Hello everyone, I ran into this and downloaded Gridinsoft Trojan Killer to get rid of it, but the evaluation version won't let me remove the 8 excess files left over from the malware.
Right now it's not effecting me because Trojan Killer was able to get rid of the main files but I was hoping I could get some help for the leftover files. I ran OTL (twice) but it didn't give me an updated Extras.txt, the file that shows up when I open Extras.txt is from my last OTL scan in May. Hope this isn't a problem, thank you for your time.
[OTL log omitted]
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-13 04:08:03
—————————–
04:08:03.519 OS Version: Windows x64 6.1.7601 Service Pack 1
04:08:03.520 Number of processors: 2 586 0x170A
04:08:03.520 ComputerName: MYCOMPUTER-PC UserName: My Computer
04:08:04.896 Initialze error C000010E - driver not loaded
04:08:04.927 write error "aswCmnB.dll". The process cannot access the file because it is being used by another process.
04:13:14.914 AVAST engine defs: 11111300
04:14:56.774 Service scanning
04:14:57.753 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
04:14:58.382 Modules scanning
04:14:58.389 Disk 0 trace - called modules:
04:14:58.396
04:14:59.656 AVAST engine scan C:\Windows
04:15:02.936 AVAST engine scan C:\Windows\system32
04:17:53.690 AVAST engine scan C:\Windows\system32\drivers
04:18:13.235 AVAST engine scan C:\Users\My Computer
04:19:32.801 The log file has been saved successfully to "C:\Users\My Computer\Desktop\aswMBR.txt"
_____________________________
_____________________________
Okay sorry, looks like I made the log too early. Heres the finished one…
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-13 04:08:03
—————————–
04:08:03.519 OS Version: Windows x64 6.1.7601 Service Pack 1
04:08:03.520 Number of processors: 2 586 0x170A
04:08:03.520 ComputerName: MYCOMPUTER-PC UserName: My Computer
04:08:04.896 Initialze error C000010E - driver not loaded
04:08:04.927 write error "aswCmnB.dll". The process cannot access the file because it is being used by another process.
04:13:14.914 AVAST engine defs: 11111300
04:14:56.774 Service scanning
04:14:57.753 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
04:14:58.382 Modules scanning
04:14:58.389 Disk 0 trace - called modules:
04:14:58.396
04:14:59.656 AVAST engine scan C:\Windows
04:15:02.936 AVAST engine scan C:\Windows\system32
04:17:53.690 AVAST engine scan C:\Windows\system32\drivers
04:18:13.235 AVAST engine scan C:\Users\My Computer
04:19:32.801 The log file has been saved successfully to "C:\Users\My Computer\Desktop\aswMBR.txt"
04:28:09.709 AVAST engine scan C:\ProgramData
04:31:40.430 Scan finished successfully
04:41:46.654 The log file has been saved successfully to "C:\Users\My Computer\Desktop\aswMBR.txt"
Hi
Please run the following:
Refer to the
ComboFix User's Guide Download ComboFix from one of these locations:Link 1 Link 2 * IMPORTANT !!! Place ComboFix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.here Double click on ComboFix.exe & follow the prompts. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next replyNote: Ensure your AntiVirus and AntiSpyware applications are re-enabled. NOTE: If you encounter a message
"illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
ComboFix 11-11-13.03 - My Computer 11/13/2011 22:03:48.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4092.2667 [GMT -8:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))
.
.
2011-11-14 06:14 . 2011-11-14 06:14 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-13 21:31 . 2011-11-13 21:31 ——– d—–w- c:\users\My Computer\AppData\Local\.inapptracking
2011-11-13 21:30 . 2010-06-02 12:55 77656 —-a-w- c:\windows\system32\XAPOFX1_5.dll
2011-11-13 21:30 . 2010-06-02 12:55 74072 —-a-w- c:\windows\SysWow64\XAPOFX1_5.dll
2011-11-13 21:30 . 2010-06-02 12:55 527192 —-a-w- c:\windows\SysWow64\XAudio2_7.dll
2011-11-13 21:30 . 2010-06-02 12:55 518488 —-a-w- c:\windows\system32\XAudio2_7.dll
2011-11-13 21:30 . 2010-06-02 12:55 239960 —-a-w- c:\windows\SysWow64\xactengine3_7.dll
2011-11-13 21:30 . 2010-06-02 12:55 176984 —-a-w- c:\windows\system32\xactengine3_7.dll
2011-11-13 21:30 . 2010-05-26 19:41 2526056 —-a-w- c:\windows\system32\D3DCompiler_43.dll
2011-11-13 21:30 . 2010-05-26 19:41 2106216 —-a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2011-11-13 21:30 . 2010-05-26 19:41 1907552 —-a-w- c:\windows\system32\d3dcsx_43.dll
2011-11-13 21:30 . 2010-05-26 19:41 1868128 —-a-w- c:\windows\SysWow64\d3dcsx_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 511328 —-a-w- c:\windows\system32\d3dx10_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 470880 —-a-w- c:\windows\SysWow64\d3dx10_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 276832 —-a-w- c:\windows\system32\d3dx11_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 248672 —-a-w- c:\windows\SysWow64\d3dx11_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 1998168 —-a-w- c:\windows\SysWow64\D3DX9_43.dll
2011-11-13 21:29 . 2010-05-26 19:41 2401112 —-a-w- c:\windows\system32\D3DX9_43.dll
2011-11-11 05:13 . 2011-01-17 17:09 334976 —-a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-11-11 05:13 . 2010-12-16 16:43 137704 —-a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-11-11 05:13 . 2010-07-16 22:53 816016 —-a-w- c:\windows\system32\drivers\pctEFA64.sys
2011-11-11 05:13 . 2010-06-29 18:35 452872 —-a-w- c:\windows\system32\drivers\pctDS64.sys
2011-11-11 05:13 . 2010-12-10 21:24 257232 —-a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-11-11 05:13 . 2010-12-16 16:46 92896 —-a-w- c:\windows\system32\drivers\pctplsg64.sys
2011-11-11 05:12 . 2011-11-14 05:56 ——– d—–w- c:\program files (x86)\PC Tools Security
2011-11-11 05:12 . 2011-11-11 05:25 ——– d—–w- c:\program files (x86)\Common Files\PC Tools
2011-11-11 05:12 . 2011-11-11 05:12 ——– d—–w- c:\users\My Computer\AppData\Roaming\PC Tools
2011-11-10 16:32 . 2007-07-20 08:57 411496 —-a-w- c:\windows\system32\xactengine2_9.dll
2011-11-09 22:57 . 2011-10-01 05:45 886784 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-09 22:57 . 2011-10-01 04:37 708608 —-a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 22:57 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 22:57 . 2011-09-29 04:03 3144704 —-a-w- c:\windows\system32\win32k.sys
2011-11-09 22:31 . 2011-11-12 04:45 ——– d—–w- c:\users\My Computer\AppData\Local\Akamai
2011-11-07 10:44 . 2011-11-07 10:44 ——– d—–w- C:\b7ea8cc1c440dece5fb47ef6f967d9db
2011-11-07 10:43 . 2010-02-04 18:01 74072 —-a-w- c:\windows\SysWow64\XAPOFX1_4.dll
2011-11-07 10:43 . 2010-02-04 18:01 528216 —-a-w- c:\windows\SysWow64\XAudio2_6.dll
2011-11-07 10:43 . 2010-02-04 18:01 238936 —-a-w- c:\windows\SysWow64\xactengine3_6.dll
2011-11-07 10:43 . 2010-02-04 18:01 22360 —-a-w- c:\windows\SysWow64\X3DAudio1_7.dll
2011-11-07 10:43 . 2009-03-09 23:27 4178264 —-a-w- c:\windows\SysWow64\D3DX9_41.dll
2011-11-07 02:30 . 2011-11-07 02:30 ——– d—–w- c:\windows\system32\SPReview
2011-11-07 02:29 . 2011-11-07 02:29 ——– d—–w- c:\windows\system32\EventProviders
2011-11-07 01:37 . 2011-11-13 12:11 ——– d—–w- c:\program files (x86)\GridinSoft Trojan Killer
2011-11-07 00:11 . 2011-11-07 00:11 ——– d—–w- c:\windows\Sun
2011-11-05 17:54 . 2011-11-11 08:13 ——– d—–w- c:\users\My Computer\AppData\Roaming\Bioshock
2011-11-04 23:42 . 2011-11-04 23:42 ——– d—–w- c:\program files (x86)\Common Files\Adobe
2011-11-04 07:04 . 2011-11-04 07:04 ——– d—–w- c:\program files (x86)\Microsoft XNA
2011-11-04 05:47 . 2011-11-04 05:47 ——– d—–w- c:\program files (x86)\AMD APP
2011-11-04 05:47 . 2011-11-04 05:47 ——– d—–w- c:\program files\Common Files\ATI Technologies
2011-11-04 05:47 . 2011-11-04 05:47 ——– d—–w- c:\program files (x86)\Common Files\ATI Technologies
2011-11-04 05:46 . 2011-11-04 05:47 ——– d—–w- c:\program files\ATI Technologies
2011-11-04 05:46 . 2011-11-04 05:46 ——– d—–w- c:\program files\ATI
2011-11-04 05:45 . 2011-11-04 05:45 ——– d—–w- C:\ATI
2011-11-01 04:05 . 2011-11-13 11:15 ——– d—–w- c:\program files (x86)\Common Files\Steam
2011-11-01 04:05 . 2011-11-14 06:00 ——– d—–w- c:\program files (x86)\Steam
2011-10-26 20:32 . 2011-10-26 20:32 ——– d—–w- c:\program files (x86)\uTorrent
2011-10-26 20:31 . 2011-11-14 06:12 ——– d—–w- c:\users\My Computer\AppData\Roaming\uTorrent
2011-10-26 20:31 . 2011-10-26 20:31 ——– d—–w- c:\users\My Computer\AppData\Local\uTorrent
2011-10-19 21:56 . 2011-10-19 21:56 ——– d—–w- c:\program files (x86)\UBISOFT
2011-10-19 21:55 . 2002-12-05 21:10 155648 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-10-19 21:55 . 2002-12-02 22:22 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-10-19 21:55 . 2002-12-02 20:33 57344 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-10-19 21:55 . 2002-12-02 20:33 237568 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-10-19 21:55 . 2003-02-27 23:12 696320 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-10-19 21:54 . 2011-10-19 21:54 282756 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-10-19 21:54 . 2011-10-19 21:54 163972 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-07 02:38 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll
2011-11-07 02:38 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll
2011-10-20 16:30 . 2011-08-26 20:34 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-12 23:16 . 2011-10-12 23:16 66048 —-a-w- c:\windows\system32\OpenVideo64.dll
2011-10-12 23:16 . 2011-10-12 23:16 56832 —-a-w- c:\windows\SysWow64\OpenVideo.dll
2011-10-12 23:16 . 2011-10-12 23:16 16787456 —-a-w- c:\windows\system32\amdocl64.dll
2011-10-12 23:15 . 2011-10-12 23:15 13753856 —-a-w- c:\windows\SysWow64\amdocl.dll
2011-10-12 23:14 . 2011-10-12 23:14 51200 —-a-w- c:\windows\system32\OpenCL.dll
2011-10-12 23:14 . 2011-10-12 23:14 43520 —-a-w- c:\windows\SysWow64\OpenCL.dll
2011-10-12 20:56 . 2011-10-12 20:56 10207232 —-a-w- c:\windows\system32\drivers\atikmdag.sys
2011-10-12 20:20 . 2011-10-12 20:20 24629760 —-a-w- c:\windows\system32\atio6axx.dll
2011-10-12 20:14 . 2011-10-12 20:14 159744 —-a-w- c:\windows\system32\atiapfxx.exe
2011-10-12 20:14 . 2011-10-12 20:14 736768 —-a-w- c:\windows\SysWow64\aticfx32.dll
2011-10-12 20:13 . 2011-10-12 20:13 867328 —-a-w- c:\windows\system32\aticfx64.dll
2011-10-12 20:10 . 2011-10-12 20:10 466944 —-a-w- c:\windows\system32\ATIDEMGX.dll
2011-10-12 20:10 . 2011-10-12 20:10 487936 —-a-w- c:\windows\system32\atieclxx.exe
2011-10-12 20:09 . 2011-10-12 20:09 204288 —-a-w- c:\windows\system32\atiesrxx.exe
2011-10-12 20:08 . 2011-10-12 20:08 120320 —-a-w- c:\windows\system32\atitmm64.dll
2011-10-12 20:08 . 2011-10-12 20:08 423424 —-a-w- c:\windows\system32\atipdl64.dll
2011-10-12 20:08 . 2011-10-12 20:08 356352 —-a-w- c:\windows\SysWow64\atipdlxx.dll
2011-10-12 20:07 . 2011-10-12 20:07 278528 —-a-w- c:\windows\SysWow64\Oemdspif.dll
2011-10-12 20:07 . 2011-10-12 20:07 21504 —-a-w- c:\windows\system32\atimuixx.dll
2011-10-12 20:07 . 2011-10-12 20:07 59392 —-a-w- c:\windows\system32\atiedu64.dll
2011-10-12 20:07 . 2011-10-12 20:07 43520 —-a-w- c:\windows\SysWow64\ati2edxx.dll
2011-10-12 20:04 . 2011-10-12 20:04 4231680 —-a-w- c:\windows\SysWow64\atidxx32.dll
2011-10-12 20:04 . 2011-10-12 20:04 18630656 —-a-w- c:\windows\SysWow64\atioglxx.dll
2011-10-12 19:54 . 2009-12-04 18:19 4960768 —-a-w- c:\windows\system32\atidxx64.dll
2011-10-12 19:46 . 2011-10-12 19:46 51200 —-a-w- c:\windows\system32\aticalrt64.dll
2011-10-12 19:46 . 2011-10-12 19:46 46080 —-a-w- c:\windows\SysWow64\aticalrt.dll
2011-10-12 19:46 . 2011-10-12 19:46 44544 —-a-w- c:\windows\system32\aticalcl64.dll
2011-10-12 19:46 . 2011-10-12 19:46 44032 —-a-w- c:\windows\SysWow64\aticalcl.dll
2011-10-12 19:45 . 2011-10-12 19:45 9877504 —-a-w- c:\windows\system32\aticaldd64.dll
2011-10-12 19:44 . 2011-10-12 19:44 1113088 —-a-w- c:\windows\system32\atiumd6v.dll
2011-10-12 19:44 . 2009-12-04 18:19 4289024 —-a-w- c:\windows\SysWow64\atiumdag.dll
2011-10-12 19:44 . 2011-10-12 19:44 1828864 —-a-w- c:\windows\SysWow64\atiumdmv.dll
2011-10-12 19:44 . 2011-10-12 19:44 4023296 —-a-w- c:\windows\system32\atiumd6a.dll
2011-10-12 19:42 . 2011-10-12 19:42 8391680 —-a-w- c:\windows\SysWow64\aticaldd.dll
2011-10-12 19:39 . 2011-10-12 19:39 58880 —-a-w- c:\windows\system32\coinst.dll
2011-10-12 19:38 . 2011-10-12 19:38 5431808 —-a-w- c:\windows\system32\atiumd64.dll
2011-10-12 19:33 . 2009-12-04 18:19 4174848 —-a-w- c:\windows\SysWow64\atiumdva.dll
2011-10-12 19:31 . 2011-10-12 19:31 479744 —-a-w- c:\windows\system32\atiadlxx.dll
2011-10-12 19:31 . 2011-10-12 19:31 335872 —-a-w- c:\windows\SysWow64\atiadlxy.dll
2011-10-12 19:31 . 2011-10-12 19:31 17408 —-a-w- c:\windows\system32\atig6pxx.dll
2011-10-12 19:31 . 2011-10-12 19:31 14336 —-a-w- c:\windows\SysWow64\atiglpxx.dll
2011-10-12 19:31 . 2011-10-12 19:31 14336 —-a-w- c:\windows\system32\atiglpxx.dll
2011-10-12 19:30 . 2011-10-12 19:30 39936 —-a-w- c:\windows\system32\atig6txx.dll
2011-10-12 19:30 . 2011-10-12 19:30 32768 —-a-w- c:\windows\SysWow64\atigktxx.dll
2011-10-12 19:30 . 2011-10-12 19:30 317952 —-a-w- c:\windows\system32\drivers\atikmpag.sys
2011-10-12 19:29 . 2011-10-12 19:29 40960 —-a-w- c:\windows\system32\atiuxp64.dll
2011-10-12 19:29 . 2011-10-12 19:29 31744 —-a-w- c:\windows\SysWow64\atiuxpag.dll
2011-10-12 19:29 . 2011-10-12 19:29 38912 —-a-w- c:\windows\system32\atiu9p64.dll
2011-10-12 19:29 . 2011-10-12 19:29 29184 —-a-w- c:\windows\SysWow64\atiu9pag.dll
2011-10-12 19:28 . 2011-10-12 19:28 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2011-10-12 19:16 . 2011-10-12 19:16 54784 —-a-w- c:\windows\system32\atimpc64.dll
2011-10-12 19:16 . 2011-10-12 19:16 54784 —-a-w- c:\windows\system32\amdpcom64.dll
2011-10-12 19:16 . 2011-10-12 19:16 53760 —-a-w- c:\windows\SysWow64\atimpc32.dll
2011-10-12 19:16 . 2011-10-12 19:16 53760 —-a-w- c:\windows\SysWow64\amdpcom32.dll
2011-10-01 03:25 . 2011-10-11 18:31 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-01 02:42 . 2011-10-11 18:31 1638912 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-08-27 05:37 . 2011-10-11 18:30 861696 —-a-w- c:\windows\system32\oleaut32.dll
2011-08-27 05:37 . 2011-10-11 18:30 331776 —-a-w- c:\windows\system32\oleacc.dll
2011-08-27 04:26 . 2011-10-11 18:30 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-08-27 04:26 . 2011-10-11 18:30 233472 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-08-20 05:37 . 2011-10-11 18:31 1188864 —-a-w- c:\windows\system32\wininet.dll
2011-08-20 04:31 . 2011-10-11 18:31 981504 —-a-w- c:\windows\SysWow64\wininet.dll
2011-08-17 05:26 . 2011-10-11 18:30 613888 —-a-w- c:\windows\system32\psisdecd.dll
2011-08-17 05:25 . 2011-10-11 18:30 108032 —-a-w- c:\windows\system32\psisrndr.ax
2011-08-17 04:24 . 2011-10-11 18:30 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-08-17 04:19 . 2011-10-11 18:30 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
"F.lux"="c:\users\My Computer\Local Settings\Apps\F.lux\flux.exe" [2009-08-29 966656]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-09-01 3077528]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-10-26 641400]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-11-01 1242448]
"Akamai NetSession Interface"="c:\users\My Computer\AppData\Local\Akamai\netsession_win.exe" [2011-11-12 3303000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-12 343168]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-06-19 494064]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2009-11-13 141600]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-10-12 559616]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184]
.
c:\users\My Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-26 135664]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-26 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va005;X6va005;c:\users\MYCOMP~1\AppData\Local\Temp\00537B2.tmp [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-26 11:46]
.
2011-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-26 11:46]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-01-23 305664]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-07-02 3180624]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{B99FD459-9E01-44A6-90AB-5491C4E2287A}\65562796A7F6E602D496649623230303026454736302355636572756: NameServer = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\users\My Computer\AppData\Roaming\Mozilla\Firefox\Profiles\znh109lv.default\
FF - prefs.js: browser.startup.homepage - about:home
.
- - - - ORPHANS REMOVED - - - -
.
Notify-GoToAssist - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-Astroburn Toolbar - c:\program files (x86)\Astroburn Toolbar\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_dac4cfd.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\MYCOMP~1\AppData\Local\Temp\00537B2.tmp"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-11-13 22:18:47
ComboFix-quarantined-files.txt 2011-11-14 06:18
.
Pre-Run: 135,949,291,520 bytes free
Post-Run: 136,432,287,744 bytes free
.
- - End Of File - - 1052E2341BF0E8A31DF2E88C5C4D7132
Hi,
Please do the following:
Please download
Malwarebytes' Anti-Malware Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan" , then click Scan. The scan may take some time to finish, so please be patient. When the scan is complete, click OK , then Show Results to view the results. Make sure that everything is checked, and click Remove Selected . <– very important When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
NEXT
Go
here to run an online scanner from
ESET. Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activeX control to install Click Start Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked. Click on Advanced Settings, ensure the options Scan for potentially unwanted applications , Scan for potentially unsafe applications , and Enable Anti-Stealth Technology are ticked. Click Scan Wait for the scan to finish When the scan completes, press the LIST OF THREATS FOUND button Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop Include the contents of this report in your next reply. Press the BACK button. Press Finish
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 8164
Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514
11/14/2011 7:06:29 PM
mbam-log-2011-11-14 (19-06-29).txt
Scan type: Quick scan
Objects scanned: 175419
Time elapsed: 3 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\my computer\downloads\downloadsetup.exe (Affiliate.Downloader) -> Quarantined and deleted successfully.
ESET Scan report:
C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A application
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\UpdateWorkingDirectory\DSL\hstart.exe a variant of Win32/HiddenStart.A application
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\UpdateWorkingDirectory\DSL\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application
C:\Program Files (x86)\GridinSoft Trojan Killer\trojankiller.exe a variant of Win32/1AntiVirus application
C:\ProgramData\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip worm
Hi,
You can delete the Spybot quarantine if you wish, but the files can no longer harm yyour computer in their present location.
Please do the following:
Please download
DDS from either of these links
LINK 1 LINK 2
and save it to your
desktop.
Disable any script blocking protection Double click dds to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop. —————————————————
Please include the contents of the following in your next reply:
DDS.txt
Attach.txt .
NEXT
Please advise how your computer is running now and if there are any outstanding issues.
Due to inactivity this topic will be closed.
If you need help please start a new thread.
New members follow the instructions here
http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic
