Spyware / Malware / Virus Removal

Administrator Privileges Locked!

17 min read

Looking for the outcome? Ask AI

BlendingLight Topic Starter

Post #1March 8, 2011, 12:47 AM UTC last edited March 8, 2011, 5:10 AM UTC

Hi! Recently, I downloaded a virus and it made changes to my winlogon file. I tried scanning with Malwarebytes, but it didnt find anything. Right now, I have Comodo Firewall blocking changes being made to other files. Here is the HJT file. Thank You!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:36:48 PM, on 3/7/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Owner\Desktop\NOBODY.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [C:\Users\Owner\Desktop\New folder (2)\Lockerz Auto Bid.exe] C:\Windows\Winlogon\winlogon.exe
O4 - HKCU\..\Run: [C:\Windows\Winlogon\winlogon.exe] C:\Users\Owner\AppData\Roaming\Winlogon\winlogon.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: MRI_DISABLED
O8 - Extra context menu item: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{A79E082E-EB55-4F19-ACC5-D0B5AEFFE112}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: CinemaNow Service - CinemaNow, Inc. - C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files (x86)\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: CSIScanner - Unknown owner - C:\Program Files\Prevx\prevx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (file missing)
O23 - Service: hpqwmiex - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files (x86)\PDF Complete\pdfsvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12566 bytes

EDIT:
I decided to boot on safe mode and I ended up being able to delete the virus, but winlogon.exe was infected and I accidentally deleted it.

I don't know what to do now. I'm going to submit a new HJT report. A quick reply would be appreciated. Thanks!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:07:24 AM, on 3/8/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Owner\Desktop\NOBODY.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPDSK/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
O4 - HKCU\..\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
O4 - HKCU\..\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: MRI_DISABLED
O8 - Extra context menu item: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{A79E082E-EB55-4F19-ACC5-D0B5AEFFE112}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{150CF6BF-D972-42B6-8023-B7AE83D9136D}: NameServer = 156.154.70.22,156.154.71.22
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: CinemaNow Service - CinemaNow, Inc. - C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files (x86)\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: HP Health Check Service - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe (file missing)
O23 - Service: hpqwmiex - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files (x86)\PDF Complete\pdfsvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 12345 bytes

Tomk

Post #2March 10, 2011, 6:08 AM UTC

Hi SkeW,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If you can't run it in normal mode… do it in safe mode.

BlendingLight

Post #3March 11, 2011, 4:53 AM UTC

Hi Tomk! Thanks for the reply. I didn't actually delete winlogon.exe. It was a malware executable in C:\WINDOWS\System32\Winlogon\Winlogon.exe Besides that, I ran ComboFix and here's the report. ComboFix 11-03-10.02 - Owner 03/10/2011 23:43:38.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.5887.3833 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59} FW: COMODO Firewall *Disabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Owner\AppData\Roaming\WinLogon . . ((((((((((((((((((((((((( Files Created from 2011-02-11 to 2011-03-11 ))))))))))))))))))))))))))))))) . . 2011-03-11 04:48 . 2011-03-11 04:48 ——– d—–w- c:\users\Guest\AppData\Local\temp 2011-03-11 04:48 . 2011-03-11 04:48 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-03-11 01:15 . 2011-03-11 01:15 ——– d—–w- c:\users\Owner\AppData\Roaming\SurfSecret Privacy Suite 2011-03-11 01:14 . 2011-03-11 01:15 ——– d—–w- c:\users\Owner\AppData\Local\panda2_0dn 2011-03-11 01:14 . 2011-03-11 01:15 ——– d—–w- c:\programdata\Panda Security URL Filtering 2011-03-11 01:13 . 2011-03-11 01:13 ——– d—–w- c:\users\Owner\AppData\Roaming\Panda Security 2011-03-11 01:13 . 2011-03-11 01:15 ——– d—–w- c:\program files (x86)\Panda Security 2011-03-11 01:13 . 2011-03-11 01:13 ——– d—–w- c:\programdata\Panda Security 2011-03-10 21:21 . 2011-03-10 21:22 ——– d—–w- c:\users\Owner\AppData\Local\{4AF2B197-0EEF-49A0-B94F-8D29CE16DDD9} 2011-03-10 09:21 . 2011-03-10 09:21 ——– d—–w- c:\users\Owner\AppData\Local\{D587B395-7D29-459F-9588-70D5FC8F07D9} 2011-03-09 21:09 . 2011-03-09 21:10 ——– d—–w- c:\users\Owner\AppData\Local\{3E65A2D4-0D68-420F-85E3-37BBE60A8507} 2011-03-09 09:09 . 2011-03-09 09:09 ——– d—–w- c:\users\Owner\AppData\Local\{358FAF2C-0F67-4894-B01A-83DD192C19F9} 2011-03-08 23:08 . 2011-03-08 23:12 ——– d—–w- c:\users\Owner\AppData\Roaming\ImgBurn 2011-03-08 23:07 . 2011-03-08 23:07 ——– d—–w- c:\program files (x86)\ImgBurn 2011-03-08 22:15 . 2011-02-11 07:30 7947600 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{88BD748A-4D6A-42E4-9386-BDDF6FDBED6C}\mpengine.dll 2011-03-08 21:03 . 2011-03-08 21:03 ——– d—–w- c:\users\Owner\AppData\Local\{3CF434FB-B646-4D6C-A4AA-733B21E81661} 2011-03-08 03:34 . 2011-03-08 03:34 ——– d—–w- c:\users\Owner\AppData\Local\ElevatedDiagnostics 2011-03-08 01:52 . 2011-02-23 15:04 238968 —-a-w- c:\windows\system32\aswBoot.exe 2011-03-08 01:51 . 2011-03-08 03:45 ——– d—–w- c:\programdata\AVAST Software 2011-03-07 21:49 . 2011-03-07 21:49 ——– d—–w- c:\users\Owner\AppData\Local\{D583AE8D-776E-4333-B4A3-45FA25D0D490} 2011-03-06 23:39 . 2011-03-06 23:39 ——– d—–w- c:\program files (x86)\eC 2011-03-06 21:55 . 2011-03-06 21:55 ——– d—–w- c:\programdata\RoboForm 2011-03-06 21:55 . 2011-03-06 21:55 ——– d—–w- c:\program files (x86)\Siber Systems 2011-03-06 19:13 . 2011-03-06 19:13 ——– d—–w- c:\users\Owner\AppData\Local\{834888A7-E10C-4D0A-AF80-E69630F9EAD7} 2011-03-06 07:13 . 2011-03-06 07:13 ——– d—–w- c:\users\Owner\AppData\Local\{60D76E80-D4B5-4B74-8FFC-857BB1897674} 2011-03-05 19:13 . 2011-03-05 19:13 ——– d—–w- c:\users\Owner\AppData\Local\{4EE35F11-B997-4E0F-992C-67EFB32C3781} 2011-03-05 07:12 . 2011-03-05 07:12 ——– d—–w- c:\users\Owner\AppData\Local\{DEC40C6B-E87A-49DC-8795-68C9E8975C95} 2011-03-04 21:04 . 2011-03-04 21:04 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-03-04 21:03 . 2011-03-04 21:03 ——– d—–w- c:\programdata\McAfee 2011-03-04 19:12 . 2011-03-04 19:12 ——– d—–w- c:\users\Owner\AppData\Local\{2CF86498-C52B-4FF5-BB75-0D4A453339B8} 2011-03-04 07:12 . 2011-03-04 07:12 ——– d—–w- c:\users\Owner\AppData\Local\{DF6D985F-7B8C-4B17-A306-3DF890DBB009} 2011-03-03 19:06 . 2011-03-03 19:06 ——– d—–w- c:\users\Owner\AppData\Local\{2DFF04A7-9B7A-4B9D-9B8E-652D48A0AA29} 2011-03-03 06:51 . 2011-03-03 06:51 ——– d—–w- c:\users\Owner\AppData\Local\{8AA4D5F2-ACF5-4B9A-A04A-8982C483BD2B} 2011-03-02 18:42 . 2011-03-02 18:42 ——– d—–w- c:\users\Owner\AppData\Local\{4F2486D5-BC2F-4F69-B57E-F7A70CB0A1C5} 2011-03-02 06:31 . 2011-03-02 06:31 ——– d—–w- c:\users\Owner\AppData\Local\{39D0C102-87BF-453D-A623-7BB689CB648C} 2011-03-01 18:31 . 2011-03-01 18:31 ——– d—–w- c:\users\Owner\AppData\Local\{4865BD0E-C444-4D6B-8AFE-C3B9BC943CE9} 2011-03-01 06:22 . 2011-03-01 06:23 ——– d—–w- c:\users\Owner\AppData\Local\{B0C6EF3E-143E-463B-BB30-B89F1B27E066} 2011-02-28 18:22 . 2011-02-28 18:22 ——– d—–w- c:\users\Owner\AppData\Local\{AC3C0255-CC7C-4800-88F9-03B057C5C3DC} 2011-02-28 06:11 . 2011-02-28 06:11 ——– d—–w- c:\users\Owner\AppData\Local\{DC029271-C26C-45AD-B14C-CADB33CB35CA} 2011-02-27 18:11 . 2011-02-27 18:11 ——– d—–w- c:\users\Owner\AppData\Local\{6CD548CF-B7E4-4347-ADCF-E814B8F951CD} 2011-02-27 06:10 . 2011-02-27 06:11 ——– d—–w- c:\users\Owner\AppData\Local\{8F7FEB8B-9914-42BD-95B7-4CED8E2E9354} 2011-02-26 17:54 . 2011-02-26 17:54 ——– d—–w- c:\users\Owner\AppData\Local\{AE1C1F5F-8AA3-4B1A-B11F-5E6AC580DB7E} 2011-02-26 05:53 . 2011-02-26 05:53 ——– d—–w- c:\users\Owner\AppData\Local\{2409F4D4-E857-4DA0-8366-0F7A40B3595D} 2011-02-25 17:53 . 2011-02-25 17:53 ——– d—–w- c:\users\Owner\AppData\Local\{21BDA8FE-2902-491F-90FB-67C9134F1FE9} 2011-02-25 05:53 . 2011-02-25 05:53 ——– d—–w- c:\users\Owner\AppData\Local\{D78468A3-0115-403D-93AA-33DE4A277158} 2011-02-24 17:52 . 2011-02-24 17:52 ——– d—–w- c:\users\Owner\AppData\Local\{65F17232-ECF0-47A4-BE2D-FF0761801000} 2011-02-24 08:00 . 2010-09-14 06:45 367104 —-a-w- c:\windows\system32\wcncsvc.dll 2011-02-24 08:00 . 2010-09-14 06:07 276992 —-a-w- c:\windows\SysWow64\wcncsvc.dll 2011-02-23 23:30 . 2011-02-23 23:31 ——– d—–w- c:\users\Owner\AppData\Local\Google 2011-02-23 17:52 . 2011-02-24 05:52 ——– d—–w- c:\users\Owner\AppData\Local\{A4ECC5F8-BDD2-4923-AC59-8A31CEA2A1C0} 2011-02-23 17:39 . 2011-01-07 08:07 662528 —-a-w- c:\windows\system32\XpsPrint.dll 2011-02-23 17:39 . 2011-01-07 08:07 475648 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2011-02-23 17:39 . 2011-01-07 07:31 442880 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2011-02-23 17:39 . 2011-01-07 07:31 288256 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2011-02-23 05:51 . 2011-02-23 05:52 ——– d—–w- c:\users\Owner\AppData\Local\{039EFD14-A6B2-4641-AFEC-CEB2CEA28FC6} 2011-02-22 17:51 . 2011-02-22 17:51 ——– d—–w- c:\users\Owner\AppData\Local\{E12E32BC-A7C8-460E-8CEC-6920BE7BB9EF} 2011-02-21 17:31 . 2011-02-22 05:31 ——– d—–w- c:\users\Owner\AppData\Local\{661242EF-DA26-4C00-8038-D94B86B289D5} 2011-02-21 05:31 . 2011-02-21 05:31 ——– d—–w- c:\users\Owner\AppData\Local\{7901F303-BB87-4D71-853E-41D43856119E} 2011-02-20 17:30 . 2011-02-20 17:31 ——– d—–w- c:\users\Owner\AppData\Local\{03D45DA0-0E3E-4F1F-BFB8-795B706230D7} 2011-02-20 07:23 . 2011-02-20 07:23 30840 —-a-w- c:\windows\system32\Gun64.sys 2011-02-20 05:30 . 2011-02-20 05:30 ——– d—–w- c:\users\Owner\AppData\Local\{9C9398AA-3C34-4906-89EF-575A2500F7BF} 2011-02-19 17:30 . 2011-02-19 17:30 ——– d—–w- c:\users\Owner\AppData\Local\{8388079B-E140-4541-9335-3ED53A7D4262} 2011-02-19 05:28 . 2011-02-19 05:28 ——– d—–w- c:\users\Owner\AppData\Local\{7E66A2A9-0D1A-458E-A449-E0EE7AF2A5EB} 2011-02-18 17:28 . 2011-02-18 17:28 ——– d—–w- c:\users\Owner\AppData\Local\{E12C43AC-A960-4219-86AE-3AD985B59974} 2011-02-18 05:28 . 2011-02-18 05:28 ——– d—–w- c:\users\Owner\AppData\Local\{EAB3EB78-53D8-4336-94BA-94A641A7275A} 2011-02-17 17:27 . 2011-02-17 17:28 ——– d—–w- c:\users\Owner\AppData\Local\{0C3AC355-9E78-4627-9A53-6F99832EF4F3} 2011-02-17 05:27 . 2011-02-17 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{4FE904F2-5794-4F94-95A3-F4DD5550ABCF} 2011-02-16 17:27 . 2011-02-16 17:27 ——– d—–w- c:\users\Owner\AppData\Local\{3108D94C-F14A-4496-BA6D-6FFC42150E1F} 2011-02-16 05:27 . 2011-02-16 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{1D92B586-D022-4F2C-9524-14CC66895EC4} 2011-02-15 23:13 . 2011-02-15 23:13 ——– d—–w- c:\users\Owner\.jagex_cache_32 2011-02-15 17:27 . 2011-02-15 17:27 ——– d—–w- c:\users\Owner\AppData\Local\{DF4AA745-7894-40A7-B9A4-CD48C6EA1C0D} 2011-02-15 05:26 . 2011-02-15 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{A9C904B1-68CA-42B2-92BF-520A38794D91} 2011-02-14 17:26 . 2011-02-14 17:26 ——– d—–w- c:\users\Owner\AppData\Local\{6A196CA6-3D85-4533-B887-7BBFD256CD2E} 2011-02-14 05:26 . 2011-02-14 05:26 ——– d—–w- c:\users\Owner\AppData\Local\{5AEE5F47-8725-4DCB-9032-6442CDE0ECF1} 2011-02-13 17:26 . 2011-02-13 17:26 ——– d—–w- c:\users\Owner\AppData\Local\{3DF0DC04-B597-47C3-AD28-B9511340920B} 2011-02-13 17:26 . 2011-02-13 17:26 ——– d—–w- c:\program files (x86)\Common Files\Software Update Utility 2011-02-12 23:25 . 2011-02-12 23:25 ——– d—–w- c:\users\Owner\AppData\Local\{1AA56722-0226-410A-BBF0-256CD10CD006} 2011-02-12 11:25 . 2011-02-12 11:25 ——– d—–w- c:\users\Owner\AppData\Local\{D0D0991A-C791-4FDD-BC97-AC57B5DDCAE5} 2011-02-11 23:21 . 2011-02-11 23:21 ——– d—–w- c:\users\Owner\AppData\Local\{D93D9F7D-FAD1-4E37-B0C7-F963226222D0} 2011-02-11 11:21 . 2011-02-11 11:21 ——– d—–w- c:\users\Owner\AppData\Local\{EF02311D-FD0B-4C95-865C-BC916D01F6C0} 2011-02-10 23:13 . 2011-02-10 23:13 ——– d—–w- c:\users\Owner\AppData\Local\{17720D17-EA67-4672-8585-191EFE8C0D0E} 2011-02-10 11:12 . 2011-02-10 11:13 ——– d—–w- c:\users\Owner\AppData\Local\{EC81CE77-7BD9-47BF-91EA-0759542DFF9F} 2011-02-09 23:12 . 2011-02-09 23:12 ——– d—–w- c:\users\Owner\AppData\Local\{E185DFE0-681B-4F69-87F1-3AB7B01845C9} 2011-02-09 11:12 . 2011-02-09 11:12 ——– d—–w- c:\users\Owner\AppData\Local\{DDF2BCEA-9F8E-4650-B5A9-BBE796364C60} . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-03 02:40 . 2010-09-27 23:00 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-02-02 22:11 . 2010-09-26 20:09 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-01-26 06:53 . 2011-02-08 20:53 982912 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-26 06:53 . 2011-02-08 20:53 265088 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-01-26 06:31 . 2011-02-08 20:53 144384 —-a-w- c:\windows\system32\cdd.dll 2011-01-24 17:55 . 2011-01-26 20:52 73216 —-a-w- c:\windows\SysWow64\ff_vfw.dll 2011-01-24 17:52 . 2011-01-26 20:52 44032 —-a-w- c:\windows\SysWow64\ff_acm.acm 2011-01-19 08:26 . 2011-01-19 08:26 86016 —-a-w- c:\windows\SysWow64\frapsvid.dll 2011-01-19 08:26 . 2011-01-19 08:26 84992 —-a-w- c:\windows\system32\frapsv64.dll 2011-01-11 16:43 . 2010-09-11 04:41 362784 —-a-w- c:\windows\system32\guard64.dll 2011-01-11 16:43 . 2010-09-11 04:41 285480 —-a-w- c:\windows\SysWow64\guard32.dll 2011-01-11 16:43 . 2010-09-11 04:40 89840 —-a-w- c:\windows\system32\drivers\inspect.sys 2011-01-11 16:43 . 2010-09-11 04:40 39888 —-a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-11 16:43 . 2010-09-11 04:40 250008 —-a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-11 16:43 . 2010-09-11 04:40 14184 —-a-w- c:\windows\system32\drivers\cmderd.sys 2011-01-07 08:06 . 2011-02-08 20:53 46080 —-a-w- c:\windows\system32\atmlib.dll 2011-01-07 07:27 . 2011-02-08 20:53 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2011-01-07 05:49 . 2011-02-08 20:53 366080 —-a-w- c:\windows\system32\atmfd.dll 2011-01-07 05:33 . 2011-02-08 20:53 294400 —-a-w- c:\windows\SysWow64\atmfd.dll 2011-01-05 06:20 . 2011-02-08 20:53 612352 —-a-w- c:\windows\system32\vbscript.dll 2011-01-05 05:37 . 2011-02-08 20:53 428032 —-a-w- c:\windows\SysWow64\vbscript.dll 2011-01-05 04:00 . 2011-02-08 20:53 3127808 —-a-w- c:\windows\system32\win32k.sys 2010-12-22 01:24 . 2010-12-22 01:24 3217408 —-a-w- c:\windows\system32\atiumd6a.dll 2010-12-22 01:24 . 2010-12-22 01:24 423424 —-a-w- c:\windows\system32\atipdl64.dll 2010-12-22 01:24 . 2010-12-22 01:24 5441024 —-a-w- c:\windows\SysWow64\aticaldd.dll 2010-12-22 01:24 . 2010-12-22 01:24 120320 —-a-w- c:\windows\system32\atitmm64.dll 2010-12-22 01:24 . 2010-12-22 01:23 462848 —-a-w- c:\windows\system32\ATIDEMGX.dll 2010-12-22 01:24 . 2010-12-22 01:23 356352 —-a-w- c:\windows\SysWow64\atipdlxx.dll 2010-12-22 01:23 . 2010-12-22 01:23 43520 —-a-w- c:\windows\SysWow64\ati2edxx.dll 2010-12-22 01:23 . 2010-08-17 22:08 39936 —-a-w- c:\windows\system32\atiuxp64.dll 2010-12-22 01:23 . 2010-12-22 01:23 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll 2010-12-22 01:23 . 2010-08-17 22:08 58880 —-a-w- c:\windows\system32\coinst.dll 2010-12-22 01:23 . 2010-08-17 22:08 4122624 —-a-w- c:\windows\SysWow64\atiumdag.dll 2010-12-22 01:23 . 2010-08-17 22:08 648704 —-a-w- c:\windows\system32\aticfx64.dll 2010-12-22 01:23 . 2010-12-22 01:23 278528 —-a-w- c:\windows\SysWow64\Oemdspif.dll 2010-12-22 01:23 . 2010-12-22 01:23 27136 —-a-w- c:\windows\SysWow64\atigktxx.dll 2010-12-22 01:23 . 2010-08-17 22:08 4794368 —-a-w- c:\windows\system32\atidxx64.dll 2010-12-22 01:23 . 2010-12-22 01:23 12800 —-a-w- c:\windows\SysWow64\atiglpxx.dll 2010-12-22 01:23 . 2010-12-22 01:23 12800 —-a-w- c:\windows\system32\atiglpxx.dll 2010-12-22 01:23 . 2010-12-22 01:22 6815232 —-a-w- c:\windows\system32\aticaldd64.dll 2010-12-22 01:23 . 2010-08-17 22:08 4066816 —-a-w- c:\windows\SysWow64\atidxx32.dll 2010-12-22 01:23 . 2010-12-22 01:22 332800 —-a-w- c:\windows\system32\ATIODE.exe 2010-12-22 01:23 . 2010-08-17 22:08 30720 —-a-w- c:\windows\SysWow64\atiuxpag.dll 2010-12-22 01:22 . 2010-12-22 01:22 46080 —-a-w- c:\windows\SysWow64\aticalrt.dll 2010-12-22 01:22 . 2010-12-22 01:22 44544 —-a-w- c:\windows\system32\aticalcl64.dll 2010-12-22 01:22 . 2010-12-22 01:22 51200 —-a-w- c:\windows\system32\aticalrt64.dll 2010-12-22 01:22 . 2010-12-22 01:22 14848 —-a-w- c:\windows\system32\atig6pxx.dll 2010-12-22 01:22 . 2010-12-22 01:22 289792 —-a-w- c:\windows\system32\drivers\atikmpag.sys 2010-12-22 01:22 . 2010-12-22 01:22 203776 —-a-w- c:\windows\system32\atiesrxx.exe 2010-12-22 01:22 . 2010-12-22 01:20 21610496 —-a-w- c:\windows\system32\atio6axx.dll 2010-12-22 01:22 . 2010-12-22 01:22 249856 —-a-w- c:\windows\SysWow64\atiadlxy.dll 2010-12-22 01:22 . 2010-12-22 01:22 143360 —-a-w- c:\windows\system32\atiapfxx.exe 2010-12-22 01:22 . 2010-12-22 01:21 53760 —-a-w- c:\windows\system32\atimpc64.dll 2010-12-22 01:22 . 2010-12-22 01:21 53760 —-a-w- c:\windows\system32\amdpcom64.dll 2010-12-22 01:21 . 2010-12-22 01:21 51200 —-a-w- c:\windows\system32\ATIODCLI.exe 2010-12-22 01:21 . 2010-12-22 01:21 44032 —-a-w- c:\windows\SysWow64\aticalcl.dll 2010-12-22 01:21 . 2010-12-22 01:21 52736 —-a-w- c:\windows\SysWow64\atimpc32.dll 2010-12-22 01:21 . 2010-12-22 01:21 52736 —-a-w- c:\windows\SysWow64\amdpcom32.dll 2010-12-22 01:21 . 2010-12-22 01:21 31744 —-a-w- c:\windows\system32\atig6txx.dll 2010-12-22 01:21 . 2010-12-22 01:20 16702976 —-a-w- c:\windows\SysWow64\atioglxx.dll 2010-12-22 01:21 . 2010-12-22 01:20 16384 —-a-w- c:\windows\system32\atimuixx.dll 2010-12-22 01:20 . 2010-12-22 01:20 37888 —-a-w- c:\windows\system32\atiu9p64.dll 2010-12-22 01:20 . 2010-08-17 22:08 28672 —-a-w- c:\windows\SysWow64\atiu9pag.dll 2010-12-22 01:20 . 2010-12-22 01:20 478720 —-a-w- c:\windows\system32\atieclxx.exe 2010-12-22 01:20 . 2010-12-22 01:20 8120320 —-a-w- c:\windows\system32\drivers\atikmdag.sys 2010-12-22 01:20 . 2010-12-22 01:20 59392 —-a-w- c:\windows\system32\atiedu64.dll 2010-12-22 01:20 . 2010-08-17 22:08 3460096 —-a-w- c:\windows\SysWow64\atiumdva.dll 2010-12-22 01:20 . 2010-12-22 01:19 5258240 —-a-w- c:\windows\system32\atiumd64.dll 2010-12-22 01:20 . 2010-12-22 01:19 351232 —-a-w- c:\windows\system32\atiadlxx.dll 2010-12-22 01:20 . 2010-08-17 22:08 550400 —-a-w- c:\windows\SysWow64\aticfx32.dll 2010-12-21 06:16 . 2011-02-08 20:53 97280 —-a-w- c:\windows\system32\wscsvc.dll 2010-12-21 06:16 . 2011-02-08 20:53 62976 —-a-w- c:\windows\system32\wscapi.dll 2010-12-21 06:16 . 2011-02-08 20:53 214016 —-a-w- c:\windows\system32\winsrv.dll 2010-12-21 06:16 . 2011-02-08 20:53 442880 —-a-w- c:\windows\system32\winhttp.dll 2010-12-21 06:16 . 2011-02-08 20:53 1197056 —-a-w- c:\windows\system32\wininet.dll 2010-12-21 06:16 . 2011-02-08 20:53 258048 —-a-w- c:\windows\system32\WebClnt.dll 2010-12-21 06:15 . 2011-02-08 20:53 264192 —-a-w- c:\windows\system32\upnp.dll 2010-12-21 06:15 . 2011-02-08 20:53 15360 —-a-w- c:\windows\system32\slwga.dll 2010-12-21 06:13 . 2011-02-08 20:53 2003968 —-a-w- c:\windows\system32\msxml6.dll 2010-12-21 06:13 . 2011-02-08 20:53 1880576 —-a-w- c:\windows\system32\msxml3.dll 2010-12-21 06:10 . 2011-02-08 20:53 100864 —-a-w- c:\windows\system32\davclnt.dll 2010-12-21 05:38 . 2011-02-08 20:53 51200 —-a-w- c:\windows\SysWow64\wscapi.dll 2010-12-21 05:38 . 2011-02-08 20:53 981504 —-a-w- c:\windows\SysWow64\wininet.dll 2010-12-21 05:38 . 2011-02-08 20:53 350720 —-a-w- c:\windows\SysWow64\winhttp.dll 2010-12-21 05:38 . 2011-02-08 20:53 204800 —-a-w- c:\windows\SysWow64\WebClnt.dll 2010-12-21 05:38 . 2011-02-08 20:53 204288 —-a-w- c:\windows\SysWow64\upnp.dll 2010-12-21 05:38 . 2011-02-08 20:53 14336 —-a-w- c:\windows\SysWow64\slwga.dll 2010-12-21 05:36 . 2011-02-08 20:53 1389568 —-a-w- c:\windows\SysWow64\msxml6.dll 2010-12-21 05:36 . 2011-02-08 20:53 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2010-12-21 05:34 . 2011-02-08 20:53 80384 —-a-w- c:\windows\SysWow64\davclnt.dll 2010-12-20 23:09 . 2010-09-26 23:33 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-20 23:08 . 2010-09-26 23:33 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-18 06:11 . 2011-02-08 20:54 57856 —-a-w- c:\windows\system32\licmgr10.dll 2010-12-18 06:11 . 2011-02-08 20:53 714752 —-a-w- c:\windows\system32\kerberos.dll 2010-12-18 05:29 . 2011-02-08 20:54 44544 —-a-w- c:\windows\SysWow64\licmgr10.dll 2010-12-18 05:29 . 2011-02-08 20:53 541184 —-a-w- c:\windows\SysWow64\kerberos.dll 2010-12-18 04:55 . 2011-02-08 20:54 482816 —-a-w- c:\windows\system32\html.iec 2010-12-18 04:20 . 2011-02-08 20:54 386048 —-a-w- c:\windows\SysWow64\html.iec 2010-12-18 04:13 . 2011-02-08 20:54 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2010-12-18 03:47 . 2011-02-08 20:54 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}] 2010-12-19 14:46 86696 —-a-w- c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2010-12-19 86696] . [HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-08-09 565480] "Aim"="c:\program files (x86)\AIM\aim.exe" [2011-01-05 4321112] "Google Update"="c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" [2011-02-23 136176] "RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-03-06 107000] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-26 98304] "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296] "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-12-16 423232] "Panda Security URL Filtering"="c:\programdata\Panda Security URL Filtering\Panda_URL_Filtering.exe" [2010-12-19 223400] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MRI_DISABLED Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-6-17 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete] 2009-10-14 22:53 563736 —-a-w- c:\program files (x86)\PDF Complete\pdfsty.exe . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 ALSysIO;ALSysIO;c:\users\Owner\AppData\Local\Temp\ALSysIO64.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\CABAL Online (US)\GameGuard\dump_wmimmc.sys [x] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 Gun;Gun;c:\windows\system32\Gun64.sys [x] R3 vtany;vtany;c:\windows\vtany.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 X6va003;X6va003;c:\users\Owner\AppData\Local\Temp\0038F3E.tmp [x] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x] S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-06-13 400368] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-20 363344] S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-12-16 140608] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2009-10-14 635416] S2 PSINAFLT;PSINAFLT;c:\windows\system32\DRIVERS\PSINAflt.sys [x] S2 PSINFILE;PSINFILE;c:\windows\system32\DRIVERS\PSINFile.sys [x] S2 PSINPROC;PSINPROC;c:\windows\system32\DRIVERS\PSINProc.sys [x] S2 PSINPROT;PSINPROT;c:\windows\system32\DRIVERS\PSINProt.sys [x] S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-09-21 1957672] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - PSINAFLT *NewlyCreated* - PSINFILE *NewlyCreated* - PSINKNC *NewlyCreated* - PSINPROC *NewlyCreated* - PSINPROT . Contents of the 'Scheduled Tasks' folder . 2011-03-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3841339290-2289582511-2207286269-1000Core.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-23 23:30] . 2011-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3841339290-2289582511-2207286269-1000UA.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-23 23:30] . 2011-02-23 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon] @="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}" [HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}] 2010-12-16 23:17 473408 —-a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon] @="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}" [HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}] 2010-12-16 23:17 473408 —-a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "COMODO Internet Security"="c:\program files (x86)\COMODO\COMODO Internet Security\cfp.exe" [2011-01-29 8866120] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x1 "AppInit_DLLs"=c:\windows\System32\guard64.dll . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html TCP: {150CF6BF-D972-42B6-8023-B7AE83D9136D} = 156.154.70.22,156.154.71.22 TCP: {A79E082E-EB55-4F19-ACC5-D0B5AEFFE112} = 156.154.70.22,156.154.71.22 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\umtyqo16.default\ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Utopia FFSE White: {20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E} - %profile%\extensions\{20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E} FF - Ext: Cookie Monster: {45d8ff86-d909-11db-9705-005056c00008} - %profile%\extensions\{45d8ff86-d909-11db-9705-005056c00008} FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} FF - Ext: Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - c:\program files (x86)\Siber Systems\AI RoboForm\Firefox FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(general.useragent.extra.brc, BRI/1 FF - user.js: network.protocol-handler.warn-external.dnupdate - false . - - - - ORPHANS REMOVED - - - - . MSConfigStartUp-HP Software Update - c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe MSConfigStartUp-Norton Online Backup - c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-{FBBC4667-2521-4E78-B1BD-8706F774549B} - c:\programdata\{52FD7279-AB6C-4868-9409-1842DECDABD3}\Best Buy Software Installer Setup.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher] "ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va003] "ImagePath"="\??\c:\users\Owner\AppData\Local\Temp\0038F3E.tmp" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3841339290-2289582511-2207286269-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3841339290-2289582511-2207286269-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-03-10 23:50:20 ComboFix-quarantined-files.txt 2011-03-11 04:50 . Pre-Run: 926,780,424,192 bytes free Post-Run: 926,710,009,856 bytes free . - - End Of File - - FEAFADD473A18665FC5D8EC1026B4431

Tomk

Post #4March 11, 2011, 7:02 AM UTC

SkeW,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

folder::
c:\programdata\AVAST Software
c:\programdata\McAfee

File::
c:\users\Owner\AppData\Local\Temp\ALSysIO64.sys
c:\program files (x86)\CABAL Online (US)\GameGuard\dump_wmimmc.sys
c:\windows\system32\drivers\EagleX64.sys
c:\windows\system32\Gun64.sys
c:\windows\vtany.sys
c:\windows\system32\Wat\WatAdminSvc.exe
c:\users\Owner\AppData\Local\Temp\0038F3E.tmp
c:\windows\system32\DRIVERS\psinknc.sys
c:\windows\system32\atiesrxx.exe
c:\windows\system32\DRIVERS\PSINAflt.sys
c:\windows\system32\DRIVERS\PSINFile.sys
c:\windows\system32\DRIVERS\PSINProc.sys
c:\windows\system32\DRIVERS\PSINProt.sys
c:\windows\system32\DRIVERS\atikmdag.sys
c:\windows\system32\DRIVERS\atikmpag.sys

driver::
ALSysIO
dump_wmimmc
EagleX64
Gun
vtany
WatAdminSvc
X6va003
PSINKNC
AMD External Events Utility
PSINAFLT
PSINFILE
PSINPROC
PSINPROT
amdkmdag
amdkmdap

Firefox::
FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\umtyqo16.default\
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

BlendingLight

Post #5March 11, 2011, 6:14 PM UTC last edited March 11, 2011, 6:30 PM UTC

Hi Tomk. Is there a specific files that control administrative rights? If there is I would like to add it to COMODO's Defense + or is that a bad idea? Also, after the scan, my desktop is kind of disoriented. Here's the report: ComboFix 11-03-10.04 - Owner 03/11/2011 12:53:16.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.5887.4448 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Owner\Desktop\CFScript.txt AV: Panda Cloud Antivirus *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59} FW: COMODO Firewall *Disabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE} SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28} SP: Panda Cloud Antivirus *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files (x86)\CABAL Online (US)\GameGuard\dump_wmimmc.sys" "c:\users\Owner\AppData\Local\Temp\0038F3E.tmp" "c:\users\Owner\AppData\Local\Temp\ALSysIO64.sys" "c:\windows\system32\atiesrxx.exe" "c:\windows\system32\DRIVERS\atikmdag.sys" "c:\windows\system32\DRIVERS\atikmpag.sys" "c:\windows\system32\drivers\EagleX64.sys" "c:\windows\system32\DRIVERS\PSINAflt.sys" "c:\windows\system32\DRIVERS\PSINFile.sys" "c:\windows\system32\DRIVERS\psinknc.sys" "c:\windows\system32\DRIVERS\PSINProc.sys" "c:\windows\system32\DRIVERS\PSINProt.sys" "c:\windows\system32\Gun64.sys" "c:\windows\system32\Wat\WatAdminSvc.exe" "c:\windows\vtany.sys" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome.manifest c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\install.rdf c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome.manifest c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\install.rdf c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome.manifest c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\install.rdf c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome.manifest c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\install.rdf c:\programdata\AVAST Software c:\programdata\McAfee c:\programdata\McAfee\MCLOGS\Common\MsiExec\MsiExec000.log c:\windows\system32\atiesrxx.exe c:\windows\system32\DRIVERS\atikmdag.sys c:\windows\system32\DRIVERS\atikmpag.sys c:\windows\system32\DRIVERS\PSINAflt.sys c:\windows\system32\DRIVERS\PSINFile.sys c:\windows\system32\DRIVERS\psinknc.sys c:\windows\system32\DRIVERS\PSINProc.sys c:\windows\system32\DRIVERS\PSINProt.sys c:\windows\system32\Gun64.sys c:\windows\system32\Wat\WatAdminSvc.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Legacy_AMDKMDAG ——-\Legacy_EAGLEX64 ——-\Legacy_GUN ——-\Legacy_PSINAFLT ——-\Legacy_PSINFILE ——-\Legacy_PSINKNC ——-\Legacy_PSINPROC ——-\Legacy_PSINPROT ——-\Legacy_X6VA003 ——-\Service_ALSysIO ——-\Service_AMD External Events Utility ——-\Service_amdkmdag ——-\Service_amdkmdap ——-\Service_dump_wmimmc ——-\Service_EagleX64 ——-\Service_Gun ——-\Service_PSINAflt ——-\Service_PSINFile ——-\Service_PSINKNC ——-\Service_PSINProc ——-\Service_PSINProt ——-\Service_vtany ——-\Service_WatAdminSvc ——-\Service_X6va003 . . ((((((((((((((((((((((((( Files Created from 2011-02-11 to 2011-03-11 ))))))))))))))))))))))))))))))) . . 2011-03-11 17:59 . 2011-03-11 17:59 ——– d—–w- c:\users\Owner\AppData\Roaming\EurekaLog 2011-03-11 17:58 . 2011-03-11 17:58 ——– d—–w- c:\users\Guest\AppData\Local\temp 2011-03-11 17:58 . 2011-03-11 17:58 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-03-11 07:46 . 2011-02-11 07:30 7947600 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2DC823AD-0199-4606-B027-00EE092592C6}\mpengine.dll 2011-03-11 01:15 . 2011-03-11 01:15 ——– d—–w- c:\users\Owner\AppData\Roaming\SurfSecret Privacy Suite 2011-03-11 01:14 . 2011-03-11 01:15 ——– d—–w- c:\users\Owner\AppData\Local\panda2_0dn 2011-03-11 01:14 . 2011-03-11 18:00 ——– d—–w- c:\programdata\Panda Security URL Filtering 2011-03-11 01:13 . 2011-03-11 01:13 ——– d—–w- c:\users\Owner\AppData\Roaming\Panda Security 2011-03-11 01:13 . 2011-03-11 01:15 ——– d—–w- c:\program files (x86)\Panda Security 2011-03-11 01:13 . 2011-03-11 01:13 ——– d—–w- c:\programdata\Panda Security 2011-03-10 21:21 . 2011-03-10 21:22 ——– d—–w- c:\users\Owner\AppData\Local\{4AF2B197-0EEF-49A0-B94F-8D29CE16DDD9} 2011-03-10 09:21 . 2011-03-10 09:21 ——– d—–w- c:\users\Owner\AppData\Local\{D587B395-7D29-459F-9588-70D5FC8F07D9} 2011-03-09 21:09 . 2011-03-09 21:10 ——– d—–w- c:\users\Owner\AppData\Local\{3E65A2D4-0D68-420F-85E3-37BBE60A8507} 2011-03-09 09:09 . 2011-03-09 09:09 ——– d—–w- c:\users\Owner\AppData\Local\{358FAF2C-0F67-4894-B01A-83DD192C19F9} 2011-03-08 23:08 . 2011-03-08 23:12 ——– d—–w- c:\users\Owner\AppData\Roaming\ImgBurn 2011-03-08 23:07 . 2011-03-08 23:07 ——– d—–w- c:\program files (x86)\ImgBurn 2011-03-08 21:03 . 2011-03-08 21:03 ——– d—–w- c:\users\Owner\AppData\Local\{3CF434FB-B646-4D6C-A4AA-733B21E81661} 2011-03-08 03:34 . 2011-03-08 03:34 ——– d—–w- c:\users\Owner\AppData\Local\ElevatedDiagnostics 2011-03-08 01:52 . 2011-02-23 15:04 238968 —-a-w- c:\windows\system32\aswBoot.exe 2011-03-07 21:49 . 2011-03-07 21:49 ——– d—–w- c:\users\Owner\AppData\Local\{D583AE8D-776E-4333-B4A3-45FA25D0D490} 2011-03-06 23:39 . 2011-03-06 23:39 ——– d—–w- c:\program files (x86)\eC 2011-03-06 21:55 . 2011-03-06 21:55 ——– d—–w- c:\programdata\RoboForm 2011-03-06 21:55 . 2011-03-06 21:55 ——– d—–w- c:\program files (x86)\Siber Systems 2011-03-06 19:13 . 2011-03-06 19:13 ——– d—–w- c:\users\Owner\AppData\Local\{834888A7-E10C-4D0A-AF80-E69630F9EAD7} 2011-03-06 07:13 . 2011-03-06 07:13 ——– d—–w- c:\users\Owner\AppData\Local\{60D76E80-D4B5-4B74-8FFC-857BB1897674} 2011-03-05 19:13 . 2011-03-05 19:13 ——– d—–w- c:\users\Owner\AppData\Local\{4EE35F11-B997-4E0F-992C-67EFB32C3781} 2011-03-05 07:12 . 2011-03-05 07:12 ——– d—–w- c:\users\Owner\AppData\Local\{DEC40C6B-E87A-49DC-8795-68C9E8975C95} 2011-03-04 21:04 . 2011-03-04 21:04 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-03-04 19:12 . 2011-03-04 19:12 ——– d—–w- c:\users\Owner\AppData\Local\{2CF86498-C52B-4FF5-BB75-0D4A453339B8} 2011-03-04 07:12 . 2011-03-04 07:12 ——– d—–w- c:\users\Owner\AppData\Local\{DF6D985F-7B8C-4B17-A306-3DF890DBB009} 2011-03-03 19:06 . 2011-03-03 19:06 ——– d—–w- c:\users\Owner\AppData\Local\{2DFF04A7-9B7A-4B9D-9B8E-652D48A0AA29} 2011-03-03 06:51 . 2011-03-03 06:51 ——– d—–w- c:\users\Owner\AppData\Local\{8AA4D5F2-ACF5-4B9A-A04A-8982C483BD2B} 2011-03-02 18:42 . 2011-03-02 18:42 ——– d—–w- c:\users\Owner\AppData\Local\{4F2486D5-BC2F-4F69-B57E-F7A70CB0A1C5} 2011-03-02 06:31 . 2011-03-02 06:31 ——– d—–w- c:\users\Owner\AppData\Local\{39D0C102-87BF-453D-A623-7BB689CB648C} 2011-03-01 18:31 . 2011-03-01 18:31 ——– d—–w- c:\users\Owner\AppData\Local\{4865BD0E-C444-4D6B-8AFE-C3B9BC943CE9} 2011-03-01 06:22 . 2011-03-01 06:23 ——– d—–w- c:\users\Owner\AppData\Local\{B0C6EF3E-143E-463B-BB30-B89F1B27E066} 2011-02-28 18:22 . 2011-02-28 18:22 ——– d—–w- c:\users\Owner\AppData\Local\{AC3C0255-CC7C-4800-88F9-03B057C5C3DC} 2011-02-28 06:11 . 2011-02-28 06:11 ——– d—–w- c:\users\Owner\AppData\Local\{DC029271-C26C-45AD-B14C-CADB33CB35CA} 2011-02-27 18:11 . 2011-02-27 18:11 ——– d—–w- c:\users\Owner\AppData\Local\{6CD548CF-B7E4-4347-ADCF-E814B8F951CD} 2011-02-27 06:10 . 2011-02-27 06:11 ——– d—–w- c:\users\Owner\AppData\Local\{8F7FEB8B-9914-42BD-95B7-4CED8E2E9354} 2011-02-26 17:54 . 2011-02-26 17:54 ——– d—–w- c:\users\Owner\AppData\Local\{AE1C1F5F-8AA3-4B1A-B11F-5E6AC580DB7E} 2011-02-26 05:53 . 2011-02-26 05:53 ——– d—–w- c:\users\Owner\AppData\Local\{2409F4D4-E857-4DA0-8366-0F7A40B3595D} 2011-02-25 17:53 . 2011-02-25 17:53 ——– d—–w- c:\users\Owner\AppData\Local\{21BDA8FE-2902-491F-90FB-67C9134F1FE9} 2011-02-25 05:53 . 2011-02-25 05:53 ——– d—–w- c:\users\Owner\AppData\Local\{D78468A3-0115-403D-93AA-33DE4A277158} 2011-02-24 17:52 . 2011-02-24 17:52 ——– d—–w- c:\users\Owner\AppData\Local\{65F17232-ECF0-47A4-BE2D-FF0761801000} 2011-02-24 08:00 . 2010-09-14 06:45 367104 —-a-w- c:\windows\system32\wcncsvc.dll 2011-02-24 08:00 . 2010-09-14 06:07 276992 —-a-w- c:\windows\SysWow64\wcncsvc.dll 2011-02-23 23:30 . 2011-02-23 23:31 ——– d—–w- c:\users\Owner\AppData\Local\Google 2011-02-23 17:52 . 2011-02-24 05:52 ——– d—–w- c:\users\Owner\AppData\Local\{A4ECC5F8-BDD2-4923-AC59-8A31CEA2A1C0} 2011-02-23 17:39 . 2011-01-07 08:07 662528 —-a-w- c:\windows\system32\XpsPrint.dll 2011-02-23 17:39 . 2011-01-07 08:07 475648 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2011-02-23 17:39 . 2011-01-07 07:31 442880 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2011-02-23 17:39 . 2011-01-07 07:31 288256 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2011-02-23 05:51 . 2011-02-23 05:52 ——– d—–w- c:\users\Owner\AppData\Local\{039EFD14-A6B2-4641-AFEC-CEB2CEA28FC6} 2011-02-22 17:51 . 2011-02-22 17:51 ——– d—–w- c:\users\Owner\AppData\Local\{E12E32BC-A7C8-460E-8CEC-6920BE7BB9EF} 2011-02-21 17:31 . 2011-02-22 05:31 ——– d—–w- c:\users\Owner\AppData\Local\{661242EF-DA26-4C00-8038-D94B86B289D5} 2011-02-21 05:31 . 2011-02-21 05:31 ——– d—–w- c:\users\Owner\AppData\Local\{7901F303-BB87-4D71-853E-41D43856119E} 2011-02-20 17:30 . 2011-02-20 17:31 ——– d—–w- c:\users\Owner\AppData\Local\{03D45DA0-0E3E-4F1F-BFB8-795B706230D7} 2011-02-20 05:30 . 2011-02-20 05:30 ——– d—–w- c:\users\Owner\AppData\Local\{9C9398AA-3C34-4906-89EF-575A2500F7BF} 2011-02-19 17:30 . 2011-02-19 17:30 ——– d—–w- c:\users\Owner\AppData\Local\{8388079B-E140-4541-9335-3ED53A7D4262} 2011-02-19 05:28 . 2011-02-19 05:28 ——– d—–w- c:\users\Owner\AppData\Local\{7E66A2A9-0D1A-458E-A449-E0EE7AF2A5EB} 2011-02-18 17:28 . 2011-02-18 17:28 ——– d—–w- c:\users\Owner\AppData\Local\{E12C43AC-A960-4219-86AE-3AD985B59974} 2011-02-18 05:28 . 2011-02-18 05:28 ——– d—–w- c:\users\Owner\AppData\Local\{EAB3EB78-53D8-4336-94BA-94A641A7275A} 2011-02-17 17:27 . 2011-02-17 17:28 ——– d—–w- c:\users\Owner\AppData\Local\{0C3AC355-9E78-4627-9A53-6F99832EF4F3} 2011-02-17 05:27 . 2011-02-17 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{4FE904F2-5794-4F94-95A3-F4DD5550ABCF} 2011-02-16 17:27 . 2011-02-16 17:27 ——– d—–w- c:\users\Owner\AppData\Local\{3108D94C-F14A-4496-BA6D-6FFC42150E1F} 2011-02-16 05:27 . 2011-02-16 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{1D92B586-D022-4F2C-9524-14CC66895EC4} 2011-02-15 23:13 . 2011-02-15 23:13 ——– d—–w- c:\users\Owner\.jagex_cache_32 2011-02-15 17:27 . 2011-02-15 17:27 ——– d—–w- c:\users\Owner\AppData\Local\{DF4AA745-7894-40A7-B9A4-CD48C6EA1C0D} 2011-02-15 05:26 . 2011-02-15 05:27 ——– d—–w- c:\users\Owner\AppData\Local\{A9C904B1-68CA-42B2-92BF-520A38794D91} 2011-02-14 17:26 . 2011-02-14 17:26 ——– d—–w- c:\users\Owner\AppData\Local\{6A196CA6-3D85-4533-B887-7BBFD256CD2E} 2011-02-14 05:26 . 2011-02-14 05:26 ——– d—–w- c:\users\Owner\AppData\Local\{5AEE5F47-8725-4DCB-9032-6442CDE0ECF1} 2011-02-13 17:26 . 2011-02-13 17:26 ——– d—–w- c:\users\Owner\AppData\Local\{3DF0DC04-B597-47C3-AD28-B9511340920B} 2011-02-13 17:26 . 2011-02-13 17:26 ——– d—–w- c:\program files (x86)\Common Files\Software Update Utility 2011-02-12 23:25 . 2011-02-12 23:25 ——– d—–w- c:\users\Owner\AppData\Local\{1AA56722-0226-410A-BBF0-256CD10CD006} 2011-02-12 11:25 . 2011-02-12 11:25 ——– d—–w- c:\users\Owner\AppData\Local\{D0D0991A-C791-4FDD-BC97-AC57B5DDCAE5} 2011-02-11 23:21 . 2011-02-11 23:21 ——– d—–w- c:\users\Owner\AppData\Local\{D93D9F7D-FAD1-4E37-B0C7-F963226222D0} 2011-02-11 11:21 . 2011-02-11 11:21 ——– d—–w- c:\users\Owner\AppData\Local\{EF02311D-FD0B-4C95-865C-BC916D01F6C0} 2011-02-10 23:13 . 2011-02-10 23:13 ——– d—–w- c:\users\Owner\AppData\Local\{17720D17-EA67-4672-8585-191EFE8C0D0E} 2011-02-10 11:12 . 2011-02-10 11:13 ——– d—–w- c:\users\Owner\AppData\Local\{EC81CE77-7BD9-47BF-91EA-0759542DFF9F} 2011-02-09 23:12 . 2011-02-09 23:12 ——– d—–w- c:\users\Owner\AppData\Local\{E185DFE0-681B-4F69-87F1-3AB7B01845C9} . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-02-03 02:40 . 2010-09-27 23:00 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-02-02 22:11 . 2010-09-26 20:09 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-01-26 06:53 . 2011-02-08 20:53 982912 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-26 06:53 . 2011-02-08 20:53 265088 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-01-26 06:31 . 2011-02-08 20:53 144384 —-a-w- c:\windows\system32\cdd.dll 2011-01-24 17:55 . 2011-01-26 20:52 73216 —-a-w- c:\windows\SysWow64\ff_vfw.dll 2011-01-24 17:52 . 2011-01-26 20:52 44032 —-a-w- c:\windows\SysWow64\ff_acm.acm 2011-01-19 08:26 . 2011-01-19 08:26 86016 —-a-w- c:\windows\SysWow64\frapsvid.dll 2011-01-19 08:26 . 2011-01-19 08:26 84992 —-a-w- c:\windows\system32\frapsv64.dll 2011-01-11 16:43 . 2010-09-11 04:41 362784 —-a-w- c:\windows\system32\guard64.dll 2011-01-11 16:43 . 2010-09-11 04:41 285480 —-a-w- c:\windows\SysWow64\guard32.dll 2011-01-11 16:43 . 2010-09-11 04:40 89840 —-a-w- c:\windows\system32\drivers\inspect.sys 2011-01-11 16:43 . 2010-09-11 04:40 39888 —-a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-11 16:43 . 2010-09-11 04:40 250008 —-a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-11 16:43 . 2010-09-11 04:40 14184 —-a-w- c:\windows\system32\drivers\cmderd.sys 2011-01-07 08:06 . 2011-02-08 20:53 46080 —-a-w- c:\windows\system32\atmlib.dll 2011-01-07 07:27 . 2011-02-08 20:53 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2011-01-07 05:49 . 2011-02-08 20:53 366080 —-a-w- c:\windows\system32\atmfd.dll 2011-01-07 05:33 . 2011-02-08 20:53 294400 —-a-w- c:\windows\SysWow64\atmfd.dll 2011-01-05 06:20 . 2011-02-08 20:53 612352 —-a-w- c:\windows\system32\vbscript.dll 2011-01-05 05:37 . 2011-02-08 20:53 428032 —-a-w- c:\windows\SysWow64\vbscript.dll 2011-01-05 04:00 . 2011-02-08 20:53 3127808 —-a-w- c:\windows\system32\win32k.sys 2010-12-22 01:24 . 2010-12-22 01:24 3217408 —-a-w- c:\windows\system32\atiumd6a.dll 2010-12-22 01:24 . 2010-12-22 01:24 423424 —-a-w- c:\windows\system32\atipdl64.dll 2010-12-22 01:24 . 2010-12-22 01:24 5441024 —-a-w- c:\windows\SysWow64\aticaldd.dll 2010-12-22 01:24 . 2010-12-22 01:24 120320 —-a-w- c:\windows\system32\atitmm64.dll 2010-12-22 01:24 . 2010-12-22 01:23 462848 —-a-w- c:\windows\system32\ATIDEMGX.dll 2010-12-22 01:24 . 2010-12-22 01:23 356352 —-a-w- c:\windows\SysWow64\atipdlxx.dll 2010-12-22 01:23 . 2010-12-22 01:23 43520 —-a-w- c:\windows\SysWow64\ati2edxx.dll 2010-12-22 01:23 . 2010-08-17 22:08 39936 —-a-w- c:\windows\system32\atiuxp64.dll 2010-12-22 01:23 . 2010-12-22 01:23 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll 2010-12-22 01:23 . 2010-08-17 22:08 58880 —-a-w- c:\windows\system32\coinst.dll 2010-12-22 01:23 . 2010-08-17 22:08 4122624 —-a-w- c:\windows\SysWow64\atiumdag.dll 2010-12-22 01:23 . 2010-08-17 22:08 648704 —-a-w- c:\windows\system32\aticfx64.dll 2010-12-22 01:23 . 2010-12-22 01:23 278528 —-a-w- c:\windows\SysWow64\Oemdspif.dll 2010-12-22 01:23 . 2010-12-22 01:23 27136 —-a-w- c:\windows\SysWow64\atigktxx.dll 2010-12-22 01:23 . 2010-08-17 22:08 4794368 —-a-w- c:\windows\system32\atidxx64.dll 2010-12-22 01:23 . 2010-12-22 01:23 12800 —-a-w- c:\windows\SysWow64\atiglpxx.dll 2010-12-22 01:23 . 2010-12-22 01:23 12800 —-a-w- c:\windows\system32\atiglpxx.dll 2010-12-22 01:23 . 2010-12-22 01:22 6815232 —-a-w- c:\windows\system32\aticaldd64.dll 2010-12-22 01:23 . 2010-08-17 22:08 4066816 —-a-w- c:\windows\SysWow64\atidxx32.dll 2010-12-22 01:23 . 2010-12-22 01:22 332800 —-a-w- c:\windows\system32\ATIODE.exe 2010-12-22 01:23 . 2010-08-17 22:08 30720 —-a-w- c:\windows\SysWow64\atiuxpag.dll 2010-12-22 01:22 . 2010-12-22 01:22 46080 —-a-w- c:\windows\SysWow64\aticalrt.dll 2010-12-22 01:22 . 2010-12-22 01:22 44544 —-a-w- c:\windows\system32\aticalcl64.dll 2010-12-22 01:22 . 2010-12-22 01:22 51200 —-a-w- c:\windows\system32\aticalrt64.dll 2010-12-22 01:22 . 2010-12-22 01:22 14848 —-a-w- c:\windows\system32\atig6pxx.dll 2010-12-22 01:22 . 2010-12-22 01:20 21610496 —-a-w- c:\windows\system32\atio6axx.dll 2010-12-22 01:22 . 2010-12-22 01:22 249856 —-a-w- c:\windows\SysWow64\atiadlxy.dll 2010-12-22 01:22 . 2010-12-22 01:22 143360 —-a-w- c:\windows\system32\atiapfxx.exe 2010-12-22 01:22 . 2010-12-22 01:21 53760 —-a-w- c:\windows\system32\atimpc64.dll 2010-12-22 01:22 . 2010-12-22 01:21 53760 —-a-w- c:\windows\system32\amdpcom64.dll 2010-12-22 01:21 . 2010-12-22 01:21 51200 —-a-w- c:\windows\system32\ATIODCLI.exe 2010-12-22 01:21 . 2010-12-22 01:21 44032 —-a-w- c:\windows\SysWow64\aticalcl.dll 2010-12-22 01:21 . 2010-12-22 01:21 52736 —-a-w- c:\windows\SysWow64\atimpc32.dll 2010-12-22 01:21 . 2010-12-22 01:21 52736 —-a-w- c:\windows\SysWow64\amdpcom32.dll 2010-12-22 01:21 . 2010-12-22 01:21 31744 —-a-w- c:\windows\system32\atig6txx.dll 2010-12-22 01:21 . 2010-12-22 01:20 16702976 —-a-w- c:\windows\SysWow64\atioglxx.dll 2010-12-22 01:21 . 2010-12-22 01:20 16384 —-a-w- c:\windows\system32\atimuixx.dll 2010-12-22 01:20 . 2010-12-22 01:20 37888 —-a-w- c:\windows\system32\atiu9p64.dll 2010-12-22 01:20 . 2010-08-17 22:08 28672 —-a-w- c:\windows\SysWow64\atiu9pag.dll 2010-12-22 01:20 . 2010-12-22 01:20 478720 —-a-w- c:\windows\system32\atieclxx.exe 2010-12-22 01:20 . 2010-12-22 01:20 59392 —-a-w- c:\windows\system32\atiedu64.dll 2010-12-22 01:20 . 2010-08-17 22:08 3460096 —-a-w- c:\windows\SysWow64\atiumdva.dll 2010-12-22 01:20 . 2010-12-22 01:19 5258240 —-a-w- c:\windows\system32\atiumd64.dll 2010-12-22 01:20 . 2010-12-22 01:19 351232 —-a-w- c:\windows\system32\atiadlxx.dll 2010-12-22 01:20 . 2010-08-17 22:08 550400 —-a-w- c:\windows\SysWow64\aticfx32.dll 2010-12-21 06:16 . 2011-02-08 20:53 97280 —-a-w- c:\windows\system32\wscsvc.dll 2010-12-21 06:16 . 2011-02-08 20:53 62976 —-a-w- c:\windows\system32\wscapi.dll 2010-12-21 06:16 . 2011-02-08 20:53 214016 —-a-w- c:\windows\system32\winsrv.dll 2010-12-21 06:16 . 2011-02-08 20:53 442880 —-a-w- c:\windows\system32\winhttp.dll 2010-12-21 06:16 . 2011-02-08 20:53 1197056 —-a-w- c:\windows\system32\wininet.dll 2010-12-21 06:16 . 2011-02-08 20:53 258048 —-a-w- c:\windows\system32\WebClnt.dll 2010-12-21 06:15 . 2011-02-08 20:53 264192 —-a-w- c:\windows\system32\upnp.dll 2010-12-21 06:15 . 2011-02-08 20:53 15360 —-a-w- c:\windows\system32\slwga.dll 2010-12-21 06:13 . 2011-02-08 20:53 2003968 —-a-w- c:\windows\system32\msxml6.dll 2010-12-21 06:13 . 2011-02-08 20:53 1880576 —-a-w- c:\windows\system32\msxml3.dll 2010-12-21 06:10 . 2011-02-08 20:53 100864 —-a-w- c:\windows\system32\davclnt.dll 2010-12-21 05:38 . 2011-02-08 20:53 51200 —-a-w- c:\windows\SysWow64\wscapi.dll 2010-12-21 05:38 . 2011-02-08 20:53 981504 —-a-w- c:\windows\SysWow64\wininet.dll 2010-12-21 05:38 . 2011-02-08 20:53 350720 —-a-w- c:\windows\SysWow64\winhttp.dll 2010-12-21 05:38 . 2011-02-08 20:53 204800 —-a-w- c:\windows\SysWow64\WebClnt.dll 2010-12-21 05:38 . 2011-02-08 20:53 204288 —-a-w- c:\windows\SysWow64\upnp.dll 2010-12-21 05:38 . 2011-02-08 20:53 14336 —-a-w- c:\windows\SysWow64\slwga.dll 2010-12-21 05:36 . 2011-02-08 20:53 1389568 —-a-w- c:\windows\SysWow64\msxml6.dll 2010-12-21 05:36 . 2011-02-08 20:53 1236992 —-a-w- c:\windows\SysWow64\msxml3.dll 2010-12-21 05:34 . 2011-02-08 20:53 80384 —-a-w- c:\windows\SysWow64\davclnt.dll 2010-12-20 23:09 . 2010-09-26 23:33 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-20 23:08 . 2010-09-26 23:33 24152 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-12-18 06:11 . 2011-02-08 20:54 57856 —-a-w- c:\windows\system32\licmgr10.dll 2010-12-18 06:11 . 2011-02-08 20:53 714752 —-a-w- c:\windows\system32\kerberos.dll 2010-12-18 05:29 . 2011-02-08 20:54 44544 —-a-w- c:\windows\SysWow64\licmgr10.dll 2010-12-18 05:29 . 2011-02-08 20:53 541184 —-a-w- c:\windows\SysWow64\kerberos.dll 2010-12-18 04:55 . 2011-02-08 20:54 482816 —-a-w- c:\windows\system32\html.iec 2010-12-18 04:20 . 2011-02-08 20:54 386048 —-a-w- c:\windows\SysWow64\html.iec 2010-12-18 04:13 . 2011-02-08 20:54 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2010-12-18 03:47 . 2011-02-08 20:54 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb 2010-12-16 23:39 . 2010-12-16 23:39 361280 —-a-w- c:\windows\system32\PSUNCpl.cpl . . ((((((((((((((((((((((((((((( SnapShot@2011-03-11_04.48.36 ))))))))))))))))))))))))))))))))))))))))) . - 2009-07-14 04:54 . 2011-03-11 01:13 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2011-03-11 18:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2011-03-11 01:13 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-03-11 18:00 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-03-11 01:13 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-03-11 18:00 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-09-26 20:49 . 2011-03-11 18:00 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-26 20:49 . 2011-03-11 00:20 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-26 20:49 . 2011-03-11 00:20 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-09-26 20:49 . 2011-03-11 18:00 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-03-11 18:00 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2011-03-11 00:20 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-09-26 23:02 . 2011-03-09 00:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-09-26 23:02 . 2011-03-11 18:00 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-09-26 23:02 . 2011-03-11 18:00 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-09-26 23:02 . 2011-03-09 00:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-09-26 23:02 . 2011-03-09 00:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-09-26 23:02 . 2011-03-11 18:00 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-09-26 23:02 . 2011-03-09 00:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-09-26 23:02 . 2011-03-11 18:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-26 23:02 . 2011-03-09 00:13 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-09-26 23:02 . 2011-03-11 18:00 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-03-09 00:12 . 2011-03-09 00:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-03-11 18:00 . 2011-03-11 18:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-03-09 00:12 . 2011-03-09 00:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-03-11 18:00 . 2011-03-11 18:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2010-09-27 02:39 . 2011-03-11 17:30 254592 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin - 2009-07-14 05:01 . 2011-03-08 23:43 283680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-03-11 17:59 283680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2010-09-26 20:24 . 2011-03-08 23:43 1377296 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3841339290-2289582511-2207286269-1000-8192.dat + 2010-09-26 20:24 . 2011-03-11 17:59 1377296 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3841339290-2289582511-2207286269-1000-8192.dat + 2009-07-14 02:34 . 2011-03-11 07:56 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT - 2009-07-14 02:34 . 2011-03-10 10:14 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}] 2010-12-19 14:46 86696 —-a-w- c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files (x86)\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2010-12-19 86696] . [HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-08-09 565480] "Aim"="c:\program files (x86)\AIM\aim.exe" [2011-01-05 4321112] "Google Update"="c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" [2011-02-23 136176] "RoboForm"="c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-03-06 107000] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-26 98304] "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296] "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "PSUNMain"="c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-12-16 423232] "Panda Security URL Filtering"="c:\programdata\Panda Security URL Filtering\Panda_URL_Filtering.exe" [2010-12-19 223400] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MRI_DISABLED Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-6-17 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe [BU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Online Backup] c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [BU] . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF Complete] 2009-10-14 22:53 563736 —-a-w- c:\program files (x86)\PDF Complete\pdfsty.exe . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752] S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-06-13 400368] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2010-12-20 363344] S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-12-16 140608] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x] S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2009-10-14 635416] S2 TeamViewer5;TeamViewer 5;c:\program files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-09-21 1957672] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-03-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3841339290-2289582511-2207286269-1000Core.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-23 23:30] . 2011-03-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3841339290-2289582511-2207286269-1000UA.job - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-23 23:30] . 2011-02-23 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon] @="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}" [HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}] 2010-12-16 23:17 473408 —-a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon] @="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}" [HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}] 2010-12-16 23:17 473408 —-a-w- c:\program files (x86)\Panda Security\Panda Cloud Antivirus\PSUNShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF15561.cfxxe" [X] "COMODO Internet Security"="c:\program files (x86)\COMODO\COMODO Internet Security\cfp.exe" [2011-01-29 8866120] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\guard64.dll . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html TCP: {150CF6BF-D972-42B6-8023-B7AE83D9136D} = 156.154.70.22,156.154.71.22 TCP: {A79E082E-EB55-4F19-ACC5-D0B5AEFFE112} = 156.154.70.22,156.154.71.22 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\umtyqo16.default\ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=PCAFSI1190&p= FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Utopia FFSE White: {20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E} - %profile%\extensions\{20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E} FF - Ext: Cookie Monster: {45d8ff86-d909-11db-9705-005056c00008} - %profile%\extensions\{45d8ff86-d909-11db-9705-005056c00008} FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} FF - Ext: Panda Security Toolbar: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - %profile%\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} FF - Ext: Autofill Forms: [removed] - %profile%\extensions\[removed] FF - Ext: Panda Identity Protect: [removed] - c:\program files (x86)\Panda Security\Panda ID Protect\Firefox FF - Ext: Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - c:\program files (x86)\Siber Systems\AI RoboForm\Firefox FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(general.useragent.extra.brc, BRI/1 FF - user.js: network.protocol-handler.warn-external.dnupdate - false . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher] "ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3841339290-2289582511-2207286269-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3841339290-2289582511-2207286269-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files (x86)\OpenOffice.org 3\program\soffice.exe c:\program files (x86)\OpenOffice.org 3\program\soffice.bin c:\program files (x86)\Windows Live\Contacts\wlcomm.exe . ************************************************************************** . Completion time: 2011-03-11 13:03:49 - machine was rebooted ComboFix-quarantined-files.txt 2011-03-11 18:03 ComboFix2.txt 2011-03-11 04:50 . Pre-Run: 925,927,452,672 bytes free Post-Run: 925,339,480,064 bytes free . - - End Of File - - C3A4A08E93A5B39FE6BD0C790691C1B6 EDIT: After ComboFix removed the items, my ATI Drivers are missing and Panda Cloud Antivirus will not start.

Tomk

Post #6March 11, 2011, 8:59 PM UTC

SkeW,

In windows 7 the administrative permissions are handled by UAC. See this link for information:
http://windows.microsoft.com/en-US/windows…account-control

I did not purposefully "mess" with Panda or ATI. I did "clean-up" a couple of links that referenced ATI but was reporting that files were unavailable. I haven't a clue why Panda won't re-enable. Are you able to reinstall these two "programs"?

BlendingLight

Post #7March 11, 2011, 9:04 PM UTC

Tomk, I haven't tried reinstalling yet, but there's more problems now. Windows Aero is buggy. DirectX is not working either. I don't want to reinstall until I can get further advice from you.

Tomk

Post #8March 11, 2011, 9:55 PM UTC

SkeW,

Please browse to and open:
c:\Qoobox\ComboFix-quarantined-files.txt

Copy/paste that information here please.

BlendingLight

Post #9March 11, 2011, 9:56 PM UTC

Tomk, here's the report. 2011-03-11 17:56:58 . 2011-03-11 17:56:58 1,460 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_X6va003.reg.dat 2011-03-11 17:56:58 . 2011-03-11 17:56:58 4,158 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_WatAdminSvc.reg.dat 2011-03-11 17:56:57 . 2011-03-11 17:56:57 812 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_vtany.reg.dat 2011-03-11 17:56:57 . 2011-03-11 17:56:57 1,338 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_PSINProt.reg.dat 2011-03-11 17:56:57 . 2011-03-11 17:56:57 2,270 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_PSINProc.reg.dat 2011-03-11 17:56:57 . 2011-03-11 17:56:57 1,496 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_PSINKNC.reg.dat 2011-03-11 17:56:57 . 2011-03-11 17:56:57 2,122 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_PSINFile.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 1,842 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_PSINAflt.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 1,216 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_Gun.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 1,398 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_EagleX64.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 1,370 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_dump_wmimmc.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 2,390 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_amdkmdap.reg.dat 2011-03-11 17:56:56 . 2011-03-11 17:56:56 17,608 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_amdkmdag.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 980 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_AMD External Events Utility.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,116 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Service_ALSysIO.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,034 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_X6VA003.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,104 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROT.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,104 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROC.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,092 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINKNC.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,104 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINFILE.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,104 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINAFLT.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 994 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_GUN.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,044 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_EAGLEX64.reg.dat 2011-03-11 17:56:55 . 2011-03-11 17:56:55 1,100 —-a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_AMDKMDAG.reg.dat 2011-03-11 17:52:55 . 2011-03-11 17:52:57 5,338,214 —-a-w- C:\Qoobox\Quarantine\[4]-Submit_2011-03-11_12.52.52.zip 2011-03-11 04:49:39 . 2011-03-11 04:49:39 544 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{FBBC4667-2521-4E78-B1BD-8706F774549B}.reg.dat 2011-03-11 04:49:39 . 2011-03-11 04:49:39 1,380 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Adobe Shockwave Player.reg.dat 2011-03-11 04:49:20 . 2011-03-11 04:49:20 692 —-a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Norton Online Backup.reg.dat 2011-03-11 04:49:20 . 2011-03-11 04:49:20 666 —-a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-HP Software Update.reg.dat 2011-03-11 04:46:52 . 2011-03-11 17:56:25 5,263 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2011-03-11 04:41:43 . 2011-03-11 17:51:50 204 —-a-w- C:\Qoobox\Quarantine\catchme.log 2011-03-04 21:03:00 . 2011-03-04 21:03:00 2,704 —-a-w- C:\Qoobox\Quarantine\C\ProgramData\McAfee\MCLOGS\Common\MsiExec\MsiExec000.log.vir 2011-02-20 07:23:55 . 2011-02-20 07:23:55 30,840 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\Gun64.sys.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 671 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\install.rdf.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 788 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome.manifest.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:55 . 2011-01-03 04:04:55 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 510 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul.vir 2011-01-03 04:04:54 . 2011-01-03 04:04:54 1,232 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js.vir 2010-12-22 01:22:14 . 2010-12-22 01:22:19 289,792 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\atikmpag.sys.vir 2010-12-22 01:22:12 . 2010-12-22 01:22:15 203,776 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\atiesrxx.exe.vir 2010-12-22 01:20:09 . 2010-12-22 01:20:42 8,120,320 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\atikmdag.sys.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 788 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome.manifest.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 671 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\install.rdf.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 1,232 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js.vir 2010-12-20 16:45:36 . 2010-12-20 16:45:36 510 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul.vir 2010-12-16 23:12:18 . 2010-12-16 23:12:18 128,584 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINProt.sys.vir 2010-12-16 23:12:11 . 2010-12-16 23:12:11 121,928 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINProc.sys.vir 2010-12-16 23:12:04 . 2010-12-16 23:12:04 150,088 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINKNC.sys.vir 2010-12-16 23:11:56 . 2010-12-16 23:11:56 114,760 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINFile.sys.vir 2010-12-16 23:11:49 . 2010-12-16 23:11:49 158,280 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINAflt.sys.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 788 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome.manifest.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 671 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\install.rdf.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 1,232 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js.vir 2010-11-01 10:12:58 . 2010-11-01 10:12:58 510 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 788 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome.manifest.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 671 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\install.rdf.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 1,232 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 510 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd.vir 2010-09-27 23:00:42 . 2010-09-27 23:00:42 94 —-a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd.vir 2010-09-26 20:24:52 . 2010-09-26 20:14:26 1,255,736 —-a-w- C:\Qoobox\Quarantine\C\Windows\System32\Wat\WatAdminSvc.exe.vir

Tomk

Post #10March 12, 2011, 12:26 AM UTC

SkeW,

Alrighty then… let's undo what I did.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\Windows\System32\Gun64.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\atikmpag.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\atiesrxx.exe.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\atikmdag.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINProt.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINProc.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINKNC.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINFile.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\drivers\PSINAflt.sys.vir
C:\Qoobox\Quarantine\C\Windows\System32\Wat\WatAdminSvc.exe.vir
QUIT::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Please open Notepad

Click Start , then Run
Type notepad.exe in the Run Box.
Copy and Paste everything from the Quote box into Notepad:

@echo off
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_WatAdminSvc.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_PSINProt.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_PSINProc.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_PSINKNC.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_PSINFile.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_PSINAflt.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_Gun.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_dump_wmimmc.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_amdkmdap.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_amdkmdag.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Service_AMD External Events Utility.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROT.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROC.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINKNC.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINFILE.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINAFLT.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_GUN.reg.dat"
Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_AMDKMDAG.reg.dat"
Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes. Once saved, the icon to click should look like this on your desktop:[external image: Posted Image]
Double click fix.bat.

Once complete… please reboot your system and let me know how things seem now.

BlendingLight

Post #11March 12, 2011, 2:13 AM UTC last edited March 12, 2011, 2:32 AM UTC

Hi TomK,

Tomk

Post #12March 12, 2011, 2:33 AM UTC

Hi SkeW.

BlendingLight

Post #13March 12, 2011, 2:50 AM UTC

Hi Tomk, Sorry about that. Right now ComboFix hangs after it says (paraphrasing) "It usually takes 10 minutes to do a scan. Infected machines can easily double in time." I waited for 10 minutes or so and none of the stages appeared. It just stood there. After that, I closed it and rebooted and the system is a little more unstable. What should I do now?

Tomk

Post #14March 12, 2011, 4:17 AM UTC

The script shouldn't run a scan so you won't see all the stages… it just restores the info and provide a log saying it did in fact restore them. Let's try again. Please drag your copy of ComboFix to the recycle bin. Then download a fresh copy per earlier instructions. Then make CFScript.txt again and drag into the icon again.

BlendingLight

Post #15March 12, 2011, 2:11 PM UTC last edited March 12, 2011, 2:44 PM UTC

Hi Tomk, I did what you requested. I downloaded a fresh copy of ComboFix and ran the script by dragging the script onto ComboFix. The same thing happened as last time. The ComboFix window just hangs and does not produce a log either. I left ComboFix with this script on overnight and still nothing has changed. However, this morning I did go to my folders to check if the items are restored. For ComboFix, it has restored all the files except C:\Qoobox\Quarantine\C\Windows\System32\drivers\atikmdag.sys.vir. As for the BAT file, everything was recovered normally except these files: Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROT.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINPROC.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINKNC.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINFILE.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_PSINAFLT.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_GUN.reg.dat" Regedit "C:\Qoobox\Quarantine\Registry_backups\Legacy_AMDKMDAG.reg.dat" It says that they are in use and cannot be fully restored. The behavior of the system has not changed. I will try to reinstall the graphic drivers and see what happens. EDIT: OK, I reinstalled the ATI Graphics Drivers and everything is working properly now

. EDIT #2: Tomk, for folders like C:\Program Data\Application Data, are they meant to be inaccessible? I can't access it as an administrator right now and I'm curious if the inaccessibility may be due to a virus.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Administrator Privileges Locked!

✨ Ask AI

Ask AI