MyCleanPC Registry Cleaner & no web access

ComboFix 11-03-23.04 - lorraine 03/28/2011 16:01:56.2.2 - x86 Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.2038.952 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\lorraine\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\lorraine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MyCleanPC Registry Scanner.lnk" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Winferno c:\program files\Winferno\PC Confidential\DeleteIndex.exe c:\program files\Winferno\PC Confidential\Graphics\HandPoint.ico c:\program files\Winferno\PC Confidential\PCConfidential.chm c:\program files\Winferno\PC Confidential\PCConfidential.exe c:\program files\Winferno\PC Confidential\PCCST.exe c:\program files\Winferno\PC Confidential\unins000.dat c:\program files\Winferno\PC Confidential\unins000.exe c:\program files\Winferno\PC Confidential\WinCMR.dll c:\program files\Winferno\PC Confidential\WinfernoSoftware.url c:\program files\Winferno\RegistryPowerCleaner\CHives.dll c:\program files\Winferno\RegistryPowerCleaner\regpowerclean.chm c:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe c:\program files\Winferno\RegistryPowerCleaner\RPCL.DLL c:\program files\Winferno\RegistryPowerCleaner\RPCReminder.exe c:\program files\Winferno\RegistryPowerCleaner\SysRst.exe c:\program files\Winferno\RegistryPowerCleaner\unins000.dat c:\program files\Winferno\RegistryPowerCleaner\unins000.exe c:\program files\Winferno\RegistryPowerCleaner\WinCMR.dll . c:\windows\System32\autochk.exe . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-28 ))))))))))))))))))))))))))))))) . . 2011-03-28 20:18 . 2011-03-28 20:22 ——– d—–w- c:\users\lorraine\AppData\Local\temp 2011-03-28 20:18 . 2011-03-28 20:18 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-03-28 19:33 . 2011-03-28 19:33 10240 —-a-w- c:\windows\system32\drivers\ujm2ndi3.sys 2011-03-28 19:33 . 2011-03-28 19:33 7168 —-a-w- c:\windows\system32\drivers\utm2ndi3.sys 2011-03-28 19:33 . 2011-03-28 19:33 11264 —-a-w- c:\windows\system32\drivers\uzm2ndi3.sys 2011-03-27 14:45 . 2011-03-28 19:38 ——– d—–w- c:\programdata\Kaspersky Lab 2011-03-27 14:44 . 2009-10-22 17:54 37392 —-a-w- c:\windows\system32\drivers\85588442.sys 2011-03-27 14:44 . 2009-10-10 03:31 311312 —-a-w- c:\windows\system32\drivers\8558844.sys 2011-03-27 14:44 . 2009-09-25 21:59 128016 —-a-w- c:\windows\system32\drivers\85588441.sys 2011-03-27 07:21 . 2011-03-27 07:21 ——– d—–w- c:\program files\Windows Portable Devices 2011-03-27 07:04 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll 2011-03-27 07:04 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll 2011-03-27 07:04 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll 2011-03-27 07:02 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll 2011-03-27 07:02 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll 2011-03-27 07:02 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll 2011-03-26 16:33 . 2011-03-28 20:20 17408 —-a-w- c:\windows\system32\rpcnetp.dll 2011-03-26 16:32 . 2011-03-28 20:20 17408 —-a-w- c:\windows\system32\rpcnetp.exe 2011-03-26 16:29 . 2011-03-26 16:29 ——– d—–w- C:\_OTL 2011-03-26 15:56 . 2010-05-04 19:13 231424 —-a-w- c:\windows\system32\msshsq.dll 2011-03-25 22:08 . 2011-03-25 22:09 ——– d—–w- c:\windows\system32\ca-ES 2011-03-25 22:08 . 2011-03-25 22:08 ——– d—–w- c:\windows\system32\eu-ES 2011-03-25 22:08 . 2011-03-25 22:08 ——– d—–w- c:\windows\system32\vi-VN 2011-03-25 19:52 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-03-25 19:52 . 2011-03-25 19:52 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-03-25 19:52 . 2010-12-20 22:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-03-25 19:43 . 2011-03-15 04:05 6792528 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{46805E9E-0E8A-4E62-ADE0-12379849B872}\mpengine.dll 2011-03-25 19:24 . 2011-03-25 19:24 ——– d—–w- c:\program files\Trend Micro 2011-03-25 19:08 . 2011-03-25 19:08 ——– d—–w- c:\users\lorraine\AppData\Roaming\Malwarebytes 2011-03-25 19:08 . 2011-03-25 19:08 ——– d—–w- c:\programdata\Malwarebytes 2011-03-25 19:04 . 2011-03-25 19:08 ——– d—–w- c:\users\lorraine\AppData\Roaming\U3 2011-03-17 01:09 . 2011-03-17 01:09 ——– d—–w- c:\program files\ConduitEngine 2011-03-17 00:57 . 2010-12-29 18:28 322560 —-a-w- c:\windows\system32\sbe.dll 2011-03-17 00:57 . 2010-12-29 18:28 153088 —-a-w- c:\windows\system32\sbeio.dll 2011-03-17 00:57 . 2010-12-29 18:28 429056 —-a-w- c:\windows\system32\EncDec.dll 2011-03-17 00:57 . 2010-12-29 18:26 177664 —-a-w- c:\windows\system32\mpg2splt.ax 2011-03-17 00:57 . 2010-12-17 15:45 2067968 —-a-w- c:\windows\system32\mstscax.dll 2011-03-17 00:57 . 2010-12-17 13:54 677888 —-a-w- c:\windows\system32\mstsc.exe 2011-03-17 00:57 . 2009-04-11 06:28 63488 —-a-w- c:\windows\system32\tscupgrd.exe 2011-03-07 18:22 . 2011-03-07 18:33 ——– d—–w- c:\program files\Serpent of Isis - Your Journey Continues 2011-03-01 18:59 . 2011-03-01 18:59 ——– d—–w- c:\users\lorraine\AppData\Roaming\Fugazo 2011-02-28 01:38 . 2011-02-28 01:38 ——– d—–w- c:\programdata\SugarGames 2011-02-28 00:56 . 2011-02-28 00:56 ——– d—–w- c:\program files\Wedding Salon 2011-02-28 00:34 . 2011-02-28 00:36 ——– d—–w- c:\program files\Fiction Fixers - Adventures in Wonderland 2011-02-27 23:42 . 2011-02-27 23:43 ——– d—–w- c:\program files\The Otherside - Realm of Eons 2011-02-27 23:23 . 2011-02-27 23:23 ——– d—–w- c:\users\lorraine\AppData\Roaming\RegistryKeys 2011-02-27 23:23 . 2011-02-27 23:23 ——– d—–w- c:\users\lorraine\AppData\Roaming\PC Speed Maximizer 2011-02-27 23:13 . 2011-02-28 01:36 ——– d—–w- c:\programdata\Farm Frenzy 2011-02-27 23:07 . 2011-02-27 23:07 ——– d—–w- c:\program files\Farm Frenzy 2011-02-27 23:07 . 2011-02-27 23:07 ——– d—–w- c:\program files\Common Files\Farm Frenzy 2011-02-27 23:03 . 2011-02-27 23:03 ——– d—–w- c:\program files\PC Speed Maximizer 2011-02-27 23:03 . 2011-02-27 23:03 ——– d—–w- c:\program files\Surf Canyon 2011-02-27 23:02 . 2006-07-24 13:56 212240 —-a-w- c:\windows\system32\Richtx32.ocx 2011-02-26 21:39 . 2011-02-26 21:39 ——– d—–w- c:\users\lorraine\AppData\Roaming\Dekovir . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-20 20:36 . 2009-04-16 18:46 44544 —-a-w- c:\windows\system32\agremove.exe 2011-02-02 22:11 . 2009-10-02 16:59 222080 ——w- c:\windows\system32\MpSigStub.exe 2011-01-12 21:32 . 2011-01-12 21:32 18944 —-a-r- c:\users\lorraine\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe 2011-01-08 08:47 . 2011-02-09 21:05 34304 —-a-w- c:\windows\system32\atmlib.dll 2011-01-08 06:28 . 2011-02-09 21:05 292352 —-a-w- c:\windows\system32\atmfd.dll 2010-12-31 13:57 . 2011-02-09 21:06 2039808 —-a-w- c:\windows\system32\win32k.sys 2009-12-08 11:59 . 2009-12-08 11:59 119808 —-a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1] @="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}" [HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}] 2007-04-20 19:40 118784 —-a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2007-12-29 430080] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-10-26 413696] "FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2008-01-24 671744] "UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2007-06-06 94208] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-30 1029416] "PCMAgent"="c:\program files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360] "CLMLServer"="c:\program files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-02-14 184320] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-30 583048] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-12 29984] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-12 46368] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-05-29 1085440] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976] . c:\users\lorraine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ setup_9.0.0.722_27.03.2011_16-18.lnk - c:\users\lorraine\Desktop\Virus Removal Tool\setup_9.0.0.722_27.03.2011_16-18\startup.exe [2011-3-27 72208] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1c9b3bf57e625e0;Google Update Service (gupdate1c9b3bf57e625e0);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-02 133104] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-08 101936] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192] R4 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2007-12-25 40960] R4 GamesAppService;GamesAppService;c:\program files\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R4 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2010-09-02 176408] S0 85588442;85588442 Boot Guard Driver;c:\windows\system32\DRIVERS\85588442.sys [2009-10-22 37392] S0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\Drivers\AlfaFF.sys [2008-02-03 43440] S0 rpcnetp;rpcnetp; [x] S1 85588441;85588441;c:\windows\system32\DRIVERS\85588441.sys [2009-09-25 128016] S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20090415.001\IDSvix86.sys [2009-02-09 272432] S1 NEOFLTR_650_15991;Juniper Networks TDI Filter Driver (NEOFLTR_650_15991);c:\windows\system32\Drivers\NEOFLTR_650_15991.SYS [2010-06-08 85360] S2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [2007-10-15 49152] S3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDART.sys [2008-02-01 187904] S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-01-15 48472] S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-10 8192] . . — Other Services/Drivers In Memory — . *NewlyCreated* - COMHOST . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr getPlusHelper REG_MULTI_SZ getPlusHelper LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-03-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-02 18:17] . 2011-03-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-02 18:17] . 2011-03-27 c:\windows\Tasks\Norton Security Scan for lorraine.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 12:18] . 2011-03-25 c:\windows\Tasks\User_Feed_Synchronization-{BC8E2FBD-449D-4311-ABB5-365FF961D66A}.job - c:\windows\system32\msfeedssync.exe [2011-02-09 04:47] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.toshibadirect.com/dpdstart mStart Page = hxxp://www.toshibadirect.com/dpdstart uSearchURL,(Default) = hxxp://www.google.com/keyword/%s . - - - - ORPHANS REMOVED - - - - . AddRemove-PCConfidential_is1 - c:\program files\Winferno\PC Confidential\unins000.exe AddRemove-RegPowerClean_is1 - c:\program files\Winferno\RegistryPowerCleaner\unins000.exe . . . ************************************************************************** scanning hidden processes … . scanning hidden autostart entries … . HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????4??H????`????????????????? . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1189411615-3114965565-1695826520-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:4f,15,e2,06,87,e4,aa,30,55,4e,48,39,ee,b9,6b,48,ae,42,3e,f9,75,8c,a9, f5,43,43,d8,4e,f5,dc,e6,84,2d,30,12,48,85,7e,c4,63,72,3c,31,f4,55,f0,32,b9,\ "??"=hex:56,62,6a,3c,b5,72,ef,ca,f6,2f,7c,17,6e,e5,39,7f . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'Explorer.exe'(3280) c:\program files\TrueSuite Access Manager\IconOvrly.dll . ———————— Other Running Processes ———————— . c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\windows\system32\WLANExt.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\System32\rpcnetp.exe c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe c:\windows\system32\TODDSrv.exe c:\program files\Toshiba\Power Saver\TosCoSrv.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\Windows Media Player\wmplayer.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Completion time: 2011-03-28 16:30:07 - machine was rebooted ComboFix-quarantined-files.txt 2011-03-28 20:29 ComboFix2.txt 2011-03-26 18:31 . Pre-Run: 194,019,688,448 bytes free Post-Run: 194,001,448,960 bytes free . - - End Of File - - 5CCBFB7A87E4F3B1E76D2790EEC67EDD