What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ping.exe virus problems [Solved]

61 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Hi catherine,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:11E79CC9
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:4AA2F6A9
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:0C988F7D
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:58A2C544
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:1A5207FA
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:AAA06E15
@Alternate Data Stream - 241 bytes -> C:\ProgramData\TEMP:8AE92FD3
@Alternate Data Stream - 239 bytes -> C:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 238 bytes -> C:\ProgramData\TEMP:689E7F7D
@Alternate Data Stream - 237 bytes -> C:\ProgramData\TEMP:D667795F
@Alternate Data Stream - 234 bytes -> C:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 228 bytes -> C:\ProgramData\TEMP:D6D084A5
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:BEE39E9B
@Alternate Data Stream - 226 bytes -> C:\ProgramData\TEMP:7A032A04
@Alternate Data Stream - 225 bytes -> C:\ProgramData\TEMP:6F0B6A5A
@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:9033BDFB
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:D8134D8F
@Alternate Data Stream - 222 bytes -> C:\ProgramData\TEMP:3BF63E4A
@Alternate Data Stream - 219 bytes -> C:\ProgramData\TEMP:D2397415
@Alternate Data Stream - 218 bytes -> C:\ProgramData\TEMP:BCFEA004
@Alternate Data Stream - 217 bytes -> C:\ProgramData\TEMP:E87AB4E3
@Alternate Data Stream - 216 bytes -> C:\ProgramData\TEMP:A9056F42
@Alternate Data Stream - 215 bytes -> C:\ProgramData\TEMP:1ECED34B
@Alternate Data Stream - 212 bytes -> C:\ProgramData\TEMP:4F96D8E6
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:F072AFAF
@Alternate Data Stream - 210 bytes -> C:\ProgramData\TEMP:6677D85A
@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:E5D4F1EB
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:96AFAB10
@Alternate Data Stream - 207 bytes -> C:\ProgramData\TEMP:102394C6
@Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:6B50A605
@Alternate Data Stream - 205 bytes -> C:\ProgramData\TEMP:51F17BB8
@Alternate Data Stream - 204 bytes -> C:\ProgramData\TEMP:50636E35
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:8F4E260C
@Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:10D98D98
@Alternate Data Stream - 195 bytes -> C:\ProgramData\TEMP:B0B6888E
@Alternate Data Stream - 173 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 164 bytes -> C:\ProgramData\TEMP:FD7016C1
@Alternate Data Stream - 155 bytes -> C:\ProgramData\TEMP:402839DE
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:AECF4772
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:4A8EB1C4
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4C35C064
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:678C1866
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9812B773
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:378824DE
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0E67073E
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5E73E1C2
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:9F3CEEE6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:2AE74FF9
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5E9B629B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0A74923C
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:41289DF0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:2211E7A0
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:18A6D2CC
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:E6708F08
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:996104FC
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:D5BF78B4
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:1297FF3C
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:F81E7082
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:ED194880
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:D4D38596
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:943E8182
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:C0A9B815
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:8836A712
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:8DD20B4A
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:F422F8F1
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:ECC979BD
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:6C5EC3CD
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:F0A06891
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:E0888117
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:DD6F157A
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:D507AEDA
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:B42826C8
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:6017A808
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:331B76C7
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:3313A48D
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:969C0C96
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:6BF0805F
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:4A1628E5

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
———-

Now delete the copy of ComboFix that you have, download a fresh copy and run a new scan with that. :)
———-

In your next reply please post the logs created by OTL and the log created by ComboFix.
Post #47
OTL logfile created on: 12/19/2011 7:08:07 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\laptop\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.48 Gb Total Physical Memory | 1.90 Gb Available Physical Memory | 54.76% Memory free
6.96 Gb Paging File | 4.95 Gb Available in Paging File | 71.21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581.37 Gb Total Space | 477.56 Gb Free Space | 82.14% Space Free | Partition Type: NTFS

Computer Name: LAPTOP-PC | User Name: laptop | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\laptop\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\yui.dll ()
MOD - C:\Program Files (x86)\Yahoo!\Messenger\pcre.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (TOSHIBA eco Utility Service) – C:\Program Files\TOSHIBA\TECO\TecoService.exe (TOSHIBA Corporation)
SRV:64bit: - (TPCHSrv) – C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TosCoSrv) – C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TOSHIBA HDD SSD Alert Service) – C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (TODDSrv) – C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
SRV:64bit: - (GFNEXSrv) – C:\Windows\SysNative\GFNEXSrv.exe ()
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TMachInfo) – C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe (TOSHIBA Corporation)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (HPSLPSVC) – C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (Amazon Download Agent) – C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe (Amazon.com)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (NisDrv) – C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (PGEffect) – C:\Windows\SysNative\drivers\PGEffect.sys (TOSHIBA Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Tosrfusb) – C:\Windows\SysNative\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (BtFilter) – C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (tosrfec) – C:\Windows\SysNative\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (tdcmdpst) – C:\Windows\SysNative\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV:64bit: - (TVALZ) – C:\Windows\SysNative\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) – C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (StillCam) – C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (TVALZFL) – C:\Windows\SysNative\drivers\TVALZFL.sys (TOSHIBA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/12/17 12:12:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/11/30 12:08:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Components: C:\Program Files (x86)\SeaMonkey\components [2011/12/16 04:11:35 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.5\extensions\\Plugins: C:\Program Files (x86)\SeaMonkey\plugins

[2011/08/26 05:01:46 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Extensions
[2011/12/19 19:06:09 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions
[2011/08/27 16:43:38 | 000,000,000 | —D | M] (Ad blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/12/17 12:12:30 | 000,000,000 | —D | M] (BitDefender QuickScan) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/09/30 18:30:33 | 000,000,000 | —D | M] (Webmail Ad Blocker) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/10/07 21:02:14 | 000,000,000 | —D | M] (Read It Later) – C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\[removed]
[2011/12/16 04:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\laptop\AppData\Roaming\Mozilla\SeaMonkey\Profiles\bvn00hqz.default\extensions
[2011/12/19 19:06:09 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/12/14 00:54:27 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\LAPTOP\APPDATA\ROAMING\DISRUPTIVE INNOVATIONS SARL\BLUEGRIFFON\PROFILES\FIOLB7EX.DEFAULT\EXTENSIONS\[removed]
[2011/11/30 12:08:07 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/11 16:48:12 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2011/12/18 11:27:32 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (TOSHIBA Media Controller Plug-in) - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [Teco] C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosWaitSrv] C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe (Amazon.com)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - %SystemRoot%\System32\nwprovau.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - %SystemRoot%\System32\winrnr.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A0273F09-A733-49EC-9049-CD0F840D449E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C3B9C6DE-557E-4619-A4F6-39D3E6ECB09A}: DhcpNameServer = [removed] [removed]
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/19 19:02:54 | 000,000,000 | —D | C] – C:\_OTL
[2011/12/18 21:05:38 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 17:52:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Security Client
[2011/12/18 17:52:37 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/12/18 11:27:51 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/18 11:05:51 | 001,163,104 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/17 12:17:09 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\QuickScan
[2011/12/16 11:10:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2011/12/16 11:10:04 | 002,322,184 | —- | C] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/16 04:11:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SeaMonkey
[2011/12/16 04:11:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\SeaMonkey
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL
[2011/12/16 03:32:54 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Disruptive Innovations SARL
[2011/12/16 03:32:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueGriffon
[2011/12/16 03:32:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\BlueGriffon
[2011/12/16 02:47:06 | 000,000,000 | —D | C] – C:\ProgramData\Blumentals
[2011/12/16 00:44:42 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/15 15:12:11 | 000,518,144 | —- | C] (SteelWerX) – C:\windows\SWREG.exe
[2011/12/15 15:12:11 | 000,406,528 | —- | C] (SteelWerX) – C:\windows\SWSC.exe
[2011/12/15 15:12:11 | 000,060,416 | —- | C] (NirSoft) – C:\windows\NIRCMD.exe
[2011/12/15 15:11:45 | 000,000,000 | —D | C] – C:\windows\ERDNT
[2011/12/15 15:11:39 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/15 13:54:48 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\tdsskiller
[2011/12/15 13:47:31 | 000,000,000 | —D | C] – C:\Users\laptop\Desktop\gmer
[2011/12/13 22:46:39 | 000,000,000 | R–D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/13 22:46:07 | 000,607,260 | R— | C] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 18:01:15 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2011/12/13 18:00:29 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2011/12/13 17:50:16 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2011/12/13 17:49:48 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2011/12/13 14:45:38 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Malwarebytes
[2011/12/13 14:44:51 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/13 14:44:48 | 000,025,416 | —- | C] (Malwarebytes Corporation) – C:\windows\SysNative\drivers\mbam.sys
[2011/12/13 14:44:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/12/03 23:36:47 | 000,000,000 | —D | C] – C:\Program Files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition
[2011/12/03 18:49:57 | 000,000,000 | —D | C] – C:\ProgramData\Playrix Entertainment
[2011/12/03 18:33:20 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\My Games
[2011/12/03 17:42:59 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\MumboJumbo
[2011/12/03 17:21:27 | 000,000,000 | —D | C] – C:\ProgramData\TERMINAL Studio
[2011/12/03 12:45:35 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Local\Tific
[2011/12/03 11:17:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor Adventures
[2011/12/03 11:17:05 | 000,057,344 | —- | C] (Reflexive) – C:\windows\SysWow64\Big Kahuna Reef.scr
[2011/12/03 11:17:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef
[2011/12/03 11:02:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Double Play Jewel Quest 2 and 3
[2011/12/03 10:55:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\Royal Envoy
[2011/12/03 10:42:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift and the Mystery from Atlantis
[2011/12/03 10:26:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Big Kahuna Reef 2
[2011/12/03 10:25:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\The Rise Of Atlantis
[2011/12/03 10:23:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Sky Kingdoms
[2011/12/03 10:20:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Heroes Of Hellas
[2011/12/03 10:19:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Call Of Atlantis
[2011/12/03 10:13:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\Atlantis Quest
[2011/12/03 10:11:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor HD
[2011/12/03 10:10:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Samantha Swift Fountains of Fate
[2011/12/03 09:52:45 | 000,000,000 | —D | C] – C:\Users\laptop\Documents\Amazon Downloads
[2011/12/03 09:52:40 | 000,000,000 | —D | C] – C:\ProgramData\Amazon
[2011/12/03 09:52:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Users\Public\Documents\Amazon Games & Software
[2011/12/03 09:52:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Amazon
[2011/12/02 23:34:22 | 000,000,000 | —D | C] – C:\ProgramData\Fugazo
[2011/12/02 16:57:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mythic Pearls - The Legend of Tirnanog
[2011/12/02 16:53:49 | 000,000,000 | —D | C] – C:\ProgramData\Intenium
[2011/12/02 16:45:22 | 000,000,000 | —D | C] – C:\Program Files (x86)\Luxor - 5th Passage
[2011/11/30 12:10:59 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\OpenOffice.org
[2011/11/30 12:09:48 | 000,000,000 | –SD | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011/11/30 12:08:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\OpenOffice.org 3
[2011/11/30 12:08:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2011/11/30 12:08:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2011/11/30 11:31:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe
[2011/11/27 19:04:22 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Oberon Games
[2011/11/19 22:42:26 | 000,000,000 | —D | C] – C:\Users\laptop\AppData\Roaming\Fuzzy Games

========== Files - Modified Within 30 Days ==========

[2011/12/19 19:13:00 | 004,345,296 | —- | M] (Swearware) – C:\Users\laptop\Desktop\ComboFix.exe
[2011/12/19 19:12:19 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/19 19:12:19 | 000,024,400 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/19 19:11:21 | 000,688,904 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2011/12/19 19:11:21 | 000,596,860 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2011/12/19 19:11:21 | 000,097,834 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2011/12/19 19:04:33 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/12/19 19:04:27 | 2801,418,240 | -HS- | M] () – C:\hiberfil.sys
[2011/12/19 19:03:02 | 000,007,609 | —- | M] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/18 21:05:43 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\laptop\Desktop\OTL.exe
[2011/12/18 19:24:01 | 000,095,744 | —- | M] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 17:52:58 | 000,001,945 | —- | M] () – C:\windows\epplauncher.mif
[2011/12/18 17:52:47 | 000,702,750 | —- | M] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/12/18 11:27:32 | 000,000,027 | —- | M] () – C:\windows\SysNative\drivers\etc\hosts
[2011/12/18 11:05:52 | 001,163,104 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Users\laptop\Desktop\avg_remover_stf_x86_2011_1322.exe
[2011/12/16 15:10:58 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:36 | 000,458,240 | —- | M] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | M] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 11:10:24 | 002,322,184 | —- | M] (ESET) – C:\Users\laptop\Desktop\esetsmartinstaller_enu.exe
[2011/12/15 16:06:50 | 000,139,264 | —- | M] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/13 22:46:10 | 000,607,260 | R— | M] (Swearware) – C:\Users\laptop\Desktop\dds.scr
[2011/12/13 15:38:56 | 000,458,752 | —- | M] () – C:\windows\SysNative\Ikeext.etl
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 14:31:42 | 000,005,770 | -HS- | M] () – C:\ProgramData\222620n4p360q763c457a6gir7g0
[2011/12/05 18:49:43 | 000,000,000 | -H– | M] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/12/03 00:10:11 | 000,372,016 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/12/18 19:24:00 | 000,095,744 | —- | C] () – C:\Users\laptop\Desktop\SystemLook_x64.exe
[2011/12/18 17:52:40 | 000,001,908 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/16 15:10:34 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe
[2011/12/16 15:10:31 | 000,458,240 | —- | C] () – C:\Users\laptop\Desktop\CKScanner.exe.part
[2011/12/16 14:43:19 | 000,004,540 | —- | C] () – C:\Users\laptop\Desktop\avg scan.csv
[2011/12/16 10:42:34 | 000,001,945 | —- | C] () – C:\windows\epplauncher.mif
[2011/12/15 16:06:49 | 000,139,264 | —- | C] () – C:\Users\laptop\Desktop\SystemLook.exe
[2011/12/15 15:12:11 | 000,256,000 | —- | C] () – C:\windows\PEV.exe
[2011/12/15 15:12:11 | 000,208,896 | —- | C] () – C:\windows\MBR.exe
[2011/12/15 15:12:11 | 000,098,816 | —- | C] () – C:\windows\sed.exe
[2011/12/15 15:12:11 | 000,080,412 | —- | C] () – C:\windows\grep.exe
[2011/12/15 15:12:11 | 000,068,096 | —- | C] () – C:\windows\zip.exe
[2011/12/13 17:39:17 | 000,007,609 | —- | C] () – C:\Users\laptop\AppData\Local\Resmon.ResmonCfg
[2011/12/13 13:28:37 | 000,005,770 | -HS- | C] () – C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0
[2011/12/13 13:28:37 | 000,005,770 | -HS- | C] () – C:\ProgramData\222620n4p360q763c457a6gir7g0
[2011/12/05 18:49:43 | 000,000,000 | -H– | C] () – C:\windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/11/30 11:32:03 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/10/16 04:05:33 | 000,002,951 | —- | C] () – C:\windows\SysWow64\settings.bin
[2011/10/16 02:05:51 | 000,702,750 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2011/10/15 22:24:50 | 000,007,112 | —- | C] () – C:\windows\mozver.dat
[2011/10/15 00:29:35 | 000,000,335 | —- | C] () – C:\windows\nsreg.dat
[2011/10/11 22:54:25 | 000,004,096 | —- | C] () – C:\windows\d3dx.dat
[2011/10/10 20:35:44 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat.temp
[2011/09/14 11:06:40 | 000,207,034 | —- | C] () – C:\windows\hpoins46.dat
[2011/09/05 22:44:51 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2011/09/05 22:37:34 | 000,003,929 | —- | C] () – C:\windows\SysWow64\atipblag.dat
[2011/08/25 12:38:12 | 000,061,678 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JPR.{PB
[2011/08/25 12:38:12 | 000,012,358 | —- | C] () – C:\Users\laptop\AppData\Roaming\PFP100JCM.{PB
[2011/08/25 11:57:18 | 000,000,420 | —- | C] () – C:\windows\PowerReg.dat
[2011/08/24 11:58:34 | 000,128,312 | —- | C] () – C:\windows\SysWow64\GFNEX.dll
[2011/02/03 21:56:58 | 000,066,856 | —- | C] () – C:\windows\SysWow64\SynTPEnhPS.dll
[2010/03/31 19:34:36 | 000,000,574 | —- | C] () – C:\windows\hpomdl46.dat
[2009/07/14 00:38:36 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | —- | C] () – C:\windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | —- | C] () – C:\windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | —- | C] () – C:\windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011/10/09 16:56:41 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Anabel
[2011/11/02 08:26:46 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Big Fish Games
[2011/12/02 22:27:16 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Blue Tea Games
[2011/11/09 22:08:51 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Boomzap
[2011/11/10 06:39:07 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Casual Box
[2011/11/03 21:35:25 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ChaYoWo Games
[2011/10/14 19:43:25 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\CursedOnboard
[2011/10/22 02:44:49 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\DarkParablesBriarRoseSE_BFG
[2011/12/16 03:32:54 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL
[2011/11/10 02:54:51 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\EleFun Games
[2011/11/16 15:33:10 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Elephant Games
[2011/11/09 21:55:50 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Enki Games
[2011/11/07 23:04:21 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Enlightenus
[2011/11/10 02:10:22 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ERS Game Studios
[2011/11/08 14:36:08 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\FirstColony
[2011/11/10 00:53:14 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ForgottenRiddles
[2011/10/30 03:55:31 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Friday's games
[2011/11/19 22:42:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Fuzzy Games
[2011/08/27 16:47:04 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gamelab
[2011/08/27 15:25:54 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\GameMill
[2011/11/10 07:53:33 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gamers Digital
[2011/11/09 21:29:35 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\GAMGO
[2011/11/07 03:36:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Genimo
[2011/10/12 01:46:52 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Gogii
[2011/11/16 15:23:16 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\HdO Adventure
[2011/11/10 04:49:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\In search of the Lost Temple
[2011/11/03 01:26:45 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\JaiboGames
[2011/11/06 08:55:47 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\MumboJumbo
[2011/10/15 22:20:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Netscape
[2011/11/30 00:03:28 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Oberon Games
[2011/11/30 12:10:59 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\OpenOffice.org
[2011/11/03 18:08:42 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Orneon
[2011/10/09 20:32:29 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Peace Craft
[2011/10/23 19:36:27 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PeaceCraft2
[2011/10/30 21:47:22 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PeaceCraft3
[2011/11/10 01:01:17 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\PlayFirst
[2011/12/17 12:17:18 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\QuickScan
[2011/11/03 20:09:15 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Silverback Productions
[2011/12/08 13:21:49 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\SoftGrid Client
[2011/11/10 23:07:26 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\SultansLabyrinth
[2011/09/05 22:17:06 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Tific
[2011/11/23 17:21:32 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\Toshiba
[2011/10/16 02:06:48 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\TP
[2011/11/09 06:32:19 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\UClick
[2011/11/08 22:40:04 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\VendelGAMES
[2011/10/14 17:20:36 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\ViquaSoft
[2011/08/24 12:38:07 | 000,000,000 | —D | M] – C:\Users\laptop\AppData\Roaming\WinBatch
[2009/07/14 00:08:49 | 000,016,446 | —- | M] () – C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
Post #48
ComboFix 11-12-19.03 - laptop 12/19/2011 19:18:23.9.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.2211 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-11-20 to 2011-12-20 ))))))))))))))))))))))))))))))) . . 2011-12-20 00:31 . 2011-12-20 00:31 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-20 00:16 . 2011-11-30 07:21 8822856 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-12-20 00:16 . 2011-12-20 00:16 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A59DCD9C-5B68-4A49-AC50-FC33DDFD2AB9}\offreg.dll 2011-12-20 00:16 . 2011-11-30 07:21 8822856 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A59DCD9C-5B68-4A49-AC50-FC33DDFD2AB9}\mpengine.dll 2011-12-20 00:02 . 2011-12-20 00:02 ——– d—–w- C:\_OTL 2011-12-18 23:01 . 2011-10-04 22:22 917840 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A93A80D4-4755-4AC9-90FF-1A1E953714FB}\gapaengine.dll 2011-12-18 22:52 . 2011-12-18 22:52 ——– d—–w- c:\program files (x86)\Microsoft Security Client 2011-12-18 22:52 . 2011-12-18 22:52 ——– d—–w- c:\program files\Microsoft Security Client 2011-12-17 17:17 . 2011-12-17 17:17 ——– d—–w- c:\users\laptop\AppData\Roaming\QuickScan 2011-12-16 16:10 . 2011-12-16 16:10 ——– d—–w- c:\program files (x86)\ESET 2011-12-16 09:11 . 2011-12-16 09:11 ——– d—–w- c:\program files (x86)\SeaMonkey 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Roaming\Disruptive Innovations SARL 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\users\laptop\AppData\Local\Disruptive Innovations SARL 2011-12-16 08:32 . 2011-12-16 08:32 ——– d—–w- c:\program files (x86)\BlueGriffon 2011-12-16 07:47 . 2011-12-16 07:47 ——– d—–w- c:\programdata\Blumentals 2011-12-13 23:01 . 2011-12-18 16:27 ——– d—–w- c:\programdata\AVG2012 2011-12-13 23:00 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\AVG 2011-12-13 22:50 . 2011-12-13 22:50 ——– d–h–w- c:\programdata\Common Files 2011-12-13 22:49 . 2011-12-17 18:35 ——– d—–w- c:\programdata\MFAData 2011-12-13 19:45 . 2011-12-13 19:45 ——– d—–w- c:\users\laptop\AppData\Roaming\Malwarebytes 2011-12-13 19:44 . 2011-12-14 05:54 ——– d—–w- c:\programdata\Malwarebytes 2011-12-13 19:44 . 2011-12-14 05:58 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-12-13 19:44 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-04 04:36 . 2011-12-04 04:38 ——– d—–w- c:\program files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition 2011-12-03 23:49 . 2011-12-07 16:15 ——– d—–w- c:\programdata\Playrix Entertainment 2011-12-03 22:21 . 2011-12-03 22:21 ——– d—–w- c:\programdata\TERMINAL Studio 2011-12-03 17:45 . 2011-12-03 17:46 ——– d—–w- c:\users\laptop\AppData\Local\Tific 2011-12-03 16:17 . 2011-12-18 01:48 ——– d—–w- c:\program files (x86)\Luxor Adventures 2011-12-03 16:17 . 2009-08-19 01:26 57344 —-a-w- c:\windows\SysWow64\Big Kahuna Reef.scr 2011-12-03 16:17 . 2011-12-12 00:23 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2011-12-03 16:02 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Double Play Jewel Quest 2 and 3 2011-12-03 15:55 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Royal Envoy 2011-12-03 15:42 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift and the Mystery from Atlantis 2011-12-03 15:26 . 2011-12-04 02:31 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2 2011-12-03 15:25 . 2011-12-11 23:32 ——– d—–w- c:\program files (x86)\The Rise Of Atlantis 2011-12-03 15:23 . 2011-12-03 22:42 ——– d—–w- c:\program files (x86)\Sky Kingdoms 2011-12-03 15:20 . 2011-12-18 08:33 ——– d—–w- c:\program files (x86)\Heroes Of Hellas 2011-12-03 15:19 . 2011-12-04 02:38 ——– d—–w- c:\program files (x86)\Call Of Atlantis 2011-12-03 15:13 . 2011-12-04 06:42 ——– d—–w- c:\program files (x86)\Atlantis Quest 2011-12-03 15:11 . 2011-12-18 01:00 ——– d—–w- c:\program files (x86)\Luxor HD 2011-12-03 15:10 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift Fountains of Fate 2011-12-03 14:52 . 2011-12-03 14:52 ——– d—–w- c:\programdata\Amazon 2011-12-03 14:52 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Amazon 2011-12-03 04:34 . 2011-12-03 04:34 ——– d—–w- c:\programdata\Fugazo 2011-12-02 21:57 . 2011-12-02 21:57 ——– d—–w- c:\program files (x86)\Mythic Pearls - The Legend of Tirnanog 2011-12-02 21:53 . 2011-12-02 21:53 ——– d—–w- c:\programdata\Intenium 2011-12-02 21:45 . 2011-12-02 21:45 ——– d—–w- c:\program files (x86)\Luxor - 5th Passage 2011-11-30 17:10 . 2011-11-30 17:10 ——– d—–w- c:\users\laptop\AppData\Roaming\OpenOffice.org 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\OpenOffice.org 3 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-30 17:08 . 2011-11-30 17:08 472808 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll 2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Java 2011-11-30 16:31 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Adobe 2011-11-28 00:04 . 2011-11-30 05:03 ——– d—–w- c:\users\laptop\AppData\Roaming\Oberon Games 2011-11-20 03:42 . 2011-11-20 03:42 ——– d—–w- c:\users\laptop\AppData\Roaming\Fuzzy Games . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-30 17:08 . 2011-04-28 03:24 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-10-07 01:29 . 2011-09-13 23:56 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl . . ((((((((((((((((((((((((((((( SnapShot_2011-12-16_20.38.05 ))))))))))))))))))))))))))))))))))))))))) . + 2011-12-20 00:03 . 2011-12-20 00:03 12411 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat - 2011-12-16 15:05 . 2011-12-16 15:05 12411 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2010-11-21 03:09 . 2011-12-18 23:17 44408 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2011-12-20 00:06 47482 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2009-07-14 02:36 . 2011-12-16 15:42 97834 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2011-12-20 00:11 97834 c:\windows\system32\perfc009.dat - 2011-08-24 17:35 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-08-24 17:35 . 2011-12-20 00:07 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-08-24 17:35 . 2011-12-16 15:42 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-12-20 00:07 . 2011-12-20 00:07 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-20 00:07 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2011-12-16 15:42 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-08-26 10:00 . 2011-12-19 23:51 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-08-26 10:00 . 2011-12-16 20:05 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-08-26 10:00 . 2011-12-19 23:51 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-12-15 20:54 . 2011-12-18 16:26 3630 c:\windows\system32\wdi\ERCQueuedResolutions.dat + 2011-08-25 16:47 . 2011-12-20 00:06 8114 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2785432018-3854357188-4169626549-1000_UserData.bin - 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-12-20 00:04 . 2011-12-20 00:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2011-12-16 15:06 . 2011-12-16 15:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-12-20 00:04 . 2011-12-20 00:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 04:54 . 2011-12-20 00:05 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-07-14 04:54 . 2011-12-16 15:07 344064 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-09-06 05:40 . 2011-12-19 23:48 278422 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2011-12-20 00:11 596860 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2011-12-16 15:42 596860 c:\windows\system32\perfh009.dat + 2010-11-21 03:27 . 2010-10-19 16:33 270720 c:\windows\system32\MpSigStub.exe - 2010-11-21 03:27 . 2010-10-19 20:51 270720 c:\windows\system32\MpSigStub.exe - 2009-07-14 05:12 . 2011-12-16 15:25 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-07-14 05:12 . 2011-12-20 00:07 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-07-14 05:01 . 2011-12-16 15:05 320312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-12-20 00:03 320312 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-10-01 04:08 . 2011-12-18 16:26 593416 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2785432018-3854357188-4169626549-1000-12288.dat - 2009-07-14 04:54 . 2011-12-16 15:07 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-20 00:05 2785280 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2011-12-16 15:07 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-07-14 04:54 . 2011-12-20 00:05 1884160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-09-06 03:27 . 2011-12-16 15:05 1057200 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-09-06 03:27 . 2011-12-20 00:03 1057200 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2011-05-19 22:23 . 2011-05-19 22:23 2708992 c:\windows\Installer\1613d9f.msi + 2011-06-15 19:51 . 2011-06-15 19:51 1911808 c:\windows\Installer\1613d98.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-08 336384] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920] R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x] R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664] S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688] S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-04-07 294328] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x] S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768] S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632] S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-04-06 828336] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU] "HSON"="c:\program files (x86)\TOSHIBA\TBS\HSON.exe" [BU] "TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "Teco"="c:\program files (x86)\TOSHIBA\TECO\Teco.exe" [BU] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040] "TosWaitSrv"="c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe" [BU] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://start.toshiba.com uInternet Settings,ProxyOverride = TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed] FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed] FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-19 19:52:35 ComboFix-quarantined-files.txt 2011-12-20 00:52 ComboFix2.txt 2011-12-18 16:48 ComboFix3.txt 2011-12-18 05:01 ComboFix4.txt 2011-12-16 21:06 ComboFix5.txt 2011-12-20 00:17 . Pre-Run: 513,624,252,416 bytes free Post-Run: 513,460,391,936 bytes free . - - End Of File - - B52997D618F4382E7E9568102DD5BBD0
Post #49
Hi catherine,

