Hi
Yes,
You may have to uninstall and re-install some of those infected programs, but let's see what the tools can do first and then we'll go from there,
stay with me till I give you the "all clean" and don't run any scans or fix any items unless I give you the instructions to do so as it may interfere.
thanks
Please be patient and give the tools lots of time to complete, especially ComboFix, it may appear to have stalled, but wait until it creates a log
TDSSkiller scan done a few times and it said nothing was infected. should i still continue with the ComboFix ?
yes please
please give ComboFix lots of time to complete, make certain your security programs are disabled
okay ComboFix log:
ComboFix 11-12-09.03 - HKH 12/09/2011 17:23:18.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3934.1522 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Rising Antivirus *Enabled/Updated* {C0AEEC5C-BBDB-2745-3E22-21BEC65323A5}
FW: Rising Personal Firewall *Enabled* {F8956D79-F1B4-261D-157D-888B388064DE}
SP: Rising Antivirus *Enabled/Updated* {7BCF0DB8-9DE1-28CB-0492-1ACCBDD46918}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\AppleVerifierUpdate.dll
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
c:\users\HKH\AppData\Local\Apple Computer\AppleUpdate\Appleup.dll
c:\users\HKH\AppData\Local\Apple\AppleUpdate\Appleup.dll
c:\users\HKH\AppData\Local\cache\cacheUpdate\cacheup.dll
c:\users\HKH\AppData\Local\Lexar Media\LexarUpdate\Lexarup.dll
c:\users\HKH\AppData\Roaming\AcroIEHelpe.txt
c:\users\HKH\AppData\Roaming\AcroIEHelpe060.dll
c:\users\HKH\AppData\Roaming\appconf32.exe
c:\users\HKH\AppData\Roaming\Firefox.exe
c:\users\HKH\AppData\Roaming\java.exe
c:\users\HKH\AppData\Roaming\mCekIVrzOtAuSiD
c:\users\HKH\AppData\Roaming\mCekIVrzOtAuSiD\Guard Online .ico
c:\users\HKH\AppData\Roaming\spxadzo6.default.tmp
c:\users\HKH\AppData\Roaming\srvblck2.tmp
c:\windows\assembly\tmp\U
c:\windows\assembly\tmp\U\00000001.@
c:\windows\assembly\tmp\U\00000002.@
c:\windows\assembly\tmp\U\00000004.@
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\80000004.@
c:\windows\assembly\tmp\U\80000032.@
c:\windows\assembly\tmp\U\80000064.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@
c:\windows\svcs.exe
c:\windows\system32\consrv.dll
c:\windows\System64
c:\windows\SysWow64\config\mcckmplayervod.ini
c:\windows\SysWow64\FastUserSwitchingCompatibilityex.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_Kingsoft Antivirus WebShield Service
——-\Service_RkHit
——-\Service_NetworkLog
.
.
((((((((((((((((((((((((( Files Created from 2011-11-09 to 2011-12-09 )))))))))))))))))))))))))))))))
.
.
2011-12-09 22:31 . 2011-12-09 22:31 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\offreg.dll
2011-12-09 22:28 . 2011-12-09 22:33 ——– d—–w- c:\users\HKH\AppData\Local\temp
2011-12-09 22:28 . 2011-12-09 22:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-09 11:38 . 2011-12-08 14:25 8822856 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\mpengine.dll
2011-12-09 10:38 . 2011-12-09 10:38 388096 —-a-r- c:\users\HKH\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-09 10:38 . 2011-12-09 10:38 ——– d—–w- c:\program files (x86)\Trend Micro
2011-12-09 10:00 . 2011-12-09 10:00 ——– d—–w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2011-12-09 09:55 . 2011-12-09 09:55 ——– d—–w- c:\users\HKH\AppData\Local\PackageAware
2011-12-09 09:41 . 2011-12-09 09:41 ——– d—–w- c:\users\HKH\AppData\Roaming\5054
2011-12-08 23:33 . 2011-12-08 23:34 ——– d—–w- c:\users\HKH\AppData\Roaming\5053
2011-12-08 23:33 . 2011-12-09 10:23 ——– d—–w- c:\users\HKH\AppData\Roaming\UAs
2011-12-08 23:30 . 2011-12-09 21:36 ——– d—–w- c:\users\HKH\AppData\Roaming\xmldm
2011-12-08 23:29 . 2011-12-09 21:36 ——– d—–w- c:\users\HKH\AppData\Roaming\kock
2011-12-08 23:29 . 2011-12-08 23:29 ——– d—–w- c:\windows\Sun
2011-12-08 23:24 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Common Files\xing shared
2011-12-08 23:16 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Real
2011-12-08 14:40 . 2011-12-08 14:40 32256 —-a-w- c:\windows\SysWow64\Qq8n68.com
2011-12-08 14:08 . 2011-12-08 14:06 39576 —-a-w- c:\windows\system32\drivers\rfwarp.sys
2011-12-08 14:07 . 2011-12-08 14:06 19608 —-a-w- c:\windows\system32\drivers\rfwndis.sys
2011-12-08 14:03 . 2011-12-09 22:18 ——– d—–r- C:\RavBin
2011-12-08 14:03 . 2011-12-08 14:01 30360 ——w- c:\windows\system32\drivers\HookTdi.sys
2011-12-08 14:03 . 2011-12-08 14:01 317080 ——w- c:\windows\system32\RavExt64.dll
2011-12-08 14:03 . 2011-12-08 14:01 234648 ——w- c:\windows\SysWow64\ravext.dll
2011-12-08 14:03 . 2011-12-08 14:01 41048 ——w- c:\windows\system32\drivers\hvm.sys
2011-12-08 14:03 . 2011-12-08 14:01 239768 ——w- c:\windows\SysWow64\bsmain.exe
2011-12-08 14:03 . 2011-12-08 14:01 37016 ——w- c:\windows\system32\drivers\Hooksys.sys
2011-12-08 14:03 . 2011-12-08 14:01 27288 ——w- c:\windows\system32\drivers\HookHelp.sys
2011-12-08 14:02 . 2011-12-08 14:07 ——– d—–w- c:\program files (x86)\Rising
2011-12-08 14:02 . 2011-12-08 14:20 ——– d—–w- c:\programdata\Rising
2011-12-08 11:24 . 2011-07-29 16:08 375808 —-a-w- c:\windows\system32\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:01 293376 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:08 289792 —-a-w- c:\windows\system32\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:06 73216 —-a-w- c:\windows\system32\MSDvbNP.ax
2011-12-08 11:24 . 2011-07-29 16:06 100352 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:01 217088 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:00 69632 —-a-w- c:\windows\SysWow64\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:00 57856 —-a-w- c:\windows\SysWow64\MSDvbNP.ax
2011-12-08 11:22 . 2011-09-06 13:56 2764288 —-a-w- c:\windows\system32\win32k.sys
2011-12-08 11:22 . 2011-08-25 16:20 735744 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:19 847360 —-a-w- c:\windows\system32\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:19 332288 —-a-w- c:\windows\system32\oleacc.dll
2011-12-08 11:22 . 2011-08-25 16:15 555520 —-a-w- c:\windows\SysWow64\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:14 563712 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:14 238080 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-12-08 11:22 . 2011-08-25 13:54 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-12-08 11:22 . 2011-08-25 13:31 4096 —-a-w- c:\windows\SysWow64\oleaccrc.dll
2011-12-08 11:06 . 2011-12-08 11:06 ——– d—–w- c:\program files\Symantec
2011-12-08 11:03 . 2011-12-08 11:03 ——– d—–w- c:\program files (x86)\Norton AntiVirus(0)
2011-12-08 10:09 . 2011-12-08 10:09 ——– d—–w- c:\users\HKH\AppData\Local\Symantec
2011-11-20 23:05 . 2011-11-20 23:05 ——– d-sh–w- c:\programdata\KRSHistory
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 14:25 . 2010-03-25 01:57 270720 ——w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-05-19 432640]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-09 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"NDSTray.exe"="NDSTray.exe" [BU]
"PCMAgent"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
"CLMLServer"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-08-14 417792]
"nmctxth"="c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files (x86)\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"RFWTRAY"="c:\program files (x86)\Rising\RFW\RSTRAY.EXE" [2011-12-08 178840]
"RavTRAY"="c:\program files (x86)\Rising\RAV\RSTRAY.EXE" [2011-12-08 178840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-12-08 296056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TOSHIBA Face Recognition Watcher.lnk - c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2008-8-25 126464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 bsmain
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i64.sys [x]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n64.sys [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 hooksys;hooksys;c:\windows\system32\drivers\Hooksys.sys [x]
S1 HookTdi;HookTdi;c:\windows\system32\drivers\HookTdi.sys [x]
S1 HyperVM;HyperVM;c:\windows\system32\drivers\hvm.sys [x]
S1 RFWNDIS;Rising RfwNdis Driver;c:\windows\system32\DRIVERS\rfwndis.sys [x]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-03-06 20376]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [x]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2008-06-28 36864]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2008-07-11 40960]
S2 RFWARP;Rising RfwARP Driver;c:\windows\system32\DRIVERS\rfwarp.sys [x]
S2 rfwtdi;rfwtdi;c:\program files (x86)\Rising\RFW\rfwtdi.sys [2011-12-08 31896]
S2 rsfwdrv;rsfwdrv;c:\program files (x86)\Rising\RFW\rsfwdrv.sys [2011-12-08 74904]
S2 RsMgrSvc;Rsd Service;c:\program files (x86)\Rising\RSD\RsMgrSvc.exe [2011-12-08 150168]
S2 RsRavMon;Rav Service;c:\program files (x86)\Rising\RAV\RavMonD.exe [2011-12-08 264448]
S2 RsRFWMon;RFW Service;c:\program files (x86)\Rising\RFW\RavMonD.exe [2011-12-08 264448]
S2 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2008-08-04 46392]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-07-17 139776]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;c:\windows\system32\DRIVERS\NETw5v64.sys [x]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 89600]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-09 c:\windows\Tasks\At1.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At11.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At13.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At15.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-08 c:\windows\Tasks\At17.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-08 c:\windows\Tasks\At19.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-08 c:\windows\Tasks\At21.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At23.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At25.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At27.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At29.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At3.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At31.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At33.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At35.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-08 c:\windows\Tasks\At37.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At39.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At41.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At43.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At45.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At47.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At5.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At7.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\At9.job
- c:\windows\system32\Qq8n68.com [2011-12-08 14:40]
.
2011-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
2011-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-13 151064]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-13 209432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-13 181784]
"RtHDVCpl"="RAVCpl64.exe" [2008-08-21 6456864]
"Skytel"="Skytel.exe" [2008-08-21 1833504]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2008-09-03 885248]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-15 1573160]
"combofix"="c:\combofix\CF23769.3XE" [2008-01-21 363008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/?pc=BNHP
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Download all by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: ???????? - c:\flashget network\FlashGet Mini\GetUrl.htm
IE: ???????????? - c:\flashget network\FlashGet Mini\GetAllUrl.htm
TCP: DhcpNameServer = [removed] [removed] 192.168.1.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\HKH\AppData\Roaming\Mozilla\Firefox\Profiles\spxadzo6.default\
FF - prefs.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=
FF - user.js: browser.search.order.1 - Search
FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-h11uuvS2ob3pGaJ8234A - c:\users\HKH\AppData\Roaming\DvvDD2obF4Q68R9\GhTXXwUCelIrzNy.exe
Wow6432Node-HKCU-Run-Local Update - c:\users\HKH\AppData\Local\Apple\AppleUpdate\Appleup.dll
Wow6432Node-HKCU-Run-AppleVerifierUpdate - c:\programdata\AppleVerifierUpdate.dll
Wow6432Node-HKCU-Run-Adobe Update - c:\users\HKH\AppData\Local\Apple Computer\AppleUpdate\Appleup.dll
Wow6432Node-HKCU-Run-TOSHIBA Update - c:\users\HKH\AppData\Local\Lexar Media\LexarUpdate\Lexarup.dll
Wow6432Node-HKCU-Run-YahooPartnerToolbar Update - c:\users\HKH\AppData\Local\cache\cacheUpdate\cacheup.dll
Wow6432Node-HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
Wow6432Node-HKLM-Run-SunJavaUpdateSched - c:\program files (x86)\Java\jre6\bin\jusched.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files (x86)\Toshiba\ConfigFree\NDSTray.exe
c:\program files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
.
**************************************************************************
.
Completion time: 2011-12-09 17:40:16 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-09 22:40
.
Pre-Run: 262,121,664,512 bytes free
Post-Run: 263,007,264,768 bytes free
.
- - End Of File - - 4F2436105064E1F673F92F2123D2FDC2
Hi,
Please do the following:
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Copy/paste the text inside the Codebox below into notepad:
Here's how to do that:
Click
Start > Run type
Notepad click
OK.
This will open an empty notepad file:
Copy all the text
inside of the code box -
Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/index.php?act=post&do=reply_post&f=27&t=121494
Collect::
c:\windows\SysWow64\Qq8n68.com
c:\windows\system32\Qq8n68.com
DirLook::
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
c:\users\HKH\AppData\Roaming\5054
c:\users\HKH\AppData\Roaming\5053
c:\users\HKH\AppData\Roaming\UAs
c:\users\HKH\AppData\Roaming\xmldm
c:\users\HKH\AppData\Roaming\kock
AtJob::
ClearJavaCache::
Now
paste the copied text into the open notepad - press
CTRL+V (or right click and choose 'paste')
Here's how to do that:
1.Click
File ;
2.Click
Save As … Change the directory to your
desktop ;
3.Change the
Save as type to
"All Files";
4.Type in the file name:
CFScript
5.Click
Save …
[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix may request an update; please allow it. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
NEXT
Please download
Malwarebytes' Anti-Malware Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan" , then click Scan. The scan may take some time to finish, so please be patient. When the scan is complete, click OK , then Show Results to view the results. Make sure that everything is checked, and click Remove Selected . <– very important When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
NEXT
Go
here to run an online scanner from
ESET. Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activeX control to install Click Start Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked. Click on Advanced Settings, ensure the options Scan for potentially unwanted applications , Scan for potentially unsafe applications , and Enable Anti-Stealth Technology are ticked. Click Scan Wait for the scan to finish When the scan completes, press the LIST OF THREATS FOUND button Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop Include the contents of this report in your next reply. Press the BACK button. Press Finish
i dont know why it keeps saying my antivirus is still enabled, i right click on the icon on the bottom right of my screen, then click disable all protections. i turn my firewall of to. is there another way to disable or what should i do ???
here's the log for the first step:
ComboFix 11-12-09.03 - HKH 12/09/2011 18:27:02.2.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3934.2390 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\HKH\Desktop\CFScript.txt
AV: Rising Antivirus *Enabled/Updated* {C0AEEC5C-BBDB-2745-3E22-21BEC65323A5}
FW: Rising Personal Firewall *Enabled* {F8956D79-F1B4-261D-157D-888B388064DE}
SP: Rising Antivirus *Enabled/Updated* {7BCF0DB8-9DE1-28CB-0492-1ACCBDD46918}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\assembly\tmp\U
c:\windows\SysWow64\Qq8n68.com
c:\windows\Tasks\At1.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At25.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At9.job
.
.
((((((((((((((((((((((((( Files Created from 2011-11-09 to 2011-12-09 )))))))))))))))))))))))))))))))
.
.
2011-12-09 23:34 . 2011-12-09 23:34 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\offreg.dll
2011-12-09 23:33 . 2011-12-09 23:37 ——– d—–w- c:\users\HKH\AppData\Local\temp
2011-12-09 23:33 . 2011-12-09 23:33 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-09 11:38 . 2011-12-08 14:25 8822856 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\mpengine.dll
2011-12-09 10:38 . 2011-12-09 10:38 388096 —-a-r- c:\users\HKH\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-09 10:38 . 2011-12-09 10:38 ——– d—–w- c:\program files (x86)\Trend Micro
2011-12-09 10:00 . 2011-12-09 10:00 ——– d—–w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2011-12-09 09:55 . 2011-12-09 09:55 ——– d—–w- c:\users\HKH\AppData\Local\PackageAware
2011-12-09 09:41 . 2011-12-09 09:41 ——– d—–w- c:\users\HKH\AppData\Roaming\5054
2011-12-08 23:33 . 2011-12-08 23:34 ——– d—–w- c:\users\HKH\AppData\Roaming\5053
2011-12-08 23:33 . 2011-12-09 10:23 ——– d—–w- c:\users\HKH\AppData\Roaming\UAs
2011-12-08 23:30 . 2011-12-09 21:36 ——– d—–w- c:\users\HKH\AppData\Roaming\xmldm
2011-12-08 23:29 . 2011-12-09 21:36 ——– d—–w- c:\users\HKH\AppData\Roaming\kock
2011-12-08 23:29 . 2011-12-08 23:29 ——– d—–w- c:\windows\Sun
2011-12-08 23:24 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Common Files\xing shared
2011-12-08 23:16 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Real
2011-12-08 14:08 . 2011-12-08 14:06 39576 —-a-w- c:\windows\system32\drivers\rfwarp.sys
2011-12-08 14:07 . 2011-12-08 14:06 19608 —-a-w- c:\windows\system32\drivers\rfwndis.sys
2011-12-08 14:03 . 2011-12-09 22:18 ——– d—–r- C:\RavBin
2011-12-08 14:03 . 2011-12-08 14:01 30360 ——w- c:\windows\system32\drivers\HookTdi.sys
2011-12-08 14:03 . 2011-12-08 14:01 317080 ——w- c:\windows\system32\RavExt64.dll
2011-12-08 14:03 . 2011-12-08 14:01 234648 ——w- c:\windows\SysWow64\ravext.dll
2011-12-08 14:03 . 2011-12-08 14:01 41048 ——w- c:\windows\system32\drivers\hvm.sys
2011-12-08 14:03 . 2011-12-08 14:01 239768 ——w- c:\windows\SysWow64\bsmain.exe
2011-12-08 14:03 . 2011-12-08 14:01 37016 ——w- c:\windows\system32\drivers\Hooksys.sys
2011-12-08 14:03 . 2011-12-08 14:01 27288 ——w- c:\windows\system32\drivers\HookHelp.sys
2011-12-08 14:02 . 2011-12-08 14:07 ——– d—–w- c:\program files (x86)\Rising
2011-12-08 14:02 . 2011-12-08 14:20 ——– d—–w- c:\programdata\Rising
2011-12-08 11:24 . 2011-07-29 16:08 375808 —-a-w- c:\windows\system32\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:01 293376 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:08 289792 —-a-w- c:\windows\system32\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:06 73216 —-a-w- c:\windows\system32\MSDvbNP.ax
2011-12-08 11:24 . 2011-07-29 16:06 100352 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:01 217088 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:00 69632 —-a-w- c:\windows\SysWow64\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:00 57856 —-a-w- c:\windows\SysWow64\MSDvbNP.ax
2011-12-08 11:22 . 2011-09-06 13:56 2764288 —-a-w- c:\windows\system32\win32k.sys
2011-12-08 11:22 . 2011-08-25 16:20 735744 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:19 847360 —-a-w- c:\windows\system32\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:19 332288 —-a-w- c:\windows\system32\oleacc.dll
2011-12-08 11:22 . 2011-08-25 16:15 555520 —-a-w- c:\windows\SysWow64\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:14 563712 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:14 238080 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-12-08 11:22 . 2011-08-25 13:54 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-12-08 11:22 . 2011-08-25 13:31 4096 —-a-w- c:\windows\SysWow64\oleaccrc.dll
2011-12-08 11:06 . 2011-12-08 11:06 ——– d—–w- c:\program files\Symantec
2011-12-08 11:03 . 2011-12-08 11:03 ——– d—–w- c:\program files (x86)\Norton AntiVirus(0)
2011-12-08 10:09 . 2011-12-08 10:09 ——– d—–w- c:\users\HKH\AppData\Local\Symantec
2011-11-20 23:05 . 2011-11-20 23:05 ——– d-sh–w- c:\programdata\KRSHistory
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 14:25 . 2010-03-25 01:57 270720 ——w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1} —-
.
2011-12-09 10:00 . 2011-12-09 10:00 700 —-a-w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.bitness.log
2011-12-09 10:00 . 2011-12-09 10:00 592 —-a-w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.weight.log
2011-12-09 10:00 . 2011-12-09 10:00 8722 —-a-w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.data.log
2011-12-09 10:00 . 2011-12-09 10:00 1380 —-a-w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.elements.log
.
—- Directory of c:\users\HKH\AppData\Roaming\5053 —-
.
2011-12-08 23:34 . 2011-12-09 09:41 350 —-a-w- c:\users\HKH\AppData\Roaming\5053\chrome.manifest
2011-12-08 23:34 . 2011-12-09 09:41 539 —-a-w- c:\users\HKH\AppData\Roaming\5053\install.rdf
2011-12-08 23:34 . 2011-12-09 09:41 237568 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF8.dll
2011-12-08 23:33 . 2011-12-09 09:41 237568 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF7.dll
2011-12-08 23:33 . 2011-12-09 09:41 266240 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF6.dll
2011-12-08 23:33 . 2011-12-09 09:41 266240 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF5.dll
2011-12-08 23:33 . 2011-12-09 09:41 245760 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF0.dll
2011-12-08 23:33 . 2011-12-08 23:33 77 —-a-w- c:\users\HKH\AppData\Roaming\5053\components00\AcroFF.txt
.
—- Directory of c:\users\HKH\AppData\Roaming\5054 —-
.
2011-12-09 09:41 . 2011-12-09 22:29 350 —-a-w- c:\users\HKH\AppData\Roaming\5054\chrome.manifest
2011-12-09 09:41 . 2011-12-09 22:29 539 —-a-w- c:\users\HKH\AppData\Roaming\5054\install.rdf
2011-12-09 09:41 . 2011-12-09 22:29 237568 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF0548.dll
2011-12-09 09:41 . 2011-12-09 22:29 237568 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF0547.dll
2011-12-09 09:41 . 2011-12-09 22:29 266240 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF0546.dll
2011-12-09 09:41 . 2011-12-09 22:29 266240 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF0545.dll
2011-12-09 09:41 . 2011-12-09 22:29 233472 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF0540.dll
2011-12-09 09:41 . 2011-12-09 09:41 77 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF.txt
2011-12-09 09:41 . 2011-12-09 09:41 1326032 —-a-w- c:\users\HKH\AppData\Roaming\5054\components\AcroFF054.dll
.
—- Directory of c:\users\HKH\AppData\Roaming\kock —-
.
2011-12-09 21:36 . 2011-12-09 21:35 661 —-a-w- c:\users\HKH\AppData\Roaming\kock\VA91CQQF.txt
2011-12-09 21:36 . 2011-12-09 21:33 911 —-a-w- c:\users\HKH\AppData\Roaming\kock\R7E2Z5PG.txt
2011-12-09 21:36 . 2011-12-09 21:35 539 —-a-w- c:\users\HKH\AppData\Roaming\kock\M4M5K316.txt
2011-12-09 21:31 . 2011-12-09 21:30 659 —-a-w- c:\users\HKH\AppData\Roaming\kock\TRQ9OAMY.txt
2011-12-09 21:31 . 2011-12-09 21:31 539 —-a-w- c:\users\HKH\AppData\Roaming\kock\NDFDX2PF.txt
2011-12-09 21:31 . 2011-12-09 21:30 830 —-a-w- c:\users\HKH\AppData\Roaming\kock\IVKZEC5N.txt
2011-12-09 21:26 . 2011-12-09 21:25 658 —-a-w- c:\users\HKH\AppData\Roaming\kock\XQRISP5B.txt
2011-12-09 21:26 . 2011-12-09 21:22 787 —-a-w- c:\users\HKH\AppData\Roaming\kock\WYDP0ALZ.txt
2011-12-09 21:26 . 2011-12-09 21:25 534 —-a-w- c:\users\HKH\AppData\Roaming\kock\02PP7X18.txt
2011-12-09 21:21 . 2011-12-09 21:20 538 —-a-w- c:\users\HKH\AppData\Roaming\kock\ZDEFDPTV.txt
2011-12-09 21:16 . 2011-12-09 21:13 660 —-a-w- c:\users\HKH\AppData\Roaming\kock\XI0DLDYX.txt
2011-12-09 21:16 . 2011-12-09 21:13 766 —-a-w- c:\users\HKH\AppData\Roaming\kock\ULDRGVV0.txt
2011-12-09 21:16 . 2011-12-09 21:13 538 —-a-w- c:\users\HKH\AppData\Roaming\kock\M7ECSJTI.txt
2011-12-09 21:11 . 2011-12-09 21:08 920 —-a-w- c:\users\HKH\AppData\Roaming\kock\ZV01C58A.txt
2011-12-09 21:11 . 2011-12-09 21:08 657 —-a-w- c:\users\HKH\AppData\Roaming\kock\Z3W1JNCX.txt
2011-12-09 21:11 . 2011-12-09 21:08 538 —-a-w- c:\users\HKH\AppData\Roaming\kock\RD7MFBYC.txt
2011-12-09 15:35 . 2011-12-09 09:30 916 —-a-w- c:\users\HKH\AppData\Roaming\kock\WZS3C87N.txt
2011-12-09 00:00 . 2010-11-20 02:04 130 —-a-w- c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
2011-12-09 00:00 . 2010-12-15 05:13 411 —-a-w- c:\users\HKH\AppData\Roaming\kock\hkh@interclick[1].txt
2011-12-09 00:00 . 2010-12-15 05:19 1425 —-a-w- c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
2011-12-08 23:35 . 2010-06-08 02:37 83 —-a-w- c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
2011-12-08 23:35 . 2010-07-13 06:09 127 —-a-w- c:\users\HKH\AppData\Roaming\kock\hkh@undertone[1].txt
2011-12-08 23:35 . 2010-06-08 03:42 771 —-a-w- c:\users\HKH\AppData\Roaming\kock\hkh@popularmechanics[1].txt
2011-12-08 23:35 . 2010-05-17 04:08 94 —-a-w- c:\users\HKH\AppData\Roaming\kock\hkh@etrade[1].txt
2011-12-08 23:35 . 2010-07-13 06:18 479 —-a-w- c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
.
—- Directory of c:\users\HKH\AppData\Roaming\UAs —-
.
2011-12-09 10:23 . 2011-12-09 10:23 8 —-a-w- c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs004.dat
2011-12-09 10:22 . 2011-12-09 10:22 12 —-a-w- c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs003.dat
2011-12-09 10:22 . 2011-12-09 10:22 7 —-a-w- c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs002.dat
2011-12-09 10:22 . 2011-12-09 10:22 24 —-a-w- c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs001.dat
2011-12-09 09:54 . 2011-12-09 09:54 8 —-a-w- c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs003.dat
2011-12-09 04:19 . 2011-12-09 04:19 74 —-a-w- c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs002.dat
2011-12-08 23:33 . 2011-12-08 23:33 163 —-a-w- c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs001.dat
.
—- Directory of c:\users\HKH\AppData\Roaming\xmldm —-
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-09_22.33.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 02:23 . 2011-12-09 23:37 59566 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:45 . 2011-12-09 23:37 82890 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-24 12:38 . 2011-12-09 23:37 15472 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1585305583-3439637140-3271800917-1000_UserData.bin
+ 2011-12-09 23:34 . 2011-12-09 23:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-09 23:34 . 2011-12-09 23:34 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-01-21 03:20 . 2011-12-09 22:31 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-09 22:40 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-09 22:40 104170 c:\windows\system32\perfc009.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 104170 c:\windows\system32\perfc009.dat
+ 2011-02-16 09:57 . 2011-12-09 23:33 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-02-16 09:57 . 2011-12-09 22:30 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-04-21 08:08 . 2011-12-09 22:30 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
+ 2011-04-21 08:08 . 2011-12-09 23:33 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-21 03:20 . 2011-12-09 22:31 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-01-21 03:20 . 2011-12-09 22:31 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-24 12:28 . 2011-12-09 23:33 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2010-03-24 12:28 . 2011-12-09 22:30 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-05-19 432640]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-09 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"NDSTray.exe"="NDSTray.exe" [BU]
"PCMAgent"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
"CLMLServer"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-08-14 417792]
"nmctxth"="c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files (x86)\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"RFWTRAY"="c:\program files (x86)\Rising\RFW\RSTRAY.EXE" [2011-12-08 178840]
"RavTRAY"="c:\program files (x86)\Rising\RAV\RSTRAY.EXE" [2011-12-08 178840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-12-08 296056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TOSHIBA Face Recognition Watcher.lnk - c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2008-8-25 126464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 bsmain
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i64.sys [x]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n64.sys [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 hooksys;hooksys;c:\windows\system32\drivers\Hooksys.sys [x]
S1 HookTdi;HookTdi;c:\windows\system32\drivers\HookTdi.sys [x]
S1 HyperVM;HyperVM;c:\windows\system32\drivers\hvm.sys [x]
S1 RFWNDIS;Rising RfwNdis Driver;c:\windows\system32\DRIVERS\rfwndis.sys [x]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-03-06 20376]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [x]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2008-06-28 36864]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2008-07-11 40960]
S2 RFWARP;Rising RfwARP Driver;c:\windows\system32\DRIVERS\rfwarp.sys [x]
S2 rfwtdi;rfwtdi;c:\program files (x86)\Rising\RFW\rfwtdi.sys [2011-12-08 31896]
S2 rsfwdrv;rsfwdrv;c:\program files (x86)\Rising\RFW\rsfwdrv.sys [2011-12-08 74904]
S2 RsMgrSvc;Rsd Service;c:\program files (x86)\Rising\RSD\RsMgrSvc.exe [2011-12-08 150168]
S2 RsRavMon;Rav Service;c:\program files (x86)\Rising\RAV\RavMonD.exe [2011-12-08 264448]
S2 RsRFWMon;RFW Service;c:\program files (x86)\Rising\RFW\RavMonD.exe [2011-12-08 264448]
S2 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2008-08-04 46392]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-07-17 139776]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;c:\windows\system32\DRIVERS\NETw5v64.sys [x]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 89600]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
2011-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-13 151064]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-13 209432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-13 181784]
"RtHDVCpl"="RAVCpl64.exe" [2008-08-21 6456864]
"Skytel"="Skytel.exe" [2008-08-21 1833504]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2008-09-03 885248]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-15 1573160]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/?pc=BNHP
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Download all by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: ???????? - c:\flashget network\FlashGet Mini\GetUrl.htm
IE: ???????????? - c:\flashget network\FlashGet Mini\GetAllUrl.htm
TCP: DhcpNameServer = [removed] [removed] 192.168.1.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\HKH\AppData\Roaming\Mozilla\Firefox\Profiles\spxadzo6.default\
FF - prefs.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=
FF - user.js: browser.search.order.1 - Search
FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files (x86)\Toshiba\ConfigFree\NDSTray.exe
c:\program files (x86)\Toshiba\ConfigFree\CFSwMgr.exe
.
**************************************************************************
.
Completion time: 2011-12-09 18:42:48 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-09 23:42
ComboFix2.txt 2011-12-09 22:40
.
Pre-Run: 263,072,251,904 bytes free
Post-Run: 262,860,181,504 bytes free
.
- - End Of File - - D3CE7AB8811C7E87988BBE5D16CD00A2
Upload was successful
Hi
I'm not familiar with that AntiVirus product at all, there is probably a user interface where you can suspend the protection module
please continue on with the Malwarebytes and ESET scan, then there are a few more leftover files we will need to script out
MBAM:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Database version: 8345
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005
12/9/2011 7:17:01 PM
mbam-log-2011-12-09 (19-17-01).txt
Scan type: Quick scan
Objects scanned: 176052
Time elapsed: 1 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\HKH\downloads\f0recast-1.1.exe (VirTool.DelfInject) -> Quarantined and deleted successfully.
and heres the last step, the ESETSCAN:
C:\Qoobox\Quarantine\[4]-Submit_2011-12-09_18.26.17.zip a variant of Win32/Kryptik.WXT trojan
C:\Qoobox\Quarantine\C\ProgramData\AppleVerifierUpdate.dll.vir a variant of Win32/Kryptik.VUP trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Local\Apple\AppleUpdate\Appleup.dll.vir a variant of Win32/Injector.LGI trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Local\Apple Computer\AppleUpdate\Appleup.dll.vir a variant of Win32/Injector.LGI trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Local\cache\cacheUpdate\cacheup.dll.vir a variant of Win32/Injector.LGI trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Local\Lexar Media\LexarUpdate\Lexarup.dll.vir a variant of Win32/Injector.LGI trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Roaming\AcroIEHelpe060.dll.vir a variant of Win32/Spy.Banker.WYC trojan
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Roaming\Firefox.exe.vir Win32/Adware.WinAntiVirus.AD application
C:\Qoobox\Quarantine\C\Users\HKH\AppData\Roaming\java.exe.vir Win32/Adware.WinAntiVirus.AD application
C:\Qoobox\Quarantine\C\Windows\svcs.exe.vir probably a variant of Win32/Spy.KeyLogger.LFJNMOG trojan
C:\Qoobox\Quarantine\C\Windows\SysWOW64\FastUserSwitchingCompatibilityex.dll.vir a variant of Win32/Routmo.N trojan
C:\Qoobox\Quarantine\C\Windows\SysWOW64\Qq8n68.com.vir a variant of Win32/Kryptik.WXT trojan
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF0.dll Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF5.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF6.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF7.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF8.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF054.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF0540.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF0545.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF0546.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF0547.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\AppData\Roaming\5054\components\AcroFF0548.dll a variant of Win32/Spy.Banker.WZJ trojan
C:\Users\HKH\Downloads\registrybooster.exe Win32/RegistryBooster application
C:\Users\HKH\Downloads\Spydig_Setup.exe multiple threats
Caution: you have been infected with the following: Win32/Spy.Banker.WZJ trojan which is specifically designed to steal passwords and other sensitive information. If you have used this computer for any financial transactions while infected, then you should notify your financial institutions to put a watch on your accounts. Change all your online passwords from a machine that has never been infected. While this machine may appear to be clean once all the infected files are deleted, there can be no guarantees, you might want to reconsider a reformat.
Please do the following:
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Copy/paste the text inside the Codebox below into notepad:
Here's how to do that:
Click
Start > Run type
Notepad click
OK.
This will open an empty notepad file:
Copy all the text
inside of the code box -
Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/index.php?showtopic=121494&st=15&#entry762255
Collect::
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF0.dll
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF5.dll
C:\Users\HKH\AppData\Roaming\5053\components00\AcroFF6.dll
Folder::
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
c:\users\HKH\AppData\Roaming\5054
c:\users\HKH\AppData\Roaming\5053
c:\users\HKH\AppData\Roaming\UAs
c:\users\HKH\AppData\Roaming\xmldm
c:\users\HKH\AppData\Roaming\kock
ClearJavaCache::
Now
paste the copied text into the open notepad - press
CTRL+V (or right click and choose 'paste')
Here's how to do that:
1.Click
File ;
2.Click
Save As … Change the directory to your
desktop ;
3.Change the
Save as type to
"All Files";
4.Type in the file name:
CFScript
5.Click
Save …
[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix may request an update; please allow it. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
NEXT
Please rerun the aswMBR scan and advise if there are any outstanding issues
okay i have no idea how to fully disable my AntiVirus, i tried disabling and then going to process and ending anything that has to do with it. If you have any suggestions let me know please. should i just reformat it ?
ComboFix 11-12-09.04 - HKH 12/09/2011 23:46:53.3.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3934.2203 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\HKH\Desktop\CFScript.txt
AV: Rising Antivirus *Enabled/Updated* {C0AEEC5C-BBDB-2745-3E22-21BEC65323A5}
FW: Rising Personal Firewall *Enabled* {F8956D79-F1B4-261D-157D-888B388064DE}
SP: Rising Antivirus *Enabled/Updated* {7BCF0DB8-9DE1-28CB-0492-1ACCBDD46918}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.bitness.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.data.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.elements.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.weight.log
c:\users\HKH\AppData\Roaming\5053
c:\users\HKH\AppData\Roaming\5053\chrome.manifest
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF.txt
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF0.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF5.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF6.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF7.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF8.dll
c:\users\HKH\AppData\Roaming\5053\install.rdf
c:\users\HKH\AppData\Roaming\5054
c:\users\HKH\AppData\Roaming\5054\chrome.manifest
c:\users\HKH\AppData\Roaming\5054\components\AcroFF.txt
c:\users\HKH\AppData\Roaming\5054\components\AcroFF054.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0540.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0545.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0546.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0547.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0548.dll
c:\users\HKH\AppData\Roaming\5054\install.rdf
c:\users\HKH\AppData\Roaming\kock
c:\users\HKH\AppData\Roaming\kock\02PP7X18.txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@etrade[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@interclick[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@popularmechanics[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@undertone[1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\IVKZEC5N.txt
c:\users\HKH\AppData\Roaming\kock\M4M5K316.txt
c:\users\HKH\AppData\Roaming\kock\M7ECSJTI.txt
c:\users\HKH\AppData\Roaming\kock\NDFDX2PF.txt
c:\users\HKH\AppData\Roaming\kock\R7E2Z5PG.txt
c:\users\HKH\AppData\Roaming\kock\RD7MFBYC.txt
c:\users\HKH\AppData\Roaming\kock\TRQ9OAMY.txt
c:\users\HKH\AppData\Roaming\kock\ULDRGVV0.txt
c:\users\HKH\AppData\Roaming\kock\VA91CQQF.txt
c:\users\HKH\AppData\Roaming\kock\WYDP0ALZ.txt
c:\users\HKH\AppData\Roaming\kock\WZS3C87N.txt
c:\users\HKH\AppData\Roaming\kock\XI0DLDYX.txt
c:\users\HKH\AppData\Roaming\kock\XQRISP5B.txt
c:\users\HKH\AppData\Roaming\kock\Z3W1JNCX.txt
c:\users\HKH\AppData\Roaming\kock\ZDEFDPTV.txt
c:\users\HKH\AppData\Roaming\kock\ZV01C58A.txt
c:\users\HKH\AppData\Roaming\UAs
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs001.dat
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs002.dat
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs003.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs001.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs002.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs003.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs004.dat
c:\users\HKH\AppData\Roaming\xmldm
.
.
((((((((((((((((((((((((( Files Created from 2011-11-10 to 2011-12-10 )))))))))))))))))))))))))))))))
.
.
2011-12-10 04:55 . 2011-12-10 04:55 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\offreg.dll
2011-12-10 04:53 . 2011-12-10 05:04 ——– d—–w- c:\users\HKH\AppData\Local\temp
2011-12-10 04:53 . 2011-12-10 04:53 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-10 01:47 . 2011-12-10 01:47 ——– d—–w- c:\program files (x86)\ESET
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\users\HKH\AppData\Roaming\Malwarebytes
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\programdata\Malwarebytes
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-10 00:10 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-09 11:38 . 2011-12-08 14:25 8822856 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\mpengine.dll
2011-12-09 10:38 . 2011-12-09 10:38 388096 —-a-r- c:\users\HKH\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-09 10:38 . 2011-12-09 10:38 ——– d—–w- c:\program files (x86)\Trend Micro
2011-12-09 09:55 . 2011-12-09 09:55 ——– d—–w- c:\users\HKH\AppData\Local\PackageAware
2011-12-08 23:29 . 2011-12-08 23:29 ——– d—–w- c:\windows\Sun
2011-12-08 23:24 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Common Files\xing shared
2011-12-08 23:16 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Real
2011-12-08 14:08 . 2011-12-08 14:06 39576 —-a-w- c:\windows\system32\drivers\rfwarp.sys
2011-12-08 14:07 . 2011-12-08 14:06 19608 —-a-w- c:\windows\system32\drivers\rfwndis.sys
2011-12-08 14:03 . 2011-12-09 22:18 ——– d—–r- C:\RavBin
2011-12-08 14:03 . 2011-12-08 14:01 30360 ——w- c:\windows\system32\drivers\HookTdi.sys
2011-12-08 14:03 . 2011-12-08 14:01 317080 ——w- c:\windows\system32\RavExt64.dll
2011-12-08 14:03 . 2011-12-08 14:01 234648 ——w- c:\windows\SysWow64\ravext.dll
2011-12-08 14:03 . 2011-12-08 14:01 41048 ——w- c:\windows\system32\drivers\hvm.sys
2011-12-08 14:03 . 2011-12-08 14:01 239768 ——w- c:\windows\SysWow64\bsmain.exe
2011-12-08 14:03 . 2011-12-08 14:01 37016 ——w- c:\windows\system32\drivers\Hooksys.sys
2011-12-08 14:03 . 2011-12-08 14:01 27288 ——w- c:\windows\system32\drivers\HookHelp.sys
2011-12-08 14:02 . 2011-12-08 14:07 ——– d—–w- c:\program files (x86)\Rising
2011-12-08 14:02 . 2011-12-08 14:20 ——– d—–w- c:\programdata\Rising
2011-12-08 11:24 . 2011-07-29 16:08 375808 —-a-w- c:\windows\system32\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:01 293376 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:08 289792 —-a-w- c:\windows\system32\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:06 73216 —-a-w- c:\windows\system32\MSDvbNP.ax
2011-12-08 11:24 . 2011-07-29 16:06 100352 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:01 217088 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:00 69632 —-a-w- c:\windows\SysWow64\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:00 57856 —-a-w- c:\windows\SysWow64\MSDvbNP.ax
2011-12-08 11:22 . 2011-09-06 13:56 2764288 —-a-w- c:\windows\system32\win32k.sys
2011-12-08 11:22 . 2011-08-25 16:20 735744 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:19 847360 —-a-w- c:\windows\system32\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:19 332288 —-a-w- c:\windows\system32\oleacc.dll
2011-12-08 11:22 . 2011-08-25 16:15 555520 —-a-w- c:\windows\SysWow64\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:14 563712 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:14 238080 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-12-08 11:22 . 2011-08-25 13:54 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-12-08 11:22 . 2011-08-25 13:31 4096 —-a-w- c:\windows\SysWow64\oleaccrc.dll
2011-12-08 11:06 . 2011-12-08 11:06 ——– d—–w- c:\program files\Symantec
2011-12-08 11:03 . 2011-12-08 11:03 ——– d—–w- c:\program files (x86)\Norton AntiVirus(0)
2011-12-08 10:09 . 2011-12-08 10:09 ——– d—–w- c:\users\HKH\AppData\Local\Symantec
2011-11-20 23:05 . 2011-11-20 23:05 ——– d-sh–w- c:\programdata\KRSHistory
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 14:25 . 2010-03-25 01:57 270720 ——w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-09_22.33.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 02:23 . 2011-12-10 01:07 59982 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:45 . 2011-12-10 01:07 83088 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-24 12:38 . 2011-12-10 01:07 15472 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1585305583-3439637140-3271800917-1000_UserData.bin
+ 2010-04-20 03:12 . 2011-12-10 04:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-20 03:12 . 2011-12-10 04:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-20 03:12 . 2011-12-10 04:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-10 04:55 . 2011-12-10 04:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-12-10 04:55 . 2011-12-10 04:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-10 05:03 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-10 05:03 104170 c:\windows\system32\perfc009.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 104170 c:\windows\system32\perfc009.dat
- 2011-02-16 09:57 . 2011-12-09 22:30 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-16 09:57 . 2011-12-10 04:54 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-04-21 08:08 . 2011-12-09 22:30 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
+ 2011-04-21 08:08 . 2011-12-10 04:54 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-24 12:28 . 2011-12-09 22:30 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2010-03-24 12:28 . 2011-12-10 04:54 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-05-19 432640]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-09 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"NDSTray.exe"="NDSTray.exe" [BU]
"PCMAgent"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
"CLMLServer"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-08-14 417792]
"nmctxth"="c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files (x86)\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"RFWTRAY"="c:\program files (x86)\Rising\RFW\RSTRAY.EXE" [2011-12-08 178840]
"RavTRAY"="c:\program files (x86)\Rising\RAV\RSTRAY.EXE" [2011-12-08 178840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-12-08 296056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TOSHIBA Face Recognition Watcher.lnk - c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2008-8-25 126464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 bsmain
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i64.sys [x]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n64.sys [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 hooksys;hooksys;c:\windows\system32\drivers\Hooksys.sys [x]
S1 HookTdi;HookTdi;c:\windows\system32\drivers\HookTdi.sys [x]
S1 HyperVM;HyperVM;c:\windows\system32\drivers\hvm.sys [x]
S1 RFWNDIS;Rising RfwNdis Driver;c:\windows\system32\DRIVERS\rfwndis.sys [x]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-03-06 20376]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [x]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2008-06-28 36864]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2008-07-11 40960]
S2 RFWARP;Rising RfwARP Driver;c:\windows\system32\DRIVERS\rfwarp.sys [x]
S2 rfwtdi;rfwtdi;c:\program files (x86)\Rising\RFW\rfwtdi.sys [2011-12-08 31896]
S2 rsfwdrv;rsfwdrv;c:\program files (x86)\Rising\RFW\rsfwdrv.sys [2011-12-08 74904]
S2 RsMgrSvc;Rsd Service;c:\program files (x86)\Rising\RSD\RsMgrSvc.exe [2011-12-08 150168]
S2 RsRavMon;Rav Service;c:\program files (x86)\Rising\RAV\RavMonD.exe [2011-12-08 264448]
S2 RsRFWMon;RFW Service;c:\program files (x86)\Rising\RFW\RavMonD.exe [2011-12-08 264448]
S2 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2008-08-04 46392]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-07-17 139776]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;c:\windows\system32\DRIVERS\NETw5v64.sys [x]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 89600]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-13 151064]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-13 209432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-13 181784]
"RtHDVCpl"="RAVCpl64.exe" [2008-08-21 6456864]
"Skytel"="Skytel.exe" [2008-08-21 1833504]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2008-09-03 885248]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-15 1573160]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/?pc=BNHP
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Download all by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: ???????? - c:\flashget network\FlashGet Mini\GetUrl.htm
IE: ???????????? - c:\flashget network\FlashGet Mini\GetAllUrl.htm
TCP: DhcpNameServer = [removed] [removed] 192.168.1.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\HKH\AppData\Roaming\Mozilla\Firefox\Profiles\spxadzo6.default\
FF - prefs.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s;=
FF - user.js: browser.search.order.1 - Search
FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s;=
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files (x86)\Toshiba\ConfigFree\NDSTray.exe
.
**************************************************************************
.
Completion time: 2011-12-10 00:07:11 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-10 05:07
ComboFix2.txt 2011-12-09 23:43
ComboFix3.txt 2011-12-09 22:40
.
Pre-Run: 261,891,325,952 bytes free
Post-Run: 262,018,461,696 bytes free
.
- - End Of File - - DCF4E7AD137B968EBDF70C39E90588C3
Upload was successful
aswMBR scan came up clean! no infections. do you want the log ?
yes, please, if you could please post the logADOBE NEXT [external image: Posted Image] Your Java is out of date. Java™ 6 Update 24 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now .
okay adobe done and java done. here's the MBR scan log:
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-12-10 17:49:31
—————————–
17:49:31.246 OS Version: Windows x64 6.0.6002 Service Pack 2
17:49:31.246 Number of processors: 2 586 0x1706
17:49:31.246 ComputerName: HKH-PC UserName: HKH
17:49:33.325 Initialize success
17:49:37.144 AVAST engine defs: 11120901
17:49:43.325 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
17:49:43.329 Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
17:49:43.376 Disk 0 MBR read successfully
17:49:43.379 Disk 0 MBR scan
17:49:43.382 Disk 0 Windows VISTA default MBR code
17:49:43.396 Service scanning
17:49:44.895 Modules scanning
17:49:44.898 Disk 0 trace - called modules:
17:49:44.957 ntoskrnl.exe CLASSPNP.SYS disk.sys thpdrv.sys
17:49:44.960 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004d22300]
17:49:44.963 3 CLASSPNP.SYS[fffffa6000fd0c33] -> nt!IofCallDriver -> \Device\THPDRV[0xfffffa800664e700]
17:49:46.660 AVAST engine scan C:\Windows
17:50:20.083 AVAST engine scan C:\Windows\system32
17:54:05.576 AVAST engine scan C:\Windows\system32\drivers
17:54:16.977 AVAST engine scan C:\Users\HKH
18:10:11.168 AVAST engine scan C:\ProgramData
18:12:05.079 Scan finished successfully
18:13:35.538 Disk 0 MBR has been saved successfully to "C:\Users\HKH\Desktop\MBR.dat"
18:13:35.544 The log file has been saved successfully to "C:\Users\HKH\Desktop\aswMBR3.txt"
laptops running smooth, cpu usage wayyy down(3-15% range) and the browser redirect has stopped also!!!! yay!
but are the viruses or malware or spyware gone ?
what free AntiVirus and firewall and that good stuff do you recommend ?
ComboFix 11-12-09.04 - HKH 12/09/2011 23:46:53.3.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3934.2203 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\HKH\Desktop\CFScript.txt
AV: Rising Antivirus *Enabled/Updated* {C0AEEC5C-BBDB-2745-3E22-21BEC65323A5}
FW: Rising Personal Firewall *Enabled* {F8956D79-F1B4-261D-157D-888B388064DE}
SP: Rising Antivirus *Enabled/Updated* {7BCF0DB8-9DE1-28CB-0492-1ACCBDD46918}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.bitness.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.data.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.elements.log
c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}.native.weight.log
c:\users\HKH\AppData\Roaming\5053
c:\users\HKH\AppData\Roaming\5053\chrome.manifest
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF.txt
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF0.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF5.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF6.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF7.dll
c:\users\HKH\AppData\Roaming\5053\components00\AcroFF8.dll
c:\users\HKH\AppData\Roaming\5053\install.rdf
c:\users\HKH\AppData\Roaming\5054
c:\users\HKH\AppData\Roaming\5054\chrome.manifest
c:\users\HKH\AppData\Roaming\5054\components\AcroFF.txt
c:\users\HKH\AppData\Roaming\5054\components\AcroFF054.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0540.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0545.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0546.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0547.dll
c:\users\HKH\AppData\Roaming\5054\components\AcroFF0548.dll
c:\users\HKH\AppData\Roaming\5054\install.rdf
c:\users\HKH\AppData\Roaming\kock
c:\users\HKH\AppData\Roaming\kock\02PP7X18.txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@etrade[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@interclick[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@popularmechanics[1].txt
c:\users\HKH\AppData\Roaming\kock\hkh@undertone[1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\[removed][1].txt
c:\users\HKH\AppData\Roaming\kock\IVKZEC5N.txt
c:\users\HKH\AppData\Roaming\kock\M4M5K316.txt
c:\users\HKH\AppData\Roaming\kock\M7ECSJTI.txt
c:\users\HKH\AppData\Roaming\kock\NDFDX2PF.txt
c:\users\HKH\AppData\Roaming\kock\R7E2Z5PG.txt
c:\users\HKH\AppData\Roaming\kock\RD7MFBYC.txt
c:\users\HKH\AppData\Roaming\kock\TRQ9OAMY.txt
c:\users\HKH\AppData\Roaming\kock\ULDRGVV0.txt
c:\users\HKH\AppData\Roaming\kock\VA91CQQF.txt
c:\users\HKH\AppData\Roaming\kock\WYDP0ALZ.txt
c:\users\HKH\AppData\Roaming\kock\WZS3C87N.txt
c:\users\HKH\AppData\Roaming\kock\XI0DLDYX.txt
c:\users\HKH\AppData\Roaming\kock\XQRISP5B.txt
c:\users\HKH\AppData\Roaming\kock\Z3W1JNCX.txt
c:\users\HKH\AppData\Roaming\kock\ZDEFDPTV.txt
c:\users\HKH\AppData\Roaming\kock\ZV01C58A.txt
c:\users\HKH\AppData\Roaming\UAs
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs001.dat
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs002.dat
c:\users\HKH\AppData\Roaming\UAs\firefox.exe_UAs003.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs001.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs002.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs003.dat
c:\users\HKH\AppData\Roaming\UAs\iexplore.exe_UAs004.dat
c:\users\HKH\AppData\Roaming\xmldm
.
.
((((((((((((((((((((((((( Files Created from 2011-11-10 to 2011-12-10 )))))))))))))))))))))))))))))))
.
.
2011-12-10 04:55 . 2011-12-10 04:55 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\offreg.dll
2011-12-10 04:53 . 2011-12-10 05:04 ——– d—–w- c:\users\HKH\AppData\Local\temp
2011-12-10 04:53 . 2011-12-10 04:53 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-10 01:47 . 2011-12-10 01:47 ——– d—–w- c:\program files (x86)\ESET
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\users\HKH\AppData\Roaming\Malwarebytes
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\programdata\Malwarebytes
2011-12-10 00:10 . 2011-12-10 00:10 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-10 00:10 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-09 11:38 . 2011-12-08 14:25 8822856 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EB25D7B5-0CCC-461A-BE9F-03913AF1EDBF}\mpengine.dll
2011-12-09 10:38 . 2011-12-09 10:38 388096 —-a-r- c:\users\HKH\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-09 10:38 . 2011-12-09 10:38 ——– d—–w- c:\program files (x86)\Trend Micro
2011-12-09 09:55 . 2011-12-09 09:55 ——– d—–w- c:\users\HKH\AppData\Local\PackageAware
2011-12-08 23:29 . 2011-12-08 23:29 ——– d—–w- c:\windows\Sun
2011-12-08 23:24 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Common Files\xing shared
2011-12-08 23:16 . 2011-12-08 23:24 ——– d—–w- c:\program files (x86)\Real
2011-12-08 14:08 . 2011-12-08 14:06 39576 —-a-w- c:\windows\system32\drivers\rfwarp.sys
2011-12-08 14:07 . 2011-12-08 14:06 19608 —-a-w- c:\windows\system32\drivers\rfwndis.sys
2011-12-08 14:03 . 2011-12-09 22:18 ——– d—–r- C:\RavBin
2011-12-08 14:03 . 2011-12-08 14:01 30360 ——w- c:\windows\system32\drivers\HookTdi.sys
2011-12-08 14:03 . 2011-12-08 14:01 317080 ——w- c:\windows\system32\RavExt64.dll
2011-12-08 14:03 . 2011-12-08 14:01 234648 ——w- c:\windows\SysWow64\ravext.dll
2011-12-08 14:03 . 2011-12-08 14:01 41048 ——w- c:\windows\system32\drivers\hvm.sys
2011-12-08 14:03 . 2011-12-08 14:01 239768 ——w- c:\windows\SysWow64\bsmain.exe
2011-12-08 14:03 . 2011-12-08 14:01 37016 ——w- c:\windows\system32\drivers\Hooksys.sys
2011-12-08 14:03 . 2011-12-08 14:01 27288 ——w- c:\windows\system32\drivers\HookHelp.sys
2011-12-08 14:02 . 2011-12-08 14:07 ——– d—–w- c:\program files (x86)\Rising
2011-12-08 14:02 . 2011-12-08 14:20 ——– d—–w- c:\programdata\Rising
2011-12-08 11:24 . 2011-07-29 16:08 375808 —-a-w- c:\windows\system32\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:01 293376 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-12-08 11:24 . 2011-07-29 16:08 289792 —-a-w- c:\windows\system32\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:06 73216 —-a-w- c:\windows\system32\MSDvbNP.ax
2011-12-08 11:24 . 2011-07-29 16:06 100352 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:01 217088 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-12-08 11:24 . 2011-07-29 16:00 69632 —-a-w- c:\windows\SysWow64\Mpeg2Data.ax
2011-12-08 11:24 . 2011-07-29 16:00 57856 —-a-w- c:\windows\SysWow64\MSDvbNP.ax
2011-12-08 11:22 . 2011-09-06 13:56 2764288 —-a-w- c:\windows\system32\win32k.sys
2011-12-08 11:22 . 2011-08-25 16:20 735744 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:19 847360 —-a-w- c:\windows\system32\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:19 332288 —-a-w- c:\windows\system32\oleacc.dll
2011-12-08 11:22 . 2011-08-25 16:15 555520 —-a-w- c:\windows\SysWow64\UIAutomationCore.dll
2011-12-08 11:22 . 2011-08-25 16:14 563712 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-12-08 11:22 . 2011-08-25 16:14 238080 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-12-08 11:22 . 2011-08-25 13:54 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-12-08 11:22 . 2011-08-25 13:31 4096 —-a-w- c:\windows\SysWow64\oleaccrc.dll
2011-12-08 11:06 . 2011-12-08 11:06 ——– d—–w- c:\program files\Symantec
2011-12-08 11:03 . 2011-12-08 11:03 ——– d—–w- c:\program files (x86)\Norton AntiVirus(0)
2011-12-08 10:09 . 2011-12-08 10:09 ——– d—–w- c:\users\HKH\AppData\Local\Symantec
2011-11-20 23:05 . 2011-11-20 23:05 ——– d-sh–w- c:\programdata\KRSHistory
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 14:25 . 2010-03-25 01:57 270720 ——w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-09_22.33.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 02:23 . 2011-12-10 01:07 59982 c:\windows\system32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 15:45 . 2011-12-10 01:07 83088 c:\windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-24 12:38 . 2011-12-10 01:07 15472 c:\windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1585305583-3439637140-3271800917-1000_UserData.bin
+ 2010-04-20 03:12 . 2011-12-10 04:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-20 03:12 . 2011-12-10 04:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-04-20 03:12 . 2011-12-10 04:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-04-20 03:12 . 2011-09-25 10:43 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-12-10 04:55 . 2011-12-10 04:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-09 22:31 . 2011-12-09 22:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-12-10 04:55 . 2011-12-10 04:55 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 180224 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-10 05:03 604502 c:\windows\system32\perfh009.dat
+ 2006-11-02 12:46 . 2011-12-10 05:03 104170 c:\windows\system32\perfc009.dat
- 2006-11-02 12:46 . 2011-12-09 15:39 104170 c:\windows\system32\perfc009.dat
- 2011-02-16 09:57 . 2011-12-09 22:30 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-16 09:57 . 2011-12-10 04:54 383588 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-04-21 08:08 . 2011-12-09 22:30 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
+ 2011-04-21 08:08 . 2011-12-10 04:54 766900 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1585305583-3439637140-3271800917-1000-8192.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 2605056 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-21 03:20 . 2011-12-10 04:35 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-01-21 03:20 . 2011-12-09 22:27 1130496 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-24 12:28 . 2011-12-09 22:30 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2010-03-24 12:28 . 2011-12-10 04:54 1622680 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-05-19 432640]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-09 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"NDSTray.exe"="NDSTray.exe" [BU]
"PCMAgent"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe" [2007-12-14 143360]
"CLMLServer"="c:\program files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe" [2008-07-11 188416]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-08-14 417792]
"nmctxth"="c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files (x86)\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"RFWTRAY"="c:\program files (x86)\Rising\RFW\RSTRAY.EXE" [2011-12-08 178840]
"RavTRAY"="c:\program files (x86)\Rising\RAV\RSTRAY.EXE" [2011-12-08 178840]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-12-08 296056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TOSHIBA Face Recognition Watcher.lnk - c:\program files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2008-8-25 126464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0 bsmain
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 135664]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R4 KR10I64;KR10I64;c:\windows\system32\drivers\kr10i64.sys [x]
R4 KR10N64;KR10N64;c:\windows\system32\drivers\kr10n64.sys [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 hooksys;hooksys;c:\windows\system32\drivers\Hooksys.sys [x]
S1 HookTdi;HookTdi;c:\windows\system32\drivers\HookTdi.sys [x]
S1 HyperVM;HyperVM;c:\windows\system32\drivers\hvm.sys [x]
S1 RFWNDIS;Rising RfwNdis Driver;c:\windows\system32\DRIVERS\rfwndis.sys [x]
S2 atashost;WebEx Service Host for Support Center;c:\windows\SysWOW64\atashost.exe [2009-03-06 20376]
S2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [x]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2008-06-28 36864]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2008-07-11 40960]
S2 RFWARP;Rising RfwARP Driver;c:\windows\system32\DRIVERS\rfwarp.sys [x]
S2 rfwtdi;rfwtdi;c:\program files (x86)\Rising\RFW\rfwtdi.sys [2011-12-08 31896]
S2 rsfwdrv;rsfwdrv;c:\program files (x86)\Rising\RFW\rsfwdrv.sys [2011-12-08 74904]
S2 RsMgrSvc;Rsd Service;c:\program files (x86)\Rising\RSD\RsMgrSvc.exe [2011-12-08 150168]
S2 RsRavMon;Rav Service;c:\program files (x86)\Rising\RAV\RavMonD.exe [2011-12-08 264448]
S2 RsRFWMon;RFW Service;c:\program files (x86)\Rising\RFW\RavMonD.exe [2011-12-08 264448]
S2 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2008-08-04 46392]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-07-17 139776]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 NETw5v64;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 64 Bit ;c:\windows\system32\DRIVERS\NETw5v64.sys [x]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 89600]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-24 10:08]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-13 151064]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-13 209432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-13 181784]
"RtHDVCpl"="RAVCpl64.exe" [2008-08-21 6456864]
"Skytel"="Skytel.exe" [2008-08-21 1833504]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2008-09-03 885248]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2008-07-25 94208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-15 1573160]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/?pc=BNHP
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Download all by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\users\HKH\AppData\Roaming\FlashGetBHO\GetUrl.htm
IE: E&xport; to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: ???????? - c:\flashget network\FlashGet Mini\GetUrl.htm
IE: ???????????? - c:\flashget network\FlashGet Mini\GetAllUrl.htm
TCP: DhcpNameServer = [removed] [removed] 192.168.1.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\HKH\AppData\Roaming\Mozilla\Firefox\Profiles\spxadzo6.default\
FF - prefs.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s;=
FF - user.js: browser.search.order.1 - Search
FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s;=
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files (x86)\Toshiba\ConfigFree\NDSTray.exe
.
**************************************************************************
.
Completion time: 2011-12-10 00:07:11 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-10 05:07
ComboFix2.txt 2011-12-09 23:43
ComboFix3.txt 2011-12-09 22:40
.
Pre-Run: 261,891,325,952 bytes free
Post-Run: 262,018,461,696 bytes free
.
- - End Of File - - DCF4E7AD137B968EBDF70C39E90588C3
Upload was successful