Spyware / Malware / Virus Removal

internet explorer crashing

22 min read

Looking for the outcome? Ask AI

helprequired Topic Starter

Post #1September 30, 2011, 8:06 PM UTC last edited October 5, 2011, 7:30 PM UTC

Edit by paws referred here by Ztruker in this topic:
http://forums.whatthetech.com/index.php?sh…p;p=751117&

Hi

I have been experiencing issues with my laptop receiving the following messages:

This applications failed to start because MFC80.DLL wasn't found and gdiplus.dll wasn't found. Reinstalling may fix the problem.

There are two main issues:

Sometimes it starts up ok but as soon as I used internet explorer it throws me out and won't work as it keeps closing the window each time.

The other is that I can log on with my password but then just receive a blank screen.

I was using IE version 8 with Vista SP2 but have since installed IE 9 to see if that would work but the same issue occurs. The MCF80.DLL doesn't seem to be appearing at the moment.

i have run the HJT programme but it didn't let me keep a copy of the report.

I welcome your suggestions.

Tomk

Post #2October 6, 2011, 3:40 AM UTC

Hi helprequired,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Let's try to get a log with a different program.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

helprequired

Post #3October 7, 2011, 9:00 PM UTC

Hi Apologies for the delay, I couldn't access the laptop but managed to get it working eventually. I hope this helps. . DDS (Ver_2011-06-23.01) - NTFSx86 NETWORK Internet Explorer: 9.0.8112.16421 Run by [removed] at 21:29:48 on 2011-10-07 Microsoft� Windows Vista� Home Premium 6.0.6002.2.1252.44.1033.18.1013.88 [GMT 1:00] . AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE} SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\Explorer.EXE C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\STOPzilla!\STOPzilla.exe c:\program files\windows defender\MpCmdRun.exe . ============== Pseudo HJT Report =============== . uSearch Bar = Preserve uWindow Title = Internet Explorer provided by Dell uStart Page = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=4070928 uDefault_Page_URL = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=4070928 uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: STOPzilla Browser Helper Object: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files\stopzilla!\SZIEBHO.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [] mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" mRun: [dscactivate] c:\dell\dsca.exe 3 mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SigmatelSysTrayApp] sttray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digima~1.lnk - c:\program files\samsung\digimax viewer 2.1\STImgBrowser.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{7f0c4457-8e64-491b-8d7b-991504365d1e}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL LSP: c:\windows\system32\wpclsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.0.1 TCP: Interfaces\{659762E6-14C2-4FD3-80D4-077FD5167C7D} : DhcpNameServer = 192.168.0.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll Notify: klogon - c:\windows\system32\klogon.dll AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll c:\progra~1\google\google~1\GOEC62~1.DLL SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\toni\appdata\roaming\mozilla\firefox\profiles\syawc8w8.default\ FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\entriq\mediasphere\3.8.2.9\npEntriqMediaMozillaPlugin.dll FF - plugin: c:\program files\entriq\mediasphere\3.8.2.9\npEntriqVersionCheckMozillaPlugin.dll FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.50917.0\npctrlui.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll . ============= SERVICES / DRIVERS =============== . R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [2009-12-7 61328] R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [2010-5-12 59280] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2008-7-9 20496] S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-7 61328] S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-20 21504] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-27 136176] S3 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 208616] S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-9-28 30192] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-27 136176] S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-10-07 20:03:14 56200 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{89423389-10d1-4bf3-acea-4c5e39574a64}\offreg.dll 2011-10-07 20:03:09 7269712 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{89423389-10d1-4bf3-acea-4c5e39574a64}\mpengine.dll 2011-10-06 17:57:44 2205220 —-a-w- c:\windows\system32\lonco3264.dat 2011-10-06 17:57:44 2205220 —-a-w- c:\windows\system32\ebxcotohum.dat 2011-10-06 17:57:44 2205220 —-a-w- c:\windows\system32\32filasomnj.dat 2011-10-06 17:57:43 2205220 —-a-w- c:\windows\system32\asoetuhumfo.dat 2011-10-06 17:57:43 2094080 —-a-w- c:\windows\system32\simtosimni.dat 2011-10-06 17:57:43 2094080 —-a-w- c:\windows\system32\asoebxjehum.dat 2011-09-30 18:48:21 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2011-09-30 18:00:56 ——– d—–w- c:\users\toni\appdata\local\ElevatedDiagnostics 2011-09-30 16:08:23 388096 —-a-r- c:\users\toni\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-09-30 16:08:07 ——– d—–w- c:\program files\Trend Micro 2011-09-29 22:07:53 4006185 —-a-w- c:\windows\system32\crasubesolon.dat 2011-09-29 21:47:31 2205220 —-a-w- c:\windows\system32\winmnjaimwh.dat 2011-09-29 21:47:31 2205220 —-a-w- c:\windows\system32\wihumarjsim.dat 2011-09-29 21:47:31 2205220 —-a-w- c:\windows\system32\quior64ni.dat 2011-09-29 21:47:31 2205220 —-a-w- c:\windows\system32\quicomaimcra.dat 2011-09-29 21:47:31 2159520 —-a-w- c:\windows\system32\filcomlopfo.dat 2011-09-29 21:42:04 3195143 —-a-w- c:\windows\system32\humdllrimand.dat 2011-09-29 21:42:03 3195143 —-a-w- c:\windows\system32\loqweasofo.dat 2011-09-29 21:42:02 3195143 —-a-w- c:\windows\system32\lorimcoor.dat 2011-09-29 21:18:53 2205220 —-a-w- c:\windows\system32\asowinlopfo.dat 2011-09-29 21:18:52 2205220 —-a-w- c:\windows\system32\whandjedo.dat 2011-09-29 21:18:52 2205220 —-a-w- c:\windows\system32\lopwinaimcom.dat 2011-09-29 21:18:52 2205220 —-a-w- c:\windows\system32\aliqwejmlo.dat 2011-09-29 21:18:51 2094080 —-a-w- c:\windows\system32\cowi6432.dat 2011-09-29 21:14:02 4703787 —-a-w- c:\windows\system32\dllebxdllebx.dat 2011-09-25 19:15:25 2205220 —-a-w- c:\windows\system32\whetualiwi.dat 2011-09-25 19:15:25 2205220 —-a-w- c:\windows\system32\mnjebx32lon.dat 2011-09-25 19:15:25 2205220 —-a-w- c:\windows\system32\lopexetolop.dat 2011-09-25 19:15:24 2205220 —-a-w- c:\windows\system32\nidoetulo.dat 2011-09-25 19:15:24 2205220 —-a-w- c:\windows\system32\esoexecomvir.dat 2011-09-25 17:54:22 ——– d—–w- c:\users\toni\appdata\local\Mozilla 2011-09-25 17:52:56 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-09-25 17:48:00 979456 —-a-w- c:\windows\system32\MFH264Dec.dll 2011-09-25 17:48:00 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll 2011-09-25 17:44:30 369664 —-a-w- c:\windows\system32\WMPhoto.dll 2011-09-25 17:44:30 195584 —-a-w- c:\windows\system32\dxdiagn.dll 2011-09-25 17:44:29 252928 —-a-w- c:\windows\system32\dxdiag.exe 2011-09-25 17:44:27 519680 —-a-w- c:\windows\system32\d3d11.dll 2011-09-25 17:44:25 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-09-25 17:44:24 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-09-25 17:44:23 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-09-16 17:47:36 ——– d—–w- c:\users\toni\hen do . ==================== Find3M ==================== . 2011-09-25 17:52:55 86528 —-a-w- c:\windows\system32\iesysprep.dll 2011-09-25 17:47:59 302592 —-a-w- c:\windows\system32\mfmp4src.dll 2011-09-25 17:44:45 4096 —-a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui 2011-08-14 17:54:27 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-07-19 10:02:32 546256 —-a-r- c:\windows\system32\SZComp5.dll 2011-07-19 10:02:32 22992 —-a-r- c:\windows\system32\SZIO5.dll 2011-07-19 10:02:32 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll 2011-07-19 10:02:30 99792 —-a-r- c:\windows\system32\IS3Svc5.dll 2011-07-19 10:02:30 99792 —-a-r- c:\windows\system32\IS3Inet5.dll 2011-07-19 10:02:30 67024 —-a-r- c:\windows\system32\IS3Hks5.dll 2011-07-19 10:02:30 456144 —-a-r- c:\windows\system32\SZBase5.dll 2011-07-19 10:02:30 398800 —-a-r- c:\windows\system32\IS3DBA5.dll 2011-07-19 10:02:30 28624 —-a-r- c:\windows\system32\IS3XDat5.dll 2011-07-19 10:02:28 738768 —-a-r- c:\windows\system32\IS3Base5.dll 2011-07-19 10:02:28 390608 —-a-r- c:\windows\system32\IS3UI5.dll 2011-07-19 10:02:28 230864 —-a-r- c:\windows\system32\IS3Win325.dll . ============= FINISH: 21:35:09.47 =============== Thanks.

Attachments:

📎attachpostifasked071011.txt

helprequired

Post #4October 7, 2011, 9:02 PM UTC

I forgot to say, the only way I seem to be able to get it working is by pressing F8 on startup and using the prompt that says repair and networking or something like that.

Tomk

Post #5October 7, 2011, 9:11 PM UTC

helprequired,

If you can't get this program to run in "regular" mode, go ahead and run it from safe mode.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

helprequired

Post #6October 8, 2011, 5:46 PM UTC

Hi Combofix report for your comments. ComboFix 11-10-08.01 - Toni 08/10/2011 17:34:35.1.2 - x86 NETWORK Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.373 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE} FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5} SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13} SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\niandquico.dat c:\users\Patch\Favorites\_favdata.dat c:\users\patch2\AppData\Roaming\Adobe\plugs c:\users\patch2\AppData\Roaming\Adobe\plugs\mmc44.exe c:\users\patch2\AppData\Roaming\Adobe\shed c:\users\patch2\AppData\Roaming\Adobe\shed\thr1.chm c:\users\patch2\Desktop\Malware Protection.lnk c:\users\Toni\g2mdlhlpx.exe c:\users\Toni\ParentalControlsIAC.exe c:\windows\system32\comct332.ocx . . ((((((((((((((((((((((((( Files Created from 2011-09-08 to 2011-10-08 ))))))))))))))))))))))))))))))) . . 2011-10-08 16:59 . 2011-10-08 16:59 ——– d—–w- c:\users\patch2\AppData\Local\temp 2011-10-08 16:58 . 2011-10-08 16:58 ——– d—–w- c:\users\Patch\AppData\Local\temp 2011-10-08 16:56 . 2011-10-08 16:56 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-10-08 15:33 . 2011-10-08 15:33 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\offreg.dll 2011-10-07 20:03 . 2011-09-12 23:14 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll 2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\lonco3264.dat 2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\ebxcotohum.dat 2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\32filasomnj.dat 2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\asoetuhumfo.dat 2011-10-06 17:57 . 2011-10-06 17:57 2094080 —-a-w- c:\windows\system32\simtosimni.dat 2011-10-06 17:57 . 2011-10-06 17:57 2094080 —-a-w- c:\windows\system32\asoebxjehum.dat 2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics 2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro 2011-09-29 22:07 . 2011-09-29 22:07 4006185 —-a-w- c:\windows\system32\crasubesolon.dat 2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\winmnjaimwh.dat 2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\wihumarjsim.dat 2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\quior64ni.dat 2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\quicomaimcra.dat 2011-09-29 21:47 . 2011-09-29 21:47 2159520 —-a-w- c:\windows\system32\filcomlopfo.dat 2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\humdllrimand.dat 2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\loqweasofo.dat 2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\lorimcoor.dat 2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\asowinlopfo.dat 2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\whandjedo.dat 2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\lopwinaimcom.dat 2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\aliqwejmlo.dat 2011-09-29 21:18 . 2011-09-29 21:18 2094080 —-a-w- c:\windows\system32\cowi6432.dat 2011-09-29 21:14 . 2011-09-29 21:14 4703787 —-a-w- c:\windows\system32\dllebxdllebx.dat 2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\whetualiwi.dat 2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\mnjebx32lon.dat 2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\lopexetolop.dat 2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\nidoetulo.dat 2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\esoexecomvir.dat 2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla 2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll 2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll 2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll 2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll 2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe 2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll 2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui 2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin 2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll 2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll 2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll 2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll 2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll 2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll 2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll 2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll 2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll 2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll 2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll 2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll 2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184] "dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384] "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688] QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\MZVKBD3.DLL,c:\progra~1\KASPER~1\KASPER~1\ADIALHK.DLL,c:\progra~1\KASPER~1\KASPER~1\KLOEHK.DLL c:\progra~1\GOOGLE\GOOGLE~1\GOEC62~1.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 . R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328] R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30] . 2011-10-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30] . . ——- Supplementary Scan ——- . uStart Page = www.bbc.co.uk uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s LSP: c:\windows\system32\wpclsp.dll TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\ . . ************************************************************************** scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2011-10-08 18:09:47 ComboFix-quarantined-files.txt 2011-10-08 17:09 . Pre-Run: 4,587,819,008 bytes free Post-Run: 8,739,090,432 bytes free . - - End Of File - - A77CB289901303382A462601A7AF680B Thanks.

Attachments:

📎combofixlog081011.txt

Tomk

Post #7October 10, 2011, 3:56 AM UTC last edited October 10, 2011, 3:57 AM UTC

helprequired,

Open notepad and copy/paste the text in the quotebox below into it:

http://forums.whatthetech.com/index.php?sh…mp;#entry753127

Collect::
c:\windows\system32\lonco3264.dat
c:\windows\system32\ebxcotohum.dat
c:\windows\system32\32filasomnj.dat
c:\windows\system32\asoetuhumfo.dat
c:\windows\system32\simtosimni.dat
c:\windows\system32\asoebxjehum.dat
c:\windows\system32\crasubesolon.dat
c:\windows\system32\winmnjaimwh.dat
c:\windows\system32\wihumarjsim.dat
c:\windows\system32\quior64ni.dat
c:\windows\system32\quicomaimcra.dat
c:\windows\system32\filcomlopfo.dat
c:\windows\system32\humdllrimand.dat
c:\windows\system32\loqweasofo.dat
c:\windows\system32\lorimcoor.dat
c:\windows\system32\asowinlopfo.dat
c:\windows\system32\whandjedo.dat
c:\windows\system32\lopwinaimcom.dat
c:\windows\system32\aliqwejmlo.dat
c:\windows\system32\cowi6432.dat
c:\windows\system32\dllebxdllebx.dat
c:\windows\system32\whetualiwi.dat
c:\windows\system32\mnjebx32lon.dat
c:\windows\system32\lopexetolop.dat
c:\windows\system32\nidoetulo.dat
c:\windows\system32\esoexecomvir.dat

Save this as CFScript.txt

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

helprequired

Post #8October 10, 2011, 8:44 PM UTC

Hi There

Latest report posted and attached.

ComboFix 11-10-08.01 - Toni 10/10/2011 20:50:32.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.407 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Toni\Desktop\CFScript..txt
AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5}
SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-09-10 to 2011-10-10 )))))))))))))))))))))))))))))))
.
.
2011-10-10 20:18 . 2011-10-10 20:19 ——– d—–w- c:\users\Toni\AppData\Local\temp
2011-10-10 20:18 . 2011-10-10 20:18 ——– d—–w- c:\users\patch2\AppData\Local\temp
2011-10-10 20:18 . 2011-10-10 20:18 ——– d—–w- c:\users\Patch\AppData\Local\temp
2011-10-10 20:18 . 2011-10-10 20:18 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-10 19:32 . 2011-10-10 19:32 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\offreg.dll
2011-10-07 20:03 . 2011-09-12 23:14 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll
2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\lonco3264.dat
2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\ebxcotohum.dat
2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\32filasomnj.dat
2011-10-06 17:57 . 2011-10-06 17:57 2205220 —-a-w- c:\windows\system32\asoetuhumfo.dat
2011-10-06 17:57 . 2011-10-06 17:57 2094080 —-a-w- c:\windows\system32\simtosimni.dat
2011-10-06 17:57 . 2011-10-06 17:57 2094080 —-a-w- c:\windows\system32\asoebxjehum.dat
2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics
2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro
2011-09-29 22:07 . 2011-09-29 22:07 4006185 —-a-w- c:\windows\system32\crasubesolon.dat
2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\winmnjaimwh.dat
2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\wihumarjsim.dat
2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\quior64ni.dat
2011-09-29 21:47 . 2011-09-29 21:47 2205220 —-a-w- c:\windows\system32\quicomaimcra.dat
2011-09-29 21:47 . 2011-09-29 21:47 2159520 —-a-w- c:\windows\system32\filcomlopfo.dat
2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\humdllrimand.dat
2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\loqweasofo.dat
2011-09-29 21:42 . 2011-09-29 21:42 3195143 —-a-w- c:\windows\system32\lorimcoor.dat
2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\asowinlopfo.dat
2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\whandjedo.dat
2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\lopwinaimcom.dat
2011-09-29 21:18 . 2011-09-29 21:18 2205220 —-a-w- c:\windows\system32\aliqwejmlo.dat
2011-09-29 21:18 . 2011-09-29 21:18 2094080 —-a-w- c:\windows\system32\cowi6432.dat
2011-09-29 21:14 . 2011-09-29 21:14 4703787 —-a-w- c:\windows\system32\dllebxdllebx.dat
2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\whetualiwi.dat
2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\mnjebx32lon.dat
2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\lopexetolop.dat
2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\nidoetulo.dat
2011-09-25 19:15 . 2011-09-25 19:15 2205220 —-a-w- c:\windows\system32\esoexecomvir.dat
2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla
2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui
2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin
2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll
2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll
2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll
2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll
2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll
2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll
2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll
2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll
2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll
2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\MZVKBD3.DLL,c:\progra~1\KASPER~1\KASPER~1\ADIALHK.DLL,c:\progra~1\KASPER~1\KASPER~1\KLOEHK.DLL c:\progra~1\GOOGLE\GOOGLE~1\GOEC62~1.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328]
S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
2011-10-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.bbc.co.uk
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 21:19
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-10-10 21:27:18
ComboFix-quarantined-files.txt 2011-10-10 20:27
ComboFix2.txt 2011-10-08 17:09
.
Pre-Run: 8,624,791,552 bytes free
Post-Run: 8,521,535,488 bytes free
.
- - End Of File - - 4AE8BE37D1E5FE473D52AC9C40629EA4

I received alert saying that some of Stopzilla was still running but as far as I could see everything was deactivated. I didn't see I had much choice but to run so took the risk.
Thanks.

Attachments:

📎CFlog101011.txt

Tomk

Post #9October 11, 2011, 12:14 AM UTC

helprequired, It doesn't appear that our script worked… nor do I see that the files got submitted. Did you get notice that the files were submitted?

helprequired

Post #10October 11, 2011, 8:23 PM UTC

Hi

I must have done something wrong originally. I have run it again. Log posted below and attached.

Thanks.

ComboFix 11-10-08.01 - Toni 11/10/2011 20:19:37.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.514 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Toni\Desktop\CFScript.txt.txt
AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5}
SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
SP: STOPzilla Anti-Spyware *Enabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\system32\32filasomnj.dat
file zipped: c:\windows\system32\aliqwejmlo.dat
file zipped: c:\windows\system32\asoebxjehum.dat
file zipped: c:\windows\system32\asoetuhumfo.dat
file zipped: c:\windows\system32\asowinlopfo.dat
file zipped: c:\windows\system32\cowi6432.dat
file zipped: c:\windows\system32\crasubesolon.dat
file zipped: c:\windows\system32\dllebxdllebx.dat
file zipped: c:\windows\system32\ebxcotohum.dat
file zipped: c:\windows\system32\esoexecomvir.dat
file zipped: c:\windows\system32\filcomlopfo.dat
file zipped: c:\windows\system32\humdllrimand.dat
file zipped: c:\windows\system32\lonco3264.dat
file zipped: c:\windows\system32\lopexetolop.dat
file zipped: c:\windows\system32\lopwinaimcom.dat
file zipped: c:\windows\system32\loqweasofo.dat
file zipped: c:\windows\system32\lorimcoor.dat
file zipped: c:\windows\system32\mnjebx32lon.dat
file zipped: c:\windows\system32\nidoetulo.dat
file zipped: c:\windows\system32\quicomaimcra.dat
file zipped: c:\windows\system32\quior64ni.dat
file zipped: c:\windows\system32\simtosimni.dat
file zipped: c:\windows\system32\whandjedo.dat
file zipped: c:\windows\system32\whetualiwi.dat
file zipped: c:\windows\system32\wihumarjsim.dat
file zipped: c:\windows\system32\winmnjaimwh.dat
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\32filasomnj.dat
c:\windows\system32\aliqwejmlo.dat
c:\windows\system32\asoebxjehum.dat
c:\windows\system32\asoetuhumfo.dat
c:\windows\system32\asowinlopfo.dat
c:\windows\system32\cowi6432.dat
c:\windows\system32\crasubesolon.dat
c:\windows\system32\dllebxdllebx.dat
c:\windows\system32\ebxcotohum.dat
c:\windows\system32\esoexecomvir.dat
c:\windows\system32\filcomlopfo.dat
c:\windows\system32\humdllrimand.dat
c:\windows\system32\lonco3264.dat
c:\windows\system32\lopexetolop.dat
c:\windows\system32\lopwinaimcom.dat
c:\windows\system32\loqweasofo.dat
c:\windows\system32\lorimcoor.dat
c:\windows\system32\mnjebx32lon.dat
c:\windows\system32\nidoetulo.dat
c:\windows\system32\quicomaimcra.dat
c:\windows\system32\quior64ni.dat
c:\windows\system32\simtosimni.dat
c:\windows\system32\whandjedo.dat
c:\windows\system32\whetualiwi.dat
c:\windows\system32\wihumarjsim.dat
c:\windows\system32\winmnjaimwh.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-11 to 2011-10-11 )))))))))))))))))))))))))))))))
.
.
2011-10-11 19:36 . 2011-10-11 19:43 ——– d—–w- c:\users\Toni\AppData\Local\temp
2011-10-11 19:36 . 2011-10-11 19:36 ——– d—–w- c:\users\patch2\AppData\Local\temp
2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics
2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro
2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla
2011-09-25 17:52 . 2011-09-25 17:52 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-25 17:47 . 2011-09-25 17:47 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 797184 —-a-w- c:\windows\system32\FntCache.dll
2011-09-25 17:47 . 2011-09-25 17:47 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-09-25 17:47 . 2011-09-25 17:47 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-09-25 17:47 . 2011-09-25 17:47 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-09-25 17:47 . 2011-09-25 17:47 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-09-25 17:47 . 2011-09-25 17:47 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-09-25 17:47 . 2011-09-25 17:47 478720 —-a-w- c:\windows\system32\dxgi.dll
2011-09-25 17:47 . 2011-09-25 17:47 638336 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-09-25 17:47 . 2011-09-25 17:47 37376 —-a-w- c:\windows\system32\cdd.dll
2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-25 17:53 . 2011-09-25 17:53 4202349 —h–w- c:\windows\system32\tem32arjje.dat
2011-09-25 17:53 . 2011-09-25 17:53 4134289 —h–w- c:\windows\system32\quihumwhrim.dat
2011-09-25 17:53 . 2011-09-25 17:53 3870896 —h–w- c:\windows\system32\nilo64dim.dat
2011-09-25 17:53 . 2011-09-25 17:53 3678098 —h–w- c:\windows\system32\niqwelopvir.dat
2011-09-25 17:53 . 2011-09-25 17:53 3510736 —h–w- c:\windows\system32\tohumtolon.dat
2011-09-25 17:53 . 2011-09-25 17:53 3510736 —h–w- c:\windows\system32\toforimtem.dat
2011-09-25 17:53 . 2011-09-25 17:53 3510736 —h–w- c:\windows\system32\nihumtemsub.dat
2011-09-25 17:53 . 2011-09-25 17:53 3461143 —h–w- c:\windows\system32\loplovirto.dat
2011-09-25 17:53 . 2011-09-25 17:53 3433315 —h–w- c:\windows\system32\simarjvirdim.dat
2011-09-25 17:53 . 2011-09-25 17:53 3433315 —h–w- c:\windows\system32\qui32asoexe.dat
2011-09-25 17:53 . 2011-09-25 17:53 3433315 —h–w- c:\windows\system32\lopcraaimtem.dat
2011-09-25 17:53 . 2011-09-25 17:53 3382824 —h–w- c:\windows\system32\londoasolop.dat
2011-09-25 17:53 . 2011-09-25 17:53 3330722 —h–w- c:\windows\system32\qwelop32ni.dat
2011-09-25 17:53 . 2011-09-25 17:53 3231629 —h–w- c:\windows\system32\subandwi64.dat
2011-09-25 17:53 . 2011-09-25 17:53 3231629 —h–w- c:\windows\system32\loporandtem.dat
2011-09-25 17:53 . 2011-09-25 17:53 3178002 —h–w- c:\windows\system32\simexeqweqwe.dat
2011-09-25 17:53 . 2011-09-25 17:53 3178002 —h–w- c:\windows\system32\qwedotemcom.dat
2011-09-25 17:53 . 2011-09-25 17:53 3174320 —h–w- c:\windows\system32\wisub64and.dat
2011-09-25 17:53 . 2011-09-25 17:53 3174320 —h–w- c:\windows\system32\toqwequior.dat
2011-09-25 17:53 . 2011-09-25 17:53 3155965 —h–w- c:\windows\system32\quisimjeetu.dat
2011-09-25 17:53 . 2011-09-25 17:53 3122464 —h–w- c:\windows\system32\simdonitem.dat
2011-09-25 17:53 . 2011-09-25 17:53 3090186 —h–w- c:\windows\system32\whtemqweali.dat
2011-09-25 17:53 . 2011-09-25 17:53 3024062 —h–w- c:\windows\system32\mnjwinaimco.dat
2011-09-25 17:53 . 2011-09-25 17:53 2830392 —h–w- c:\windows\system32\mnjsimsimexe.dat
2011-09-25 17:53 . 2011-09-25 17:53 2830392 —h–w- c:\windows\system32\lopwhaimsub.dat
2011-09-25 17:53 . 2011-09-25 17:53 161792 —-a-w- c:\windows\system32\msls31.dll
2011-09-25 17:53 . 2011-09-25 17:53 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-25 17:52 . 2011-09-25 17:52 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-09-25 17:52 . 2011-09-25 17:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-09-25 17:52 . 2011-09-25 17:52 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-09-25 17:52 . 2011-09-25 17:52 23552 —-a-w- c:\windows\system32\licmgr10.dll
2011-09-25 17:52 . 2011-09-25 17:52 152064 —-a-w- c:\windows\system32\wextract.exe
2011-09-25 17:52 . 2011-09-25 17:52 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-09-25 17:52 . 2011-09-25 17:52 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-25 17:52 . 2011-09-25 17:52 11776 —-a-w- c:\windows\system32\mshta.exe
2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2011-09-25 17:47 . 2011-09-25 17:47 302592 —-a-w- c:\windows\system32\mfmp4src.dll
2011-09-25 17:47 . 2011-09-25 17:47 261632 —-a-w- c:\windows\system32\mfreadwrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 2873344 —-a-w- c:\windows\system32\mf.dll
2011-09-25 17:47 . 2011-09-25 17:47 98816 —-a-w- c:\windows\system32\mfps.dll
2011-09-25 17:47 . 2011-09-25 17:47 586240 —-a-w- c:\windows\system32\stobject.dll
2011-09-25 17:47 . 2011-09-25 17:47 209920 —-a-w- c:\windows\system32\mfplat.dll
2011-09-25 17:47 . 2011-09-25 17:47 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-09-25 17:47 . 2011-09-25 17:47 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2011-09-25 17:47 . 2011-09-25 17:47 258048 —-a-w- c:\windows\system32\winspool.drv
2011-09-25 17:47 . 2011-09-25 17:47 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-09-25 17:47 . 2011-09-25 17:47 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-09-25 17:47 . 2011-09-25 17:47 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-09-25 17:47 . 2011-09-25 17:47 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-09-25 17:47 . 2011-09-25 17:47 876032 —-a-w- c:\windows\system32\XpsPrint.dll
2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui
2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin
2011-09-12 23:14 . 2011-10-07 20:03 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll
2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll
2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll
2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll
2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll
2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll
2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll
2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll
2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll
2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll
2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 CFcatchme;CFcatchme;c:\users\Toni\AppData\Local\Temp\CFcatchme.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808]
S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328]
S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
2011-10-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.bbc.co.uk
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-11 20:42
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\iS3\Anti-Spyware\SZServer.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Kontiki\KService.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Common Files\iS3\Anti-Spyware\SZScanner.exe
c:\program files\STOPzilla!\STOPzilla.exe
c:\program files\Apple Software Update\SoftwareUpdate.exe
c:\program files\Apple Software Update\SoftwareUpdate.exe
c:\windows\system32\RacAgent.exe
.
**************************************************************************
.
Completion time: 2011-10-11 21:06:08 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-11 20:05
ComboFix2.txt 2011-10-10 20:27
ComboFix3.txt 2011-10-08 17:09
.
Pre-Run: 8,026,546,176 bytes free
Post-Run: 7,180,894,208 bytes free
.
- - End Of File - - 66E543B6097760F350736F54CEF12A88
Upload was successful

Attachments:

📎CFlog111011.txt

Tomk

Post #11October 11, 2011, 11:21 PM UTC

helprequired,

It worked that time. But…

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

Open notepad and copy/paste the text in the quotebox below into it:

http://forums.whatthetech.com/index.php?sh…mp;#entry753127

Collect::
c:\windows\system32\tem32arjje.dat
c:\windows\system32\quihumwhrim.dat
c:\windows\system32\nilo64dim.dat
c:\windows\system32\niqwelopvir.dat
c:\windows\system32\tohumtolon.dat
c:\windows\system32\toforimtem.dat
c:\windows\system32\nihumtemsub.dat
c:\windows\system32\loplovirto.dat
c:\windows\system32\simarjvirdim.dat
c:\windows\system32\qui32asoexe.dat
c:\windows\system32\lopcraaimtem.dat
c:\windows\system32\londoasolop.dat
c:\windows\system32\qwelop32ni.dat
c:\windows\system32\subandwi64.dat
c:\windows\system32\loporandtem.dat
c:\windows\system32\simexeqweqwe.dat
c:\windows\system32\qwedotemcom.dat
c:\windows\system32\wisub64and.dat
c:\windows\system32\toqwequior.dat
c:\windows\system32\quisimjeetu.dat
2c:\windows\system32\simdonitem.dat
c:\windows\system32\whtemqweali.dat
c:\windows\system32\mnjwinaimco.dat
c:\windows\system32\mnjsimsimexe.dat
c:\windows\system32\lopwhaimsub.dat

Ensure you are connected to the internet and click OK on the message box.

helprequired

Post #12October 13, 2011, 4:16 AM UTC

Hi

Report attached.

ComboFix 11-10-08.01 - Toni 12/10/2011 21:23:47.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.529 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Toni\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5}
SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\system32\londoasolop.dat
file zipped: c:\windows\system32\lopcraaimtem.dat
file zipped: c:\windows\system32\loplovirto.dat
file zipped: c:\windows\system32\loporandtem.dat
file zipped: c:\windows\system32\lopwhaimsub.dat
file zipped: c:\windows\system32\mnjsimsimexe.dat
file zipped: c:\windows\system32\mnjwinaimco.dat
file zipped: c:\windows\system32\nihumtemsub.dat
file zipped: c:\windows\system32\nilo64dim.dat
file zipped: c:\windows\system32\niqwelopvir.dat
file zipped: c:\windows\system32\qui32asoexe.dat
file zipped: c:\windows\system32\quihumwhrim.dat
file zipped: c:\windows\system32\quisimjeetu.dat
file zipped: c:\windows\system32\qwedotemcom.dat
file zipped: c:\windows\system32\qwelop32ni.dat
file zipped: c:\windows\system32\simarjvirdim.dat
file zipped: c:\windows\system32\simexeqweqwe.dat
file zipped: c:\windows\system32\subandwi64.dat
file zipped: c:\windows\system32\tem32arjje.dat
file zipped: c:\windows\system32\toforimtem.dat
file zipped: c:\windows\system32\tohumtolon.dat
file zipped: c:\windows\system32\toqwequior.dat
file zipped: c:\windows\system32\whtemqweali.dat
file zipped: c:\windows\system32\wisub64and.dat
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\londoasolop.dat
c:\windows\system32\lopcraaimtem.dat
c:\windows\system32\loplovirto.dat
c:\windows\system32\loporandtem.dat
c:\windows\system32\lopwhaimsub.dat
c:\windows\system32\mnjsimsimexe.dat
c:\windows\system32\mnjwinaimco.dat
c:\windows\system32\nihumtemsub.dat
c:\windows\system32\nilo64dim.dat
c:\windows\system32\niqwelopvir.dat
c:\windows\system32\qui32asoexe.dat
c:\windows\system32\quihumwhrim.dat
c:\windows\system32\quisimjeetu.dat
c:\windows\system32\qwedotemcom.dat
c:\windows\system32\qwelop32ni.dat
c:\windows\system32\simarjvirdim.dat
c:\windows\system32\simexeqweqwe.dat
c:\windows\system32\subandwi64.dat
c:\windows\system32\tem32arjje.dat
c:\windows\system32\toforimtem.dat
c:\windows\system32\tohumtolon.dat
c:\windows\system32\toqwequior.dat
c:\windows\system32\whtemqweali.dat
c:\windows\system32\wisub64and.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-12 to 2011-10-12 )))))))))))))))))))))))))))))))
.
.
2011-10-12 20:40 . 2011-10-12 20:46 ——– d—–w- c:\users\Toni\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\patch2\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\Patch\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics
2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro
2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla
2011-09-25 17:52 . 2011-09-25 17:52 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-25 17:47 . 2011-09-25 17:47 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 797184 —-a-w- c:\windows\system32\FntCache.dll
2011-09-25 17:47 . 2011-09-25 17:47 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-09-25 17:47 . 2011-09-25 17:47 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-09-25 17:47 . 2011-09-25 17:47 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-09-25 17:47 . 2011-09-25 17:47 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-09-25 17:47 . 2011-09-25 17:47 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-09-25 17:47 . 2011-09-25 17:47 478720 —-a-w- c:\windows\system32\dxgi.dll
2011-09-25 17:47 . 2011-09-25 17:47 638336 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-09-25 17:47 . 2011-09-25 17:47 37376 —-a-w- c:\windows\system32\cdd.dll
2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-12 20:41 . 2011-10-12 20:41 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\offreg.dll
2011-09-25 17:53 . 2011-09-25 17:53 3122464 —h–w- c:\windows\system32\simdonitem.dat
2011-09-25 17:53 . 2011-09-25 17:53 161792 —-a-w- c:\windows\system32\msls31.dll
2011-09-25 17:53 . 2011-09-25 17:53 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-25 17:52 . 2011-09-25 17:52 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-09-25 17:52 . 2011-09-25 17:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-09-25 17:52 . 2011-09-25 17:52 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-09-25 17:52 . 2011-09-25 17:52 152064 —-a-w- c:\windows\system32\wextract.exe
2011-09-25 17:52 . 2011-09-25 17:52 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-09-25 17:52 . 2011-09-25 17:52 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-25 17:52 . 2011-09-25 17:52 11776 —-a-w- c:\windows\system32\mshta.exe
2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2011-09-25 17:47 . 2011-09-25 17:47 302592 —-a-w- c:\windows\system32\mfmp4src.dll
2011-09-25 17:47 . 2011-09-25 17:47 261632 —-a-w- c:\windows\system32\mfreadwrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 2873344 —-a-w- c:\windows\system32\mf.dll
2011-09-25 17:47 . 2011-09-25 17:47 98816 —-a-w- c:\windows\system32\mfps.dll
2011-09-25 17:47 . 2011-09-25 17:47 586240 —-a-w- c:\windows\system32\stobject.dll
2011-09-25 17:47 . 2011-09-25 17:47 209920 —-a-w- c:\windows\system32\mfplat.dll
2011-09-25 17:47 . 2011-09-25 17:47 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-09-25 17:47 . 2011-09-25 17:47 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2011-09-25 17:47 . 2011-09-25 17:47 258048 —-a-w- c:\windows\system32\winspool.drv
2011-09-25 17:47 . 2011-09-25 17:47 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-09-25 17:47 . 2011-09-25 17:47 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-09-25 17:47 . 2011-09-25 17:47 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-09-25 17:47 . 2011-09-25 17:47 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-09-25 17:47 . 2011-09-25 17:47 876032 —-a-w- c:\windows\system32\XpsPrint.dll
2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui
2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin
2011-09-12 23:14 . 2011-10-07 20:03 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll
2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll
2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll
2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll
2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll
2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll
2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll
2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll
2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll
2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll
2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 CFcatchme;CFcatchme;c:\users\Toni\AppData\Local\Temp\CFcatchme.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808]
S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328]
S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.bbc.co.uk
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-12 21:45
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\iS3\Anti-Spyware\SZServer.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Kontiki\KService.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\STOPzilla!\STOPzilla.exe
c:\windows\system32\RacAgent.exe
c:\windows\system32\mcbuilder.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2011-10-12 22:15:58 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-12 21:10
ComboFix2.txt 2011-10-11 20:11
ComboFix3.txt 2011-10-10 20:27
ComboFix4.txt 2011-10-08 17:09
.
Pre-Run: 8,583,962,624 bytes free
Post-Run: 7,195,942,912 bytes free
.
- - End Of File - - B463F2D3AF9EBDF72BD6A66F901F668B
Upload was successful

Happy to go with your advice if you think reformatting is the best option?

Does that mean I will lose content and need to ensure copies if I don't have them already?

Thanks.

helprequired

Post #13October 13, 2011, 4:22 AM UTC

Report attached.

Happy to go with your suggestion if you think reformat is the best option? does that mean I need to ensure that I have everything from the laptop, if I don't have a copy already? If I use USB is that likely to get infected?

Thanks for your ongoing support.

ComboFix 11-10-08.01 - Toni 12/10/2011 21:23:47.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.529 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Toni\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5}
SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
file zipped: c:\windows\system32\londoasolop.dat
file zipped: c:\windows\system32\lopcraaimtem.dat
file zipped: c:\windows\system32\loplovirto.dat
file zipped: c:\windows\system32\loporandtem.dat
file zipped: c:\windows\system32\lopwhaimsub.dat
file zipped: c:\windows\system32\mnjsimsimexe.dat
file zipped: c:\windows\system32\mnjwinaimco.dat
file zipped: c:\windows\system32\nihumtemsub.dat
file zipped: c:\windows\system32\nilo64dim.dat
file zipped: c:\windows\system32\niqwelopvir.dat
file zipped: c:\windows\system32\qui32asoexe.dat
file zipped: c:\windows\system32\quihumwhrim.dat
file zipped: c:\windows\system32\quisimjeetu.dat
file zipped: c:\windows\system32\qwedotemcom.dat
file zipped: c:\windows\system32\qwelop32ni.dat
file zipped: c:\windows\system32\simarjvirdim.dat
file zipped: c:\windows\system32\simexeqweqwe.dat
file zipped: c:\windows\system32\subandwi64.dat
file zipped: c:\windows\system32\tem32arjje.dat
file zipped: c:\windows\system32\toforimtem.dat
file zipped: c:\windows\system32\tohumtolon.dat
file zipped: c:\windows\system32\toqwequior.dat
file zipped: c:\windows\system32\whtemqweali.dat
file zipped: c:\windows\system32\wisub64and.dat
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\londoasolop.dat
c:\windows\system32\lopcraaimtem.dat
c:\windows\system32\loplovirto.dat
c:\windows\system32\loporandtem.dat
c:\windows\system32\lopwhaimsub.dat
c:\windows\system32\mnjsimsimexe.dat
c:\windows\system32\mnjwinaimco.dat
c:\windows\system32\nihumtemsub.dat
c:\windows\system32\nilo64dim.dat
c:\windows\system32\niqwelopvir.dat
c:\windows\system32\qui32asoexe.dat
c:\windows\system32\quihumwhrim.dat
c:\windows\system32\quisimjeetu.dat
c:\windows\system32\qwedotemcom.dat
c:\windows\system32\qwelop32ni.dat
c:\windows\system32\simarjvirdim.dat
c:\windows\system32\simexeqweqwe.dat
c:\windows\system32\subandwi64.dat
c:\windows\system32\tem32arjje.dat
c:\windows\system32\toforimtem.dat
c:\windows\system32\tohumtolon.dat
c:\windows\system32\toqwequior.dat
c:\windows\system32\whtemqweali.dat
c:\windows\system32\wisub64and.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-09-12 to 2011-10-12 )))))))))))))))))))))))))))))))
.
.
2011-10-12 20:40 . 2011-10-12 20:46 ——– d—–w- c:\users\Toni\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\patch2\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\Patch\AppData\Local\temp
2011-10-12 20:40 . 2011-10-12 20:40 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics
2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro
2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla
2011-09-25 17:52 . 2011-09-25 17:52 86528 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-25 17:47 . 2011-09-25 17:47 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 797184 —-a-w- c:\windows\system32\FntCache.dll
2011-09-25 17:47 . 2011-09-25 17:47 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-09-25 17:47 . 2011-09-25 17:47 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-09-25 17:47 . 2011-09-25 17:47 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-09-25 17:47 . 2011-09-25 17:47 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-09-25 17:47 . 2011-09-25 17:47 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-09-25 17:47 . 2011-09-25 17:47 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-09-25 17:47 . 2011-09-25 17:47 478720 —-a-w- c:\windows\system32\dxgi.dll
2011-09-25 17:47 . 2011-09-25 17:47 638336 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-09-25 17:47 . 2011-09-25 17:47 37376 —-a-w- c:\windows\system32\cdd.dll
2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-12 20:41 . 2011-10-12 20:41 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\offreg.dll
2011-09-25 17:53 . 2011-09-25 17:53 3122464 —h–w- c:\windows\system32\simdonitem.dat
2011-09-25 17:53 . 2011-09-25 17:53 161792 —-a-w- c:\windows\system32\msls31.dll
2011-09-25 17:53 . 2011-09-25 17:53 1126912 —-a-w- c:\windows\system32\wininet.dll
2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-09-25 17:52 . 2011-09-25 17:52 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-09-25 17:52 . 2011-09-25 17:52 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-09-25 17:52 . 2011-09-25 17:52 63488 —-a-w- c:\windows\system32\tdc.ocx
2011-09-25 17:52 . 2011-09-25 17:52 152064 —-a-w- c:\windows\system32\wextract.exe
2011-09-25 17:52 . 2011-09-25 17:52 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-09-25 17:52 . 2011-09-25 17:52 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-25 17:52 . 2011-09-25 17:52 11776 —-a-w- c:\windows\system32\mshta.exe
2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2011-09-25 17:47 . 2011-09-25 17:47 302592 —-a-w- c:\windows\system32\mfmp4src.dll
2011-09-25 17:47 . 2011-09-25 17:47 261632 —-a-w- c:\windows\system32\mfreadwrite.dll
2011-09-25 17:47 . 2011-09-25 17:47 2873344 —-a-w- c:\windows\system32\mf.dll
2011-09-25 17:47 . 2011-09-25 17:47 98816 —-a-w- c:\windows\system32\mfps.dll
2011-09-25 17:47 . 2011-09-25 17:47 586240 —-a-w- c:\windows\system32\stobject.dll
2011-09-25 17:47 . 2011-09-25 17:47 209920 —-a-w- c:\windows\system32\mfplat.dll
2011-09-25 17:47 . 2011-09-25 17:47 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-09-25 17:47 . 2011-09-25 17:47 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2011-09-25 17:47 . 2011-09-25 17:47 258048 —-a-w- c:\windows\system32\winspool.drv
2011-09-25 17:47 . 2011-09-25 17:47 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-09-25 17:47 . 2011-09-25 17:47 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-09-25 17:47 . 2011-09-25 17:47 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-09-25 17:47 . 2011-09-25 17:47 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-09-25 17:47 . 2011-09-25 17:47 876032 —-a-w- c:\windows\system32\XpsPrint.dll
2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui
2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin
2011-09-12 23:14 . 2011-10-07 20:03 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll
2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll
2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll
2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll
2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll
2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll
2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll
2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll
2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll
2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll
2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll
2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll
2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 CFcatchme;CFcatchme;c:\users\Toni\AppData\Local\Temp\CFcatchme.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808]
S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328]
S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
2011-10-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = www.bbc.co.uk
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-12 21:45
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\iS3\Anti-Spyware\SZServer.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Kontiki\KService.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\STOPzilla!\STOPzilla.exe
c:\windows\system32\RacAgent.exe
c:\windows\system32\mcbuilder.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2011-10-12 22:15:58 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-12 21:10
ComboFix2.txt 2011-10-11 20:11
ComboFix3.txt 2011-10-10 20:27
ComboFix4.txt 2011-10-08 17:09
.
Pre-Run: 8,583,962,624 bytes free
Post-Run: 7,195,942,912 bytes free
.
- - End Of File - - B463F2D3AF9EBDF72BD6A66F901F668B
Upload was successful

Attachments:

📎CFlog121011.txt

Tomk

Post #14October 13, 2011, 5:59 AM UTC

Missed one.

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::
c:\windows\system32\simdonitem.dat
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

helprequired

Post #15October 13, 2011, 6:59 PM UTC

As requested. Even though all Stopzilla areas states disabled, it still pops up but I can't see anywhere else to deactivate. ComboFix 11-10-13.03 - Toni 13/10/2011 18:36:22.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.387 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Toni\Desktop\CFScript.txt AV: Kaspersky Internet Security *Disabled/Outdated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE} FW: Kaspersky Internet Security *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5} SP: Kaspersky Internet Security *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13} SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\system32\simdonitem.dat" . . ((((((((((((((((((((((((( Files Created from 2011-09-13 to 2011-10-13 ))))))))))))))))))))))))))))))) . . 2011-10-13 18:19 . 2011-10-13 18:19 ——– d—–w- c:\users\Toni\AppData\Local\temp 2011-10-13 18:19 . 2011-10-13 18:19 ——– d—–w- c:\users\patch2\AppData\Local\temp 2011-10-07 20:03 . 2011-09-12 23:14 7269712 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89423389-10D1-4BF3-ACEA-4C5E39574A64}\mpengine.dll 2011-09-30 18:00 . 2011-09-30 18:00 ——– d—–w- c:\users\Toni\AppData\Local\ElevatedDiagnostics 2011-09-30 16:08 . 2011-09-30 16:08 388096 —-a-r- c:\users\Toni\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-09-30 16:08 . 2011-09-30 16:08 ——– d—–w- c:\program files\Trend Micro 2011-09-25 17:54 . 2011-09-25 17:54 ——– d—–w- c:\users\Toni\AppData\Local\Mozilla 2011-09-25 17:52 . 2011-09-25 17:52 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-09-25 17:48 . 2011-09-25 17:48 979456 —-a-w- c:\windows\system32\MFH264Dec.dll 2011-09-25 17:48 . 2011-09-25 17:48 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll 2011-09-25 17:44 . 2011-09-25 17:44 369664 —-a-w- c:\windows\system32\WMPhoto.dll 2011-09-25 17:44 . 2011-09-25 17:44 195584 —-a-w- c:\windows\system32\dxdiagn.dll 2011-09-25 17:44 . 2011-09-25 17:44 252928 —-a-w- c:\windows\system32\dxdiag.exe 2011-09-25 17:44 . 2011-09-25 17:44 519680 —-a-w- c:\windows\system32\d3d11.dll 2011-09-25 17:44 . 2011-09-25 17:44 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2011-09-25 17:44 . 2011-09-25 17:44 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2011-09-25 17:44 . 2011-09-25 17:44 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll 2011-09-16 17:47 . 2011-09-16 17:47 ——– d—–w- c:\users\Toni\hen do . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-09-25 17:44 . 2011-09-25 17:44 4096 —-a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui 2011-09-22 06:21 . 2011-06-08 07:54 0 —-a-w- c:\users\patch2\AppData\Local\Rqoxamecus.bin 2011-08-14 17:54 . 2011-05-16 20:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-07-19 10:02 . 2011-07-19 10:02 546256 —-a-r- c:\windows\system32\SZComp5.dll 2011-07-19 10:02 . 2011-07-19 10:02 22992 —-a-r- c:\windows\system32\SZIO5.dll 2011-07-19 10:02 . 2011-07-19 10:02 132560 —-a-r- c:\windows\system32\IS3HTUI5.dll 2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Svc5.dll 2011-07-19 10:02 . 2011-07-19 10:02 99792 —-a-r- c:\windows\system32\IS3Inet5.dll 2011-07-19 10:02 . 2011-07-19 10:02 67024 —-a-r- c:\windows\system32\IS3Hks5.dll 2011-07-19 10:02 . 2011-07-19 10:02 456144 —-a-r- c:\windows\system32\SZBase5.dll 2011-07-19 10:02 . 2011-07-19 10:02 398800 —-a-r- c:\windows\system32\IS3DBA5.dll 2011-07-19 10:02 . 2011-07-19 10:02 28624 —-a-r- c:\windows\system32\IS3XDat5.dll 2011-07-19 10:02 . 2011-07-19 10:02 738768 —-a-r- c:\windows\system32\IS3Base5.dll 2011-07-19 10:02 . 2011-07-19 10:02 390608 —-a-r- c:\windows\system32\IS3UI5.dll 2011-07-19 10:02 . 2011-07-19 10:02 230864 —-a-r- c:\windows\system32\IS3Win325.dll 2011-09-29 07:09 . 2011-09-30 18:48 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-07-02 138008] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-02 154392] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-02 133912] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184] "dscactivate"="c:\dell\dsca.exe" [2007-07-30 16384] "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "SigmatelSysTrayApp"="sttray.exe" [2007-03-06 303104] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Digimax Viewer 2.1.lnk - c:\program files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2008-2-15 634880] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-28 50688] QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2007-9-28 45056] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 . R0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-07 61328] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176] R3 CFcatchme;CFcatchme;c:\users\Toni\AppData\Local\Temp\CFcatchme.sys [x] R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-12 30192] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 136176] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-30 33808] S0 szkg5;szkg5;c:\windows\system32\DRIVERS\szkg.sys [2009-12-07 61328] S0 szkgfs;szkgfs;c:\windows\system32\drivers\szkgfs.sys [2010-05-12 59280] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496] S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2011-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30] . 2011-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-27 09:30] . . ——- Supplementary Scan ——- . uStart Page = www.bbc.co.uk uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s LSP: c:\windows\system32\wpclsp.dll TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\syawc8w8.default\ . . ************************************************************************** scanning hidden processes … . scanning hidden autostart entries … . scanning hidden files … . scan completed successfully hidden files: . ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\controlset002\control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2011-10-13 19:39:11 ComboFix-quarantined-files.txt 2011-10-13 18:39 ComboFix2.txt 2011-10-12 21:25 ComboFix3.txt 2011-10-11 20:11 ComboFix4.txt 2011-10-10 20:27 ComboFix5.txt 2011-10-13 17:28 . Pre-Run: 7,104,462,848 bytes free Post-Run: 7,857,172,480 bytes free . - - End Of File - - 7C87DB2DE1163EEBDCDE70AF807501CF

Attachments:

📎CFlog131011.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

internet explorer crashing

✨ Ask AI

Ask AI