppData\Local\{144B42D3-144F-466A-BA16-79245A51069E}
2012-01-06 21:01:40 -------- d-----w- C:\Users\Guillermo\AppData\Local\ElevatedDiagnostics
2012-01-06 19:31:58 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2A8B2A99-DE66-48B0-B6E7-FD25A03FB7F8}\gapaengine.dll
2012-01-06 19:31:50 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-01-06 19:28:38 -------- d-----w- C:\Program Files\PeerBlock
2012-01-06 19:26:23 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2012-01-06 19:26:20 -------- d-----w- C:\Program Files\Microsoft Security Client
2012-01-06 19:24:11 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Dropbox
2012-01-06 18:53:01 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
2012-01-06 18:48:52 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Wacom
2012-01-06 18:48:45 -------- d-----w- C:\ProgramData\Wacom
2012-01-06 18:48:39 -------- d-----w- C:\Users\Guillermo\AppData\Local\Adobe
2012-01-06 18:48:34 -------- d-----w- C:\Program Files (x86)\Bamboo Dock
2012-01-06 18:33:17 -------- d-----w- C:\Users\Guillermo\AppData\Local\Power2Go
2012-01-06 18:33:09 -------- d-----w- C:\Users\Guillermo\AppData\Local\VirtualStore
2012-01-06 18:33:00 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Intel
2012-01-06 18:23:51 -------- d-----r- C:\Program Files (x86)\Skype
2012-01-06 18:22:55 -------- d-----w- C:\Users\Guillermo\AppData\Local\Spotify
2012-01-06 18:20:19 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\Spotify
2012-01-06 18:14:51 -------- d-----w- C:\Program Files (x86)\uTorrent
2012-01-06 18:13:39 -------- d-----w- C:\Users\Guillermo\AppData\Roaming\uTorrent
2012-01-06 17:51:43 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2012-01-06 17:51:43 31232 ----a-w- C:\Windows\System32\prevhost.exe
2012-01-06 17:47:57 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-01-06 17:46:59 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2012-01-06 17:44:58 -------- d-----w- C:\Users\Guillermo\AppData\Local\Deployment
2012-01-06 17:44:58 -------- d-----w- C:\Users\Guillermo\AppData\Local\Apps
.
==================== Find3M ====================
.
2012-01-30 06:37:14 45056 ----a-w- C:\Windows\SysWow64\acovcnt.exe
2012-01-09 00:27:55 44544 ----a-w- C:\Windows\System32\themeservice.dll
2012-01-09 00:27:55 2851840 ----a-w- C:\Windows\System32\themeui.dll
2012-01-09 00:27:54 332288 ----a-w- C:\Windows\System32\uxtheme.dll
2011-11-24 04:52:09 3145216 ----a-w- C:\Windows\System32\win32k.sys
2011-11-17 06:49:14 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2011-11-17 06:49:14 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2011-11-17 06:44:43 459232 ----a-w- C:\Windows\System32\drivers\cng.sys
2011-11-17 06:35:28 395776 ----a-w- C:\Windows\System32\webio.dll
2011-11-17 06:35:26 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2011-11-17 06:35:26 136192 ----a-w- C:\Windows\System32\sspicli.dll
2011-11-17 06:35:25 340992 ----a-w- C:\Windows\System32\schannel.dll
2011-11-17 06:35:25 28160 ----a-w- C:\Windows\System32\secur32.dll
2011-11-17 06:35:19 1447936 ----a-w- C:\Windows\System32\lsasrv.dll
2011-11-17 06:33:55 31232 ----a-w- C:\Windows\System32\lsass.exe
2011-11-17 05:35:02 314880 ----a-w- C:\Windows\SysWow64\webio.dll
2011-11-17 05:34:52 224768 ----a-w- C:\Windows\SysWow64\schannel.dll
2011-11-17 05:34:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2011-11-17 05:28:48 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
.
============= FINISH: 6:10:21.82 ===============

BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 04 February 2012 - 01:38 AM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 05 February 2012 - 03:30 PM

combofix ran without problem
hard to say how the computer is doing at the moment.

heres the combofix log:


ComboFix 12-02-05.02 - Guillermo 02/05/2012 14:19:43.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3874.2546 [GMT -6:00]
Running from: c:\users\Guillermo\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
.
.
((((((((((((((((((((((((( Files Created from 2012-01-05 to 2012-02-05 )))))))))))))))))))))))))))))))
.
.
2012-02-05 20:24 . 2012-02-05 20:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-05 19:13 . 2012-02-05 19:13 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E28194AB-38F0-44A6-A5D6-AA2F8BCD82F0}\offreg.dll
2012-02-05 01:42 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E28194AB-38F0-44A6-A5D6-AA2F8BCD82F0}\mpengine.dll
2012-02-04 09:42 . 2012-02-04 09:42 65736 ----a-w- c:\windows\system32\drivers\pxrts.sys
2012-02-04 09:42 . 2012-02-04 09:42 -------- d-----w- c:\program files\Prevx
2012-02-04 09:41 . 2012-02-05 19:11 -------- d-----w- c:\programdata\PrevxCSI
2012-02-03 08:10 . 2012-02-03 20:49 35712 ----a-w- c:\windows\SysWow64\drivers\BlackBox.sys
2012-02-03 04:17 . 2012-02-03 04:17 -------- d-----w- c:\programdata\Kaspersky Lab
2012-02-03 03:24 . 2012-02-03 03:24 -------- d-----w- c:\users\Guillermo\AppData\Local\Sunbelt Software
2012-02-03 01:38 . 2011-12-23 13:12 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2012-02-03 00:49 . 2012-02-03 00:49 -------- d-----w- c:\program files (x86)\ESET
2012-02-03 00:45 . 2012-02-03 00:45 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-03 00:45 . 2011-12-10 21:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-02 18:35 . 2012-02-02 18:35 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-02 02:03 . 2012-02-02 02:03 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2012-02-02 01:50 . 2012-02-03 01:38 -------- d-----w- c:\program files (x86)\Lavasoft
2012-02-02 01:50 . 2012-02-03 01:38 -------- d-----w- c:\programdata\Lavasoft
2012-02-02 01:46 . 2012-02-02 01:46 -------- d-----w- c:\users\Guillermo\AppData\Roaming\SUPERAntiSpyware.com
2012-02-02 01:45 . 2012-02-02 01:45 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Malwarebytes
2012-02-02 01:45 . 2012-02-02 01:45 -------- d-----w- c:\programdata\Malwarebytes
2012-02-01 18:06 . 2012-02-01 18:06 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2012-02-01 18:06 . 2012-02-01 18:06 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2012-02-01 18:06 . 2012-02-01 18:06 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2012-02-01 18:06 . 2012-02-01 18:06 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2012-02-01 18:06 . 2012-02-01 18:06 -------- d-----w- c:\program files (x86)\OpenAL
2012-02-01 18:03 . 2012-02-01 18:03 -------- d-----w- c:\users\Guillermo\AppData\Local\2DBoy
2012-02-01 18:03 . 2012-02-01 18:03 -------- d-----w- c:\programdata\2DBoy
2012-02-01 16:25 . 2012-02-01 16:25 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
2012-02-01 16:25 . 2012-02-05 20:07 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Winamp
2012-02-01 16:25 . 2012-02-01 16:28 -------- d-----w- c:\program files (x86)\Winamp
2012-01-31 05:46 . 2012-01-31 05:46 -------- d-----w- c:\users\Guillermo\AppData\Local\Programs
2012-01-30 12:15 . 2012-01-30 12:15 -------- d-----w- c:\windows\Sun
2012-01-29 23:59 . 2012-01-29 23:59 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-01-27 11:43 . 2011-06-21 04:09 200976 ----a-w- c:\windows\SysWow64\drivers\tmcomm.sys
2012-01-27 11:31 . 2012-01-27 11:39 -------- d-----w- c:\program files (x86)\Trend Micro
2012-01-27 07:56 . 2012-01-27 07:56 -------- d-----w- c:\programdata\Soulseek
2012-01-27 07:56 . 2012-01-27 07:56 -------- d-----w- c:\program files (x86)\SoulseekNS
2012-01-27 07:31 . 2012-02-04 20:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-01-27 07:31 . 2012-01-27 07:34 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-01-26 06:03 . 2012-01-26 06:03 -------- d-----w- c:\users\Guillermo\.config
2012-01-25 18:49 . 2012-02-05 01:34 -------- d-----w- c:\program files (x86)\Steam
2012-01-25 07:27 . 2012-01-25 07:27 -------- d-----w- c:\programdata\Age of Empires 3
2012-01-25 07:20 . 2012-02-02 04:32 -------- d-----w- c:\program files (x86)\Common Files\Microsoft Games
2012-01-25 07:13 . 2012-02-02 04:39 -------- d-----w- c:\program files (x86)\Microsoft Games
2012-01-23 20:14 . 2012-02-05 19:17 -------- d-----w- c:\users\Guillermo\riotsGamesLogs
2012-01-23 19:34 . 2012-01-23 19:34 -------- d-----w- C:\Games
2012-01-23 19:34 . 2012-01-27 11:39 -------- d-----w- c:\users\Guillermo\AppData\Local\Black_Tree_Gaming
2012-01-20 00:59 . 2012-01-20 00:59 -------- d-----w- c:\users\Guillermo\AppData\Roaming\com.adobe.kuler.Desktop.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2012-01-20 00:59 . 2012-01-20 00:59 -------- d-----w- c:\program files (x86)\Adobe kuler
2012-01-20 00:35 . 2012-01-20 00:35 -------- d-----w- c:\program files\Common Files\Propellerhead Software
2012-01-19 22:50 . 2012-01-19 22:50 -------- d---a-w- C:\.Trash-1000
2012-01-19 21:40 . 2012-01-19 21:40 -------- d-----w- c:\program files (x86)\Common Files\AnswerWorks 5.0
2012-01-17 19:55 . 2012-01-17 19:55 -------- d-----w- c:\users\Guillermo\AppData\Roaming\com.adobe.DC3Module.AdobeADC
2012-01-17 03:34 . 2012-01-17 03:34 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Foxit Software
2012-01-16 17:19 . 2012-01-16 17:19 -------- d-----w- c:\users\Guillermo\AppData\Roaming\LolClient
2012-01-14 19:19 . 2008-07-12 14:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2012-01-14 19:19 . 2008-07-12 14:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2012-01-14 19:19 . 2008-07-12 14:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2012-01-14 19:14 . 2012-01-14 19:14 -------- d-----w- C:\Riot Games
2012-01-12 02:51 . 2012-01-12 17:50 -------- d-----w- c:\users\Guillermo\AppData\Roaming\REAPER
2012-01-12 02:49 . 2012-01-20 00:35 -------- d-----w- c:\program files\REAPER (x64)
2012-01-11 18:26 . 2011-08-31 08:34 4200024 ----a-w- c:\windows\SysWow64\cdintf400.dll
2012-01-11 16:18 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 16:18 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-01-11 16:18 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-01-11 16:18 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-01-11 16:18 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 16:18 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-01-11 16:18 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-11 16:18 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-01-11 09:03 . 2012-01-11 09:03 -------- d-----w- c:\program files\Common Files\Intuit
2012-01-11 08:59 . 2012-01-11 18:28 -------- d-----w- c:\users\Guillermo\AppData\Local\Intuit
2012-01-11 08:55 . 2012-02-02 04:47 -------- d-----w- c:\program files (x86)\Intuit
2012-01-11 08:55 . 2012-01-11 09:01 -------- d-----w- c:\programdata\SQL Anywhere 11
2012-01-11 08:55 . 2012-01-11 08:55 -------- d-----w- c:\programdata\COMMON FILES
2012-01-11 08:55 . 2012-01-11 08:55 -------- d-----w- c:\program files (x86)\MSXML 4.0
2012-01-11 08:47 . 2012-01-11 18:20 -------- d-----w- c:\windows\Intuit
2012-01-11 06:06 . 2009-07-14 01:41 258048 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpfppw73.dll
2012-01-11 06:06 . 2012-01-11 06:06 -------- d-----w- c:\program files\Common Files\EPSON
2012-01-11 06:06 . 2012-01-11 06:06 -------- d-----w- c:\programdata\EPSON
2012-01-11 06:05 . 2012-01-11 06:05 -------- d--h--w- c:\programdata\CanonBJ
2012-01-11 06:05 . 2008-02-26 02:00 82944 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPP9I.DLL
2012-01-11 06:05 . 2008-02-26 02:00 27648 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNMPD9I.DLL
2012-01-10 18:06 . 2012-01-19 21:39 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Intuit
2012-01-10 18:05 . 2012-01-10 18:05 -------- d-----w- c:\users\Guillermo\AppData\Local\IsolatedStorage
2012-01-10 18:05 . 2012-02-02 04:49 -------- d-----w- c:\program files (x86)\Common Files\Intuit
2012-01-10 18:02 . 2012-01-10 18:02 -------- d-----w- c:\program files (x86)\TurboTax
2012-01-10 18:02 . 2012-01-19 21:39 -------- d-----w- c:\programdata\Intuit
2012-01-09 22:43 . 2012-01-09 22:43 -------- d-----w- c:\users\Guillermo\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2012-01-09 18:33 . 2012-02-05 19:13 -------- d-----r- c:\users\Guillermo\Dropbox
2012-01-09 06:11 . 2012-01-09 06:11 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Sublime Text 2
2012-01-09 06:10 . 2012-01-12 08:08 -------- d-----w- c:\program files\Sublime Text 2
2012-01-09 01:54 . 2012-01-09 01:54 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Waldorf
2012-01-09 01:53 . 2012-01-09 01:53 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Arturia
2012-01-09 00:27 . 2010-11-20 13:27 2851840 ----a-w- c:\windows\system32\themeui.dll.backup
2012-01-09 00:27 . 2009-07-14 01:41 44544 ----a-w- c:\windows\system32\themeservice.dll.backup
2012-01-09 00:27 . 2009-07-14 01:41 332288 ----a-w- c:\windows\system32\uxtheme.dll.backup
2012-01-09 00:17 . 2012-01-09 00:17 -------- d-----w- c:\program files (x86)\Google
2012-01-09 00:10 . 2012-01-09 01:14 -------- d-----w- c:\programdata\CustoPackTools
2012-01-09 00:10 . 2012-01-09 01:08 -------- d-----w- c:\program files (x86)\CustoPackTools
2012-01-08 23:32 . 2012-01-08 23:32 -------- d-----w- c:\users\Guillermo\AppData\Local\eLicenser
2012-01-08 23:14 . 2009-09-10 00:38 163840 ----a-w- c:\windows\SysWow64\ArtFfct.dll
2012-01-08 23:14 . 2012-01-09 03:13 -------- d-----w- c:\program files (x86)\Arturia
2012-01-08 23:14 . 2012-01-09 03:12 -------- d-----w- c:\programdata\Arturia
2012-01-08 23:07 . 2012-01-08 23:07 -------- d-----w- c:\programdata\Syncrosoft
2012-01-08 23:07 . 2012-01-08 23:07 2892 ----a-w- c:\windows\SysWow64\audcon.sys
2012-01-08 23:06 . 2012-01-08 23:32 -------- d-----w- c:\programdata\eLicenser
2012-01-08 23:06 . 2012-01-08 23:24 -------- d-----w- c:\program files (x86)\Syncrosoft
2012-01-08 23:06 . 2012-01-08 23:07 -------- d-----w- c:\program files (x86)\eLicenser
2012-01-08 23:06 . 2009-09-17 22:20 1695232 ----a-w- c:\windows\system32\synsoacc.dll
2012-01-08 23:06 . 2009-09-17 22:20 1261568 ----a-w- c:\windows\SysWow64\SYNSOACC.dll
2012-01-08 23:06 . 2009-05-19 21:21 86016 ----a-w- c:\windows\SysWow64\SYNSOPOS.exe
2012-01-08 23:00 . 2012-01-08 23:00 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Image-Line
2012-01-08 22:54 . 2012-01-08 22:54 -------- d-----w- c:\users\Guillermo\AppData\Local\Native Instruments
2012-01-08 22:51 . 2012-01-08 22:51 -------- dc-h--w- c:\programdata\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
2012-01-08 22:51 . 2012-01-08 22:51 -------- d-----w- c:\program files\Common Files\Native Instruments
2012-01-08 22:51 . 2012-01-08 22:51 -------- d-----w- c:\program files (x86)\Common Files\Native Instruments
2012-01-08 22:51 . 2012-01-08 22:51 -------- dc-h--w- c:\programdata\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2012-01-08 22:51 . 2012-01-08 22:51 -------- d-----w- c:\program files\Native Instruments
2012-01-08 22:51 . 2012-01-08 22:51 -------- d-----w- c:\programdata\Native Instruments
2012-01-08 22:18 . 2012-01-08 22:18 -------- d-----w- c:\users\Guillermo\AppData\Roaming\Rainmeter
2012-01-08 22:13 . 2012-01-08 22:13 -------- d-----w- c:\users\Guillermo\AppData\Local\ASUS
2012-01-08 22:04 . 2012-01-08 23:41 -------- d-----w- c:\program files\Rainmeter
2012-01-08 21:55 . 2012-01-08 21:55 -------- d-----w- c:\program files (x86)\RocketDock
2012-01-08 21:54 . 2012-01-08 21:54 -------- d-----w- c:\program files (x86)\Microsoft.NET
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2012-01-06 19:31 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-01-30 06:37 . 2011-07-25 20:21 45056 ----a-w- c:\windows\SysWow64\acovcnt.exe
2012-01-09 00:27 . 2011-02-18 19:49 2851840 ----a-w- c:\windows\system32\themeui.dll
2012-01-09 00:27 . 2009-07-13 23:54 44544 ----a-w- c:\windows\system32\themeservice.dll
2012-01-09 00:27 . 2009-07-13 23:55 332288 ----a-w- c:\windows\system32\uxtheme.dll
2012-01-06 19:31 . 2012-01-06 19:31 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2A8B2A99-DE66-48B0-B6E7-FD25A03FB7F8}\gapaengine.dll
2012-01-06 18:33 . 2010-06-24 18:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-24 04:52 . 2012-01-06 17:47 3145216 ----a-w- c:\windows\system32\win32k.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . 3B69712041F3D63605529BD66DC00C48 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[-] 2011-02-25 . ADA5256821ECB52070D22B74921F0DCE . 2871808 . . [6.1.7600.16385] .. c:\windows\explorer.exe
[7] 2011-02-25 . 332FEAB1435662FC6C672E25BEB37BE3 . 2871808 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[7] 2010-11-20 . AC4C51EB24AA95B77F705AB159189E24 . 2872320 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
"PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128]
"F.lux"="c:\users\Guillermo\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-23 1601536]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2011-09-27 646232]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2011-07-25 3058304]
"googletalk"="c:\program files (x86)\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
.
c:\users\Guillermo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Guillermo\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-1-18 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-4-11 548528]
CrashPlan Tray.lnk - c:\program files\CrashPlan\CrashPlanTray.exe [2011-3-16 217088]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2012-1-8 107720]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKsl4854c672;MpKsl4854c672;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7C9EA47A-C174-409B-B79A-A91071ADB998}\MpKsl4854c672.sys [x]
R2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\SysWOW64\adbcnsl.exe [2012-01-07 689492]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2012-02-03 2152152]
R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\lgandadb.sys [x]
R3 BlackBox;BlackBox SR2; [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]
R3 DIRECTIO;DIRECTIO;c:\bit_temp\DirectIo.sys [x]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 340240]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 923984]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 1001808]
S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]
S2 CrashPlanService;CrashPlan Backup Service;c:\program files\CrashPlan\CrashPlanService.exe [2011-03-16 222720]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2011-12-21 529768]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2011-11-10 370504]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 1321296]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - PBFILTER
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - pbfilter
*Deregistered* - pxrts
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2075945034-679189341-3693907279-1000Core.job
- c:\users\Guillermo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-06 17:46]
.
2012-02-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2075945034-679189341-3693907279-1000UA.job
- c:\users\Guillermo\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-06 17:46]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 97792 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 97792 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 97792 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 97792 ----a-w- c:\users\Guillermo\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2010-01-21 909824]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-30 499608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-09-01 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-09-01 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-09-01 416024]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-26 11775592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\system32\blank.htm
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-Best Buy pc app - c:\programdata\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\Best Buy pc app Setup.exe
AddRemove-{FBBC4667-2521-4E78-B1BD-8706F774549B} - c:\programdata\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\Best Buy pc app Setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:87,41,89,b1,7e,d1,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8c,a0,f1,03,a9,de,94,44,ae,54,2b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c8,02,88,90,34,52,3f,47,b5,1a,21,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8c,a0,f1,03,a9,de,94,44,ae,54,2b,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8c,a0,f1,03,a9,de,94,44,ae,54,2b,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8c,a0,f1,03,a9,de,94,44,ae,54,2b,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-02-05 14:26:21
ComboFix-quarantined-files.txt 2012-02-05 20:26
.
Pre-Run: 49,716,277,248 bytes free
Post-Run: 49,456,566,272 bytes free
.
- - End Of File - - 48BA1B38BFE65B6866D2A4AA407722F6

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 05 February 2012 - 03:39 PM

SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Link 1
Link 2


  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
:filefind
explorer.exe
wininit.exe
winlogon.exe
svchost.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 05 February 2012 - 08:01 PM

System Look log:

SystemLook 30.07.11 by jpshortstuff
Log created at 18:57 on 05/02/2012 by Guillermo
Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.exe"
C:\Windows\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] ADA5256821ECB52070D22B74921F0DCE
C:\Windows\SysWOW64\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 948826387617760B1C43153A5ED070A0
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe --a---- 2872320 bytes [19:49 18/02/2011] [13:24 20/11/2010] AC4C51EB24AA95B77F705AB159189E24
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:14 26/02/2011] 3B69712041F3D63605529BD66DC00C48
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe --a---- 2616320 bytes [19:49 18/02/2011] [12:17 20/11/2010] 40D777B7A95E00593EB1568C68514493
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:19 26/02/2011] 0FB9C74046656D1579A64660AD67B746

Searching for "wininit.exe"
C:\Windows\ERDNT\cache64\wininit.exe --a---- 129024 bytes [20:25 05/02/2012] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA
C:\Windows\ERDNT\cache86\wininit.exe --a---- 96256 bytes [20:25 05/02/2012] [01:14 14/07/2009] B5C5DCAD3899512020D135600129D665
C:\Windows\System32\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA
C:\Windows\SysWOW64\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] B5C5DCAD3899512020D135600129D665
C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA
C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] B5C5DCAD3899512020D135600129D665

Searching for "winlogon.exe"
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe --a---- 182856 bytes [00:45 03/02/2012] [20:53 13/01/2012] 63EEC8A8B221AB79045E776E5F592868
C:\Windows\ERDNT\cache64\winlogon.exe --a---- 390656 bytes [20:25 05/02/2012] [13:25 20/11/2010] 1151B1BAA6F350B1DB6598E0FEA7C457
C:\Windows\System32\winlogon.exe --a---- 390656 bytes [19:49 18/02/2011] [13:25 20/11/2010] 1151B1BAA6F350B1DB6598E0FEA7C457
C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe --a---- 390656 bytes [19:49 18/02/2011] [13:25 20/11/2010] 1151B1BAA6F350B1DB6598E0FEA7C457

Searching for "svchost.exe"
C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe --a---- 182856 bytes [00:45 03/02/2012] [20:53 13/01/2012] 63EEC8A8B221AB79045E776E5F592868
C:\Windows\ERDNT\cache64\svchost.exe --a---- 27136 bytes [20:25 05/02/2012] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D
C:\Windows\ERDNT\cache86\svchost.exe --a---- 20992 bytes [20:25 05/02/2012] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866
C:\Windows\System32\svchost.exe --a---- 27136 bytes [23:31 13/07/2009] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D
C:\Windows\SysWOW64\svchost.exe --a---- 20992 bytes [23:19 13/07/2009] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866
C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe --a---- 27136 bytes [23:31 13/07/2009] [01:39 14/07/2009] C78655BC80301D76ED4FEF1C1EA40A7D
C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe --a---- 20992 bytes [23:19 13/07/2009] [01:14 14/07/2009] 54A47F6B5E09A77E61649109C6A08866

-= EOF =-

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 05 February 2012 - 08:07 PM

SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Link 1
Link 2


  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
:filefind
explorer.ex*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 05 February 2012 - 08:33 PM

SystemLook log:

SystemLook 30.07.11 by jpshortstuff
Log created at 19:32 on 05/02/2012 by Guillermo
Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.ex*"
C:\Windows\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] ADA5256821ECB52070D22B74921F0DCE
C:\Windows\explorer.exe.bkpcpt --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\en-US\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:26 14/07/2009] 4B87EEFDC8E253F846A7DFB49A8E6C70
C:\Windows\Prefetch\EXPLORER.EXE-A0A4A901.pf --a---- 13260 bytes [00:25 03/02/2012] [01:21 03/02/2012] 4F25B8F23457FE40496D00E2BE1E1BDF
C:\Windows\Prefetch\EXPLORER.EXE-C0C2B0CC.pf --a---- 17864 bytes [00:25 03/02/2012] [00:25 03/02/2012] 8C6735DAB961FF1BBF0FA9939D43FF61
C:\Windows\SysWOW64\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 948826387617760B1C43153A5ED070A0
C:\Windows\SysWOW64\explorer.exe.bkpcpt --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\SysWOW64\en-US\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:06 14/07/2009] B9F4B1CA23D60775736059D72BA48526
C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:26 14/07/2009] 4B87EEFDC8E253F846A7DFB49A8E6C70
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe --a---- 2872320 bytes [19:49 18/02/2011] [13:24 20/11/2010] AC4C51EB24AA95B77F705AB159189E24
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:14 26/02/2011] 3B69712041F3D63605529BD66DC00C48
C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:06 14/07/2009] B9F4B1CA23D60775736059D72BA48526
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe --a---- 2616320 bytes [19:49 18/02/2011] [12:17 20/11/2010] 40D777B7A95E00593EB1568C68514493
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:19 26/02/2011] 0FB9C74046656D1579A64660AD67B746

-= EOF =-

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 05 February 2012 - 08:53 PM

Blitzblank.

Download BlitzBlank and save it to your desktop. Open Blitzblank.exe

  • Click OK at the warning (and take note of it, this is a VERY powerful tool!).
  • Click the Script tab and copy/paste the following text there:
CopyFile:
C:\Windows\explorer.exe.bkpcpt C:\Windows\explorer.exe
C:\Windows\SysWOW64\explorer.exe.bkpcpt C:\Windows\SysWOW64\explorer.exe
  • Click Execute Now. Your computer will need to reboot in order to replace the files.
  • When done, post me the report created by Blitzblank. you can find it at the root of the drive Normaly C:\

rerun system look once more when this is complete


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 05 February 2012 - 09:18 PM

Blitzblank:

BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
CopyFileOnReboot: sourceFile = "\??\c:\windows\explorer.exe.bkpcpt", destinationFile = "\??\c:\windows\explorer.exe"CopyFile: ZwCreateFile failed: status = c0000022
CopyFileOnReboot: sourceFile = "\??\c:\windows\syswow64\explorer.exe.bkpcpt", destinationFile = "\??\c:\windows\syswow64\explorer.exe"CopyFile: ZwCreateFile failed: status = c0000022

SystemLook:

SystemLook 30.07.11 by jpshortstuff
Log created at 20:15 on 05/02/2012 by Guillermo
Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.ex*"
C:\Windows\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] ADA5256821ECB52070D22B74921F0DCE
C:\Windows\explorer.exe.bkpcpt --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\en-US\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:26 14/07/2009] 4B87EEFDC8E253F846A7DFB49A8E6C70
C:\Windows\Prefetch\EXPLORER.EXE-A0A4A901.pf --a---- 13260 bytes [00:25 03/02/2012] [01:21 03/02/2012] 4F25B8F23457FE40496D00E2BE1E1BDF
C:\Windows\Prefetch\EXPLORER.EXE-C0C2B0CC.pf --a---- 17864 bytes [00:25 03/02/2012] [00:25 03/02/2012] 8C6735DAB961FF1BBF0FA9939D43FF61
C:\Windows\SysWOW64\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 948826387617760B1C43153A5ED070A0
C:\Windows\SysWOW64\explorer.exe.bkpcpt --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\SysWOW64\en-US\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:06 14/07/2009] B9F4B1CA23D60775736059D72BA48526
C:\Windows\winsxs\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61e778c48d52d19b\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:26 14/07/2009] 4B87EEFDC8E253F846A7DFB49A8E6C70
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe --a---- 2872320 bytes [19:49 18/02/2011] [13:24 20/11/2010] AC4C51EB24AA95B77F705AB159189E24
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe --a---- 2871808 bytes [17:47 06/01/2012] [06:14 26/02/2011] 3B69712041F3D63605529BD66DC00C48
C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c3c2316c1b39396\explorer.exe.mui --a---- 22016 bytes [05:35 14/07/2009] [02:06 14/07/2009] B9F4B1CA23D60775736059D72BA48526
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe --a---- 2616320 bytes [19:49 18/02/2011] [12:17 20/11/2010] 40D777B7A95E00593EB1568C68514493
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe --a---- 2616320 bytes [17:47 06/01/2012] [05:19 26/02/2011] 0FB9C74046656D1579A64660AD67B746

-= EOF =-

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 05 February 2012 - 09:24 PM

Try this please. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Remove the USB drive and insert back in your working computer and navigate to report.txt

    Please note - all text entries are case sensitive
Copy and paste the report.txt for my review
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 05 February 2012 - 10:17 PM

my USB drive isn't booting.
I put it as the first to boot in my BIOS but it goes into Windows instead.

Anything else we can try?

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 05 February 2012 - 10:54 PM

lets try from a cd

Try this please. You will need a USB drive.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Next download driver.sh to your USB drive
  • Remove the USB & CD and insert it in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • Gently tap F12 and choose to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Remove the USB drive and insert it back in your working computer and navigate to report.txt

    Please note - all text entries are case sensitive
Copy and paste the report.txt for my review
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 06 February 2012 - 08:08 PM

the C-R did boot. I saw the Welcome to xPUD but the GUI did not load after that. It said something about an X11 error.

I ran the script in Ubuntu's terminal but it didn't output any file.

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:43 AM

Posted 06 February 2012 - 08:55 PM

Hello

Ok lets try this

click the start orb

click on computer to open

double click on the C drive to open

right click on an open space and select NEW FOLDER - name this folder folder1 NO SPACES

right click on an empty space again and select new folder and name this one folder2 NO SPACES




Run Batch File

Open Notepad and copy/paste the entire contents of the codebox below, into Notepad:
@echo off
copy /y C:\Windows\explorer.exe.bkpcpt c:\folder1\
copy /y C:\Windows\SysWOW64\explorer.exe.bkpcpt c:\folder2\
del %0
Save this as copy.bat Choose to Save type as - All Files and where to save - Desktop - then close the Notepad file.
It should look like this: Posted Image <--vista
It should look like this: Posted Image <--XP
Double-click on copy.bat to run it. This batchfile will delete itself when complete.

SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
:filefind
explorer.exe.bkpcpt
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 Rovot

Rovot
  • Topic Starter

  • Members
  • 25 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 06 February 2012 - 09:03 PM

SystemLook 30.07.11 by jpshortstuff
Log created at 20:02 on 06/02/2012 by Guillermo
Administrator - Elevation successful

========== filefind ==========

Searching for "explorer.exe.bkpcpt"
C:\folder1\explorer.exe.bkpcpt --a---- 2871808 bytes [02:01 07/02/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\folder2\explorer.exe.bkpcpt --a---- 2616320 bytes [02:01 07/02/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E
C:\Windows\explorer.exe.bkpcpt --a---- 2871808 bytes [17:47 06/01/2012] [06:19 25/02/2011] 332FEAB1435662FC6C672E25BEB37BE3
C:\Windows\SysWOW64\explorer.exe.bkpcpt --a---- 2616320 bytes [17:47 06/01/2012] [05:30 25/02/2011] 8B88EBBB05A0E56B7DCC708498C02B3E

-= EOF =-




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users