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click VirusTotal

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\windows\SysWow64\settings.bin

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.
———-
Post #50
File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis: MD5: e5efe031f850c9c42b9e9b0bf753c3b2 Date first seen: 2011-04-11 11:33:54 (UTC) Date last seen: 2011-04-11 11:33:54 (UTC) Detection ratio: 0/42 What do you wish to do? i clicked on 'view last log' 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: settings.bin Submission date: 2011-04-11 11:33:54 (UTC) Current status: finished Result: 0 /42 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.04.11.03 2011.04.11 - AntiVir 7.11.6.46 2011.04.11 - Antiy-AVL 2.0.3.7 2011.04.11 - Avast 4.8.1351.0 2011.04.11 - Avast5 5.0.677.0 2011.04.11 - AVG 10.0.0.1190 2011.04.11 - BitDefender 7.2 2011.04.11 - CAT-QuickHeal 11.00 2011.04.11 - ClamAV 0.97.0.0 2011.04.10 - Commtouch 5.2.11.5 2011.04.06 - Comodo 8299 2011.04.11 - DrWeb 5.0.2.03300 2011.04.11 - Emsisoft 5.1.0.5 2011.04.11 - eSafe 7.0.17.0 2011.04.10 - eTrust-Vet 36.1.8265 2011.04.11 - F-Prot 4.6.2.117 2011.04.11 - F-Secure 9.0.16440.0 2011.04.11 - Fortinet 4.2.254.0 2011.04.09 - GData 22 2011.04.11 - Ikarus T3.1.1.103.0 2011.04.11 - Jiangmin 13.0.900 2011.04.09 - K7AntiVirus 9.96.4347 2011.04.09 - Kaspersky 7.0.0.125 2011.04.11 - McAfee 5.400.0.1158 2011.04.11 - McAfee-GW-Edition 2010.1C 2011.04.11 - Microsoft 1.6702 2011.04.11 - NOD32 6032 2011.04.11 - Norman 6.07.07 2011.04.10 - Panda 10.0.3.5 2011.04.10 - PCTools 7.0.3.5 2011.04.11 - Prevx 3.0 2011.04.11 - Rising 23.52.06.03 2011.04.10 - Sophos 4.64.0 2011.04.11 - SUPERAntiSpyware 4.40.0.1006 2011.04.10 - Symantec 20101.3.2.89 2011.04.11 - TheHacker 6.7.0.1.171 2011.04.10 - TrendMicro 9.200.0.1012 2011.04.11 - TrendMicro-HouseCall 9.200.0.1012 2011.04.11 - VBA32 3.12.14.3 2011.04.11 - VIPRE 8985 2011.04.11 - ViRobot 2011.4.11.4404 2011.04.11 - VirusBuster 13.6.298.0 2011.04.11 - Additional information Show all MD5 : e5efe031f850c9c42b9e9b0bf753c3b2 SHA1 : 7897d81af67c0d7620926f7266b113ebfe52caed SHA256: 235ef42cc8f4e3a01aafb4bc5154e3439c56d0f6517b4d377993204227c76c3c ssdeep: 24:s0BQEHNSAXHC75MokWGNVKX+t8f0h0WUsL9TMX:1RNHXoZGAOthJUq9T4 File size : 2951 bytes First seen: 2011-04-11 11:33:54 Last seen : 2011-04-11 11:33:54 Magic: GLS_BINARY_LSB_FIRST TrID: LTAC compressed audio (v1.61) (98.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.6%) MS Flight Simulator Aircraft Performance Info (0.3%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned PEiD: - ExifTool: - VT Community
Post #52
this is from the 'reanalyze' option 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: settings.bin Submission date: 2011-12-20 01:34:19 (UTC) Current status: queued queued (#1) analysing finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.12.19.03 2011.12.19 - AntiVir 7.11.19.162 2011.12.19 - Antiy-AVL 2.0.3.7 2011.12.19 - Avast 6.0.1289.0 2011.12.19 - AVG 10.0.0.1190 2011.12.19 - BitDefender 7.2 2011.12.20 - ByteHero 1.0.0.1 2011.12.07 - CAT-QuickHeal 12.00 2011.12.18 - ClamAV 0.97.3.0 2011.12.20 - Commtouch 5.3.2.6 2011.12.19 - Comodo 11020 2011.12.20 - DrWeb 5.0.2.03300 2011.12.20 - Emsisoft 5.1.0.11 2011.12.20 - eSafe 7.0.17.0 2011.12.18 - eTrust-Vet 37.0.9633 2011.12.20 - F-Prot 4.6.5.141 2011.12.19 - F-Secure 9.0.16440.0 2011.12.19 - Fortinet 4.3.388.0 2011.12.19 - GData 22.312/22.591 2011.12.20 - Ikarus T3.1.1.109.0 2011.12.20 - Jiangmin 13.0.900 2011.12.19 - K7AntiVirus 9.119.5720 2011.12.19 - Kaspersky 9.0.0.837 2011.12.19 - McAfee 5.400.0.1158 2011.12.20 - McAfee-GW-Edition 2010.1E 2011.12.19 - Microsoft 1.7903 2011.12.19 - NOD32 6725 2011.12.20 - Norman 6.07.13 2011.12.19 - nProtect 2011-12-19.01 2011.12.19 - Panda 10.0.3.5 2011.12.19 - PCTools 8.0.0.5 2011.12.20 - Prevx 3.0 2011.12.20 - Rising 23.89.00.01 2011.12.19 - Sophos 4.72.0 2011.12.19 - SUPERAntiSpyware 4.40.0.1006 2011.12.20 - Symantec 20111.2.0.82 2011.12.20 - TheHacker 6.7.0.1.362 2011.12.19 - TrendMicro 9.500.0.1008 2011.12.19 - TrendMicro-HouseCall 9.500.0.1008 2011.12.20 - VBA32 3.12.16.4 2011.12.19 - VIPRE 11277 2011.12.19 - ViRobot 2011.12.19.4833 2011.12.19 - VirusBuster 14.1.124.0 2011.12.20 - Additional information Show all MD5 : e5efe031f850c9c42b9e9b0bf753c3b2 SHA1 : 7897d81af67c0d7620926f7266b113ebfe52caed SHA256: 235ef42cc8f4e3a01aafb4bc5154e3439c56d0f6517b4d377993204227c76c3c ssdeep: 24:s0BQEHNSAXHC75MokWGNVKX+t8f0h0WUsL9TMX:1RNHXoZGAOthJUq9T4 File size : 2951 bytes First seen: 2011-04-11 11:33:54 Last seen : 2011-12-20 01:34:19 TrID: LTAC compressed audio (v1.61) (98.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.6%) MS Flight Simulator Aircraft Performance Info (0.3%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned ExifTool: file metadata Error: Unknown file type FileSize: 2.9 kB VT Community
Post #53
Hi,

Attempt to do the following…

I need some information on some unidentified files. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click VirusTotal

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\Users\laptop\AppData\Local\222620n4p360q763c457a6gir7g0

scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete before submitting the next sample. Also please make sure each result is clearly identified as to which sample they belong to.
———-
Post #54
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: 222620n4p360q763c457a6gir7g0 Submission date: 2011-12-20 01:59:32 (UTC) Current status: queued (#1) queued analysing finished Result: 1/ 43 (2.3%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.12.19.03 2011.12.19 - AntiVir 7.11.19.162 2011.12.19 - Antiy-AVL 2.0.3.7 2011.12.19 - Avast 6.0.1289.0 2011.12.19 - AVG 10.0.0.1190 2011.12.19 - BitDefender 7.2 2011.12.20 - ByteHero 1.0.0.1 2011.12.07 - CAT-QuickHeal 12.00 2011.12.18 - ClamAV 0.97.3.0 2011.12.20 - Commtouch 5.3.2.6 2011.12.20 - Comodo 11020 2011.12.20 - DrWeb 5.0.2.03300 2011.12.20 - Emsisoft 5.1.0.11 2011.12.20 - eSafe 7.0.17.0 2011.12.18 - eTrust-Vet 37.0.9633 2011.12.20 - F-Prot 4.6.5.141 2011.12.19 - F-Secure 9.0.16440.0 2011.12.19 - Fortinet 4.3.388.0 2011.12.19 - GData 22 2011.12.20 - Ikarus T3.1.1.109.0 2011.12.20 - Jiangmin 13.0.900 2011.12.19 - K7AntiVirus 9.119.5720 2011.12.19 - Kaspersky 9.0.0.837 2011.12.19 - McAfee 5.400.0.1158 2011.12.20 - McAfee-GW-Edition 2010.1E 2011.12.19 - Microsoft 1.7903 2011.12.19 - NOD32 6725 2011.12.20 - Norman 6.07.13 2011.12.19 - nProtect 2011-12-19.01 2011.12.19 - Panda 10.0.3.5 2011.12.19 - PCTools 8.0.0.5 2011.12.20 - Prevx 3.0 2011.12.20 - Rising 23.89.00.01 2011.12.19 - Sophos 4.72.0 2011.12.19 Mal/FakeAvCn-C SUPERAntiSpyware 4.40.0.1006 2011.12.20 - Symantec 20111.2.0.82 2011.12.20 - TheHacker 6.7.0.1.362 2011.12.19 - TrendMicro 9.500.0.1008 2011.12.19 - TrendMicro-HouseCall 9.500.0.1008 2011.12.20 - VBA32 3.12.16.4 2011.12.19 - VIPRE 11277 2011.12.19 - ViRobot 2011.12.19.4833 2011.12.19 - VirusBuster 14.1.124.0 2011.12.20 - Additional information Show all MD5 : 29e9315ae30c84828bf189a7d4616964 SHA1 : ddbc153b853cd999dedada85b7f6d895778fe91d SHA256: 7eccf8a2d1b6cad0d344a8c0c98934574a82733057d902c34323418ab88b2c17 ssdeep: 96:C9APZ4/M1+Tp3C1E86ISeRxlx58HbScK5xIp3izl92gfBxPZN1Ll:CiPZb+dS1ETMDamcK5x ySJACBN1x File size : 5770 bytes First seen: 2011-12-20 01:59:32 Last seen : 2011-12-20 01:59:32 TrID: Unknown! sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned ExifTool: file metadata Error: Unknown file type FileSize: 5.6 kB VT Community
Post #55
Hi catherine, Thanks for getting me those logs. :) You are doing great. Are you still having problems? I am not seeing anything jumping out at me?
Post #56
when i look at my toolbar customizing menu, i'm still seeing jjv.exe (windows 7 security 2012) and proxycheck.exe (three times) but now i'm also seeing a listing for an avg product and we removed those. also, i still have no search function. i looked under services and it's not even listed. any idea how to get it back on?
Post #57
Hi catherine,

This next step may take some time.

I want for you to open Malwarebytes again, update it and then run a Full Scan. Anything that is found remove it as it is probably going to be related to Windows 7 Security 2012.

Post the log created when you have that completed. :)
Post #58
Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8400 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 12/19/2011 11:07:37 PM mbam-log-2011-12-19 (23-07-37).txt Scan type: Full scan (C:\|Q:\|) Objects scanned: 474026 Time elapsed: 1 hour(s), 34 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\assembly\temp\kwrd.dll (PUP.BitMiner) -> Quarantined and deleted successfully.
Post #59
Hi catherine,

  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :file
*jjv.exe

:filefind
*jjv.exe
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #60
SystemLook 27.08.10 by jpshortstuff Log created at 10:11 on 20/12/2011 by laptop Administrator - Elevation successful ========== file ========== *jjv.exe - Unable to find/read file. ========== filefind ========== Searching for "*jjv.exe" No files found. -= EOF =- if it can't find it does that mean it's a made up file by the virus or is my computer seeing ghosts?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI