What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ran ComboFix to fix virus [Closed]

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer locked up due to virus. Ran Combofix and this is the result. Please help.. ComboFix 12-04-06.03 - emilyben 04/06/2012 20:07:58.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2013.629 [GMT -5:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . —- Previous Run ——- . c:\users\emilyben\AppData\Local\{46C26807-C8AD-4D91-8C27-DC13C465DE99} c:\users\emilyben\AppData\Local\{46C26807-C8AD-4D91-8C27-DC13C465DE99}\chrome.manifest c:\users\emilyben\AppData\Local\{46C26807-C8AD-4D91-8C27-DC13C465DE99}\chrome\content\_cfg.js c:\users\emilyben\AppData\Local\{46C26807-C8AD-4D91-8C27-DC13C465DE99}\chrome\content\overlay.xul c:\users\emilyben\AppData\Local\{46C26807-C8AD-4D91-8C27-DC13C465DE99}\install.rdf c:\users\emilyben\AppData\Roaming\Fonu c:\users\emilyben\AppData\Roaming\Fonu\uxho.tmp c:\windows\security\Database\tmp.edb c:\windows\system32\jucheck.exe c:\windows\system32\jusched.exe . . ((((((((((((((((((((((((( Files Created from 2012-03-07 to 2012-04-07 ))))))))))))))))))))))))))))))) . . 2012-03-30 00:20 . 2012-03-30 00:20 ——– d—–w- c:\users\emilyben\AppData\Roaming\Malwarebytes 2012-03-30 00:20 . 2012-03-30 00:31 ——– d—–w- c:\programdata\Malwarebytes 2012-03-30 00:20 . 2012-03-30 00:20 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-03-30 00:20 . 2011-12-10 20:24 23152 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-21 22:09 . 2012-03-21 22:09 ——– d—–w- c:\users\emilyben\AppData\Local\Windows Live Writer 2012-03-21 22:09 . 2012-03-21 22:09 ——– d—–w- c:\users\emilyben\AppData\Roaming\Windows Live Writer 2012-03-21 22:05 . 2012-03-30 00:32 ——– d—–w- c:\users\emilyben\AppData\Roaming\Myysi 2012-03-21 00:38 . 2012-03-21 00:38 ——– d—–w- c:\programdata\Local Settings 2012-03-19 21:17 . 2012-03-19 21:17 592824 —-a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll 2012-03-19 21:17 . 2012-03-19 21:17 44472 —-a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll 2012-03-14 08:02 . 2011-11-19 15:20 5559152 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-03-14 08:02 . 2011-11-19 14:50 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-03-14 08:02 . 2011-11-19 14:50 3913584 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-03-13 21:44 . 2012-02-03 04:34 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-03-13 21:44 . 2012-02-10 06:36 1544192 —-a-w- c:\windows\system32\DWrite.dll 2012-03-13 21:44 . 2012-02-10 05:38 1077248 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-03-13 21:44 . 2012-01-25 06:38 77312 —-a-w- c:\windows\system32\rdpwsx.dll 2012-03-13 21:44 . 2012-01-25 06:38 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-03-13 21:44 . 2012-01-25 06:33 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-03-13 21:44 . 2012-02-17 06:38 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-03-13 21:44 . 2012-02-17 05:34 826880 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-03-13 21:44 . 2012-02-17 04:58 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-03-13 21:44 . 2012-02-17 04:57 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-01 09:02 . 2012-03-01 09:02 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2012-03-01 09:02 . 2012-03-01 09:02 161792 —-a-w- c:\windows\SysWow64\msls31.dll 2012-03-01 09:02 . 2012-03-01 09:02 1127424 —-a-w- c:\windows\SysWow64\wininet.dll 2012-03-01 09:02 . 2012-03-01 09:02 1798656 —-a-w- c:\windows\SysWow64\jscript9.dll 2012-03-01 09:02 . 2012-03-01 09:02 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2012-03-01 09:02 . 2012-03-01 09:02 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll 2012-03-01 09:02 . 2012-03-01 09:02 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2012-03-01 09:02 . 2012-03-01 09:02 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2012-03-01 09:02 . 2012-03-01 09:02 74752 —-a-w- c:\windows\SysWow64\iesetup.dll 2012-03-01 09:02 . 2012-03-01 09:02 63488 —-a-w- c:\windows\SysWow64\tdc.ocx 2012-03-01 09:02 . 2012-03-01 09:02 367104 —-a-w- c:\windows\SysWow64\html.iec 2012-03-01 09:02 . 2012-03-01 09:02 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll 2012-03-01 09:02 . 2012-03-01 09:02 152064 —-a-w- c:\windows\SysWow64\wextract.exe 2012-03-01 09:02 . 2012-03-01 09:02 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2012-03-01 09:02 . 2012-03-01 09:02 1427456 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2012-03-01 09:02 . 2012-03-01 09:02 420864 —-a-w- c:\windows\SysWow64\vbscript.dll 2012-03-01 09:02 . 2012-03-01 09:02 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb 2012-03-01 09:02 . 2012-03-01 09:02 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2012-03-01 09:02 . 2012-03-01 09:02 35840 —-a-w- c:\windows\SysWow64\imgutil.dll 2012-03-01 09:02 . 2012-03-01 09:02 11776 —-a-w- c:\windows\SysWow64\mshta.exe 2012-03-01 09:02 . 2012-03-01 09:02 101888 —-a-w- c:\windows\SysWow64\admparse.dll 2012-03-01 09:02 . 2012-03-01 09:02 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2012-03-01 09:02 . 2012-03-01 09:02 222208 —-a-w- c:\windows\system32\msls31.dll 2012-03-01 09:02 . 2012-03-01 09:02 1390080 —-a-w- c:\windows\system32\wininet.dll 2012-03-01 09:02 . 2012-03-01 09:02 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2012-03-01 09:02 . 2012-03-01 09:02 173056 —-a-w- c:\windows\system32\ieUnatt.exe 2012-03-01 09:02 . 2012-03-01 09:02 12288 —-a-w- c:\windows\system32\mshta.exe 2012-03-01 09:02 . 2012-03-01 09:02 49664 —-a-w- c:\windows\system32\imgutil.dll 2012-03-01 09:02 . 2012-03-01 09:02 2308096 —-a-w- c:\windows\system32\jscript9.dll 2012-03-01 09:02 . 2012-03-01 09:02 114176 —-a-w- c:\windows\system32\admparse.dll 2012-03-01 09:02 . 2012-03-01 09:02 135168 —-a-w- c:\windows\system32\IEAdvpack.dll 2012-03-01 09:02 . 2012-03-01 09:02 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2012-03-01 09:02 . 2012-03-01 09:02 76800 —-a-w- c:\windows\system32\tdc.ocx 2012-03-01 09:02 . 2012-03-01 09:02 48640 —-a-w- c:\windows\system32\mshtmler.dll 2012-03-01 09:02 . 2012-03-01 09:02 111616 —-a-w- c:\windows\system32\iesysprep.dll 2012-03-01 09:02 . 2012-03-01 09:02 448512 —-a-w- c:\windows\system32\html.iec 2012-03-01 09:02 . 2012-03-01 09:02 85504 —-a-w- c:\windows\system32\iesetup.dll 2012-03-01 09:02 . 2012-03-01 09:02 30720 —-a-w- c:\windows\system32\licmgr10.dll 2012-03-01 09:02 . 2012-03-01 09:02 1493504 —-a-w- c:\windows\system32\inetcpl.cpl 2012-03-01 09:02 . 2012-03-01 09:02 165888 —-a-w- c:\windows\system32\iexpress.exe 2012-03-01 09:02 . 2012-03-01 09:02 160256 —-a-w- c:\windows\system32\wextract.exe 2012-03-01 09:02 . 2012-03-01 09:02 603648 —-a-w- c:\windows\system32\vbscript.dll 2012-01-24 01:46 . 2010-03-25 22:06 499712 —-a-w- c:\windows\SysWow64\msvcp71.dll 2012-01-24 01:46 . 2010-03-25 22:06 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600] "PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520] "Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2007-12-11 286720] "Nikon Transfer Monitor"="c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-02-24 479232] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2012-01-24 296056] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-09-17 560128] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184] . c:\users\emilyben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ tem64to.js [2012-3-1 2809] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360] S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v2.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2012-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3543769950-2427463838-963887859-1001Core.job - c:\users\emilyben\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-07 23:00] . 2012-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3543769950-2427463838-963887859-1001UA.job - c:\users\emilyben\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-07 23:00] . 2012-04-06 c:\windows\Tasks\Norton Security Scan for emilyben.job - c:\progra~2\NORTON~2\Engine\361~1.11\Nss.exe [2012-01-24 03:43] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = TCP: DhcpNameServer = [removed] [removed] [removed] FF - ProfilePath - c:\users\emilyben\AppData\Roaming\Mozilla\Firefox\Profiles\v2au4ptk.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B8b87cc5c-44c0-4d2f-9be5-560fff571e9a%7D&mid=&ds=&v=10.2.0.3&lang=&pr=&d=2012-04-6%2020%3A5%3A18&sap=ku&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe Wow6432Node-HKLM-Explorer_Run-41864 - c:\progra~3\LOCALS~1\Temp\msooiymia.pif Toolbar-Locked - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-3543769950-2427463838-963887859-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-3543769950-2427463838-963887859-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE c:\program files (x86)\Dell DataSafe Local Backup\Toaster.exe . ************************************************************************** . Completion time: 2012-04-06 20:30:46 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-07 01:30 . Pre-Run: 260,049,846,272 bytes free Post-Run: 264,078,397,440 bytes free . - - End Of File - - A62CFB63B3630165AE05CDE05B7ADEAA
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

First we need to make all files and folders VISIBLE:

  • Go to start>control panel>folder options>view
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with OK

Download CKScanner by askey127 from Here & save it to your Desktop.
  • Right-click and Run as Administrator CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
———-

I would be amiss if I didn't tell you to please not run ComboFix any more without the guidance of a trained malware remover. Once wrong step can turn your computer into a very fancy doorstop. :)
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-


Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post the logs created by ckscanner, DDS and aswMBR. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI