Blade81
Hi,
Please give it another try (if it stalls again try in safe mode).
Spyware / Malware / Virus Removal
Google redirect [Solved]
12 min read
Coug01
ComboFix 12-05-20.10 - gordon 05/20/2012 22:49:45.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.2032 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\gordon\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\gordon\AppData\Local\Mozilla\Firefox\Profiles\mn9yqrg3.default\Cache\E\00\25288d01"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-366e93c2"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\770adbc3-13f0cc08"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\37db3fe2-6efadbcc"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\263a9144-6a7abf1d"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\7c6df484-55809ec2"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7be78a09-5eec8572"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\gordon\AppData\Local\xkbcpupqr
c:\users\gordon\AppData\Local\xkbcpupqr\wrhvfblshdw.exe
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-366e93c2
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\37db3fe2-6efadbcc
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7be78a09-5eec8572
.
.
————— FCopy —————
.
c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\Vista\klif.sys –> c:\windows\System32\drivers\klif.sys
.
((((((((((((((((((((((((( Files Created from 2012-04-21 to 2012-05-21 )))))))))))))))))))))))))))))))
.
.
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\gordon\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-18 16:13 . 2012-05-18 16:13 ——– d—–w- c:\program files\ESET
2012-05-18 15:22 . 2012-05-18 15:22 ——– d—–w- c:\program files\Common Files\Java
2012-05-18 15:21 . 2012-05-18 15:21 772552 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-05-17 23:22 . 2009-03-08 11:32 72704 —-a-w- c:\windows\system32\admparse.dll
2012-05-16 12:18 . 2012-05-16 12:18 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-05-16 12:18 . 2012-05-16 12:18 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-16 12:18 . 2012-05-16 12:18 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-12 03:43 . 2012-03-20 23:28 53120 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 03:43 . 2012-03-30 12:39 905600 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 03:43 . 2012-02-01 15:11 1218048 —-a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-12 03:43 . 2012-02-01 15:10 1404928 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll
2012-05-12 03:43 . 2012-02-01 15:10 983040 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-12 03:43 . 2012-02-01 15:10 964608 —-a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-12 03:43 . 2012-02-01 15:10 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 03:43 . 2012-02-01 13:58 47104 —-a-w- c:\program files\Windows Journal\PDIALOG.exe
2012-05-12 03:42 . 2012-03-01 14:46 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-05-12 03:42 . 2012-02-29 13:41 1069056 —-a-w- c:\windows\system32\DWrite.dll
2012-05-12 03:42 . 2012-02-29 14:08 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-05-12 03:42 . 2012-03-01 14:46 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-05-12 03:42 . 2012-02-29 13:44 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-05-12 03:42 . 2012-04-03 08:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 03:42 . 2012-04-03 08:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-12 03:42 . 2012-04-02 13:36 2044928 —-a-w- c:\windows\system32\win32k.sys
2012-04-27 12:56 . 2012-04-27 12:56 ——– d—–w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-18 15:21 . 2010-04-25 02:14 687560 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-05 13:41 . 2012-04-07 05:37 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 13:41 . 2011-05-17 18:56 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-07 18:53 . 2012-01-05 15:47 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2012-02-29 15:11 . 2012-04-16 20:04 5120 —-a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-16 20:04 172032 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-16 20:04 157696 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-16 20:04 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-05-16 12:18 . 2012-04-15 07:34 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-15 2407184]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WN121T Smart Wizard.lnk - c:\program files\NETGEAR\WN121T\wn121t.exe [2007-8-10 1691648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 19:48 58656 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-11-02 07:25 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
2008-07-11 22:50 19968 —-a-w- c:\windows\System32\Ctxfihlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 06:33 125952 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2011-10-07 09:40 1387288 —-a-w- c:\program files\Logitech\SetPointP\SetPoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 —-a-w- c:\hp\support\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-06-24 23:06 1840424 —-a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-01-17 01:22 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55 55824 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCDMon]
2007-12-14 00:43 2051096 —-a-w- c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LGDCore]
2007-12-14 00:57 2095640 —-a-w- c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2008-08-15 00:11 565008 —-a-w- c:\program files\Common Files\Logishrd\LComMgr\Communications_Helper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxMenuMgr]
2009-03-27 22:53 181544 —-a-w- c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-06-08 16:31 2221352 —-a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-02-10 03:02 3881792 —-a-w- c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-02-10 03:00 108352 —-a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
2012-02-10 03:00 2719040 —-a-w- c:\windows\System32\nvsvc.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SnapfishMediaDetector]
2007-03-02 21:55 1441792 —-a-w- c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-17 18:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\System32\Drivers\Achernar.sys [2007-02-05 18432]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ldlcserv
lfsfilt
us30service
O2SCBUS
SE2Bobex
dnetc
ATKFUSService
jsdaemon
iaantmon
Accelerometer
vaiomediaplatform-videoserver-appserver
Intels51
isamsmt
inorpc
fsaua
ltmodem5
fsaa
websenserealtimeanalyzer
lcs
clientservice
BCMModem
spcstb
s117obex
USIUDF
ipcsvc
Cinemsup
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 13:41]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\users\gordon\AppData\Roaming\Mozilla\Firefox\Profiles\mn9yqrg3.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-20 23:00
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1891602936-3168947478-3105343759-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3a,36,e7,b3,cb,11,d1,e4,f2,15,5e,ba,2e,45,c5,e7,a5,81,54,9a,39,f9,0c,
c5,88,e7,72,6b,40,db,14,b7,1a,dc,10,8a,f9,d5,9c,ca,1c,f5,ba,ca,5d,22,9e,ca,\
"??"=hex:d2,8a,3d,7f,d6,ee,ff,ab,38,51,7b,8c,dc,d7,d2,0c
.
[HKEY_USERS\S-1-5-21-1891602936-3168947478-3105343759-1000\Software\SecuROM\License information*]
"datasecu"=hex:08,8f,8b,c7,9a,fe,86,50,2f,ea,d6,9a,ff,d6,ad,e7,2b,b7,54,cd,c0,
21,d1,d5,b0,d2,e3,4a,41,a9,05,f7,60,42,ba,fa,1e,89,d1,e5,0e,5b,d6,ac,8f,52,\
"rkeysecu"=hex:91,10,40,14,21,50,eb,12,66,05,84,60,6e,52,b2,d9
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-05-20 23:02:46
ComboFix-quarantined-files.txt 2012-05-21 06:02
ComboFix2.txt 2012-05-20 05:23
ComboFix3.txt 2012-05-18 00:43
ComboFix4.txt 2012-05-15 17:32
.
Pre-Run: 42,098,982,912 bytes free
Post-Run: 42,044,063,744 bytes free
.
- - End Of File - - 73EEA02719769AAC9F5AB923A76EAB12
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3070.2032 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\gordon\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\gordon\AppData\Local\Mozilla\Firefox\Profiles\mn9yqrg3.default\Cache\E\00\25288d01"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-366e93c2"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\770adbc3-13f0cc08"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\37db3fe2-6efadbcc"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\263a9144-6a7abf1d"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\7c6df484-55809ec2"
"c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7be78a09-5eec8572"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\gordon\AppData\Local\xkbcpupqr
c:\users\gordon\AppData\Local\xkbcpupqr\wrhvfblshdw.exe
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3cc664c-366e93c2
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\37db3fe2-6efadbcc
c:\users\gordon\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\7be78a09-5eec8572
.
.
————— FCopy —————
.
c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\Vista\klif.sys –> c:\windows\System32\drivers\klif.sys
.
((((((((((((((((((((((((( Files Created from 2012-04-21 to 2012-05-21 )))))))))))))))))))))))))))))))
.
.
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\gordon\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-21 06:00 . 2012-05-21 06:00 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-18 16:13 . 2012-05-18 16:13 ——– d—–w- c:\program files\ESET
2012-05-18 15:22 . 2012-05-18 15:22 ——– d—–w- c:\program files\Common Files\Java
2012-05-18 15:21 . 2012-05-18 15:21 772552 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-05-17 23:22 . 2009-03-08 11:32 72704 —-a-w- c:\windows\system32\admparse.dll
2012-05-16 12:18 . 2012-05-16 12:18 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-05-16 12:18 . 2012-05-16 12:18 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-16 12:18 . 2012-05-16 12:18 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-12 03:43 . 2012-03-20 23:28 53120 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 03:43 . 2012-03-30 12:39 905600 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 03:43 . 2012-02-01 15:11 1218048 —-a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-12 03:43 . 2012-02-01 15:10 1404928 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll
2012-05-12 03:43 . 2012-02-01 15:10 983040 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-12 03:43 . 2012-02-01 15:10 964608 —-a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-12 03:43 . 2012-02-01 15:10 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 03:43 . 2012-02-01 13:58 47104 —-a-w- c:\program files\Windows Journal\PDIALOG.exe
2012-05-12 03:42 . 2012-03-01 14:46 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-05-12 03:42 . 2012-02-29 13:41 1069056 —-a-w- c:\windows\system32\DWrite.dll
2012-05-12 03:42 . 2012-02-29 14:08 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-05-12 03:42 . 2012-03-01 14:46 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-05-12 03:42 . 2012-02-29 13:44 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-05-12 03:42 . 2012-04-03 08:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 03:42 . 2012-04-03 08:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-12 03:42 . 2012-04-02 13:36 2044928 —-a-w- c:\windows\system32\win32k.sys
2012-04-27 12:56 . 2012-04-27 12:56 ——– d—–w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-18 15:21 . 2010-04-25 02:14 687560 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-05 13:41 . 2012-04-07 05:37 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 13:41 . 2011-05-17 18:56 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-07 18:53 . 2012-01-05 15:47 16400 —-a-w- c:\windows\system32\drivers\LNonPnP.sys
2012-02-29 15:11 . 2012-04-16 20:04 5120 —-a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-16 20:04 172032 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-16 20:04 157696 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-16 20:04 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-05-16 12:18 . 2012-04-15 07:34 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-15 2407184]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WN121T Smart Wizard.lnk - c:\program files\NETGEAR\WN121T\wn121t.exe [2007-8-10 1691648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish Media Detector.lnk
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 19:48 58656 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-11-02 07:25 59240 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
2008-07-11 22:50 19968 —-a-w- c:\windows\System32\Ctxfihlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 06:33 125952 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2011-10-07 09:40 1387288 —-a-w- c:\program files\Logitech\SetPointP\SetPoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 —-a-w- c:\hp\support\hpsysdrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-06-24 23:06 1840424 —-a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-01-17 01:22 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55 55824 —-a-w- c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LCDMon]
2007-12-14 00:43 2051096 —-a-w- c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch LGDCore]
2007-12-14 00:57 2095640 —-a-w- c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2008-08-15 00:11 565008 —-a-w- c:\program files\Common Files\Logishrd\LComMgr\Communications_Helper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxMenuMgr]
2009-03-27 22:53 181544 —-a-w- c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-06-08 16:31 2221352 —-a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2012-02-10 03:02 3881792 —-a-w- c:\windows\System32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2012-02-10 03:00 108352 —-a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
2012-02-10 03:00 2719040 —-a-w- c:\windows\System32\nvsvc.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SnapfishMediaDetector]
2007-03-02 21:55 1441792 —-a-w- c:\program files\Snapfish Media Detector\SnapfishMediaDetector.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-17 18:07 252296 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\System32\Drivers\Achernar.sys [2007-02-05 18432]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ldlcserv
lfsfilt
us30service
O2SCBUS
SE2Bobex
dnetc
ATKFUSService
jsdaemon
iaantmon
Accelerometer
vaiomediaplatform-videoserver-appserver
Intels51
isamsmt
inorpc
fsaua
ltmodem5
fsaa
websenserealtimeanalyzer
lcs
clientservice
BCMModem
spcstb
s117obex
USIUDF
ipcsvc
Cinemsup
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 13:41]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\users\gordon\AppData\Roaming\Mozilla\Firefox\Profiles\mn9yqrg3.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-20 23:00
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1891602936-3168947478-3105343759-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3a,36,e7,b3,cb,11,d1,e4,f2,15,5e,ba,2e,45,c5,e7,a5,81,54,9a,39,f9,0c,
c5,88,e7,72,6b,40,db,14,b7,1a,dc,10,8a,f9,d5,9c,ca,1c,f5,ba,ca,5d,22,9e,ca,\
"??"=hex:d2,8a,3d,7f,d6,ee,ff,ab,38,51,7b,8c,dc,d7,d2,0c
.
[HKEY_USERS\S-1-5-21-1891602936-3168947478-3105343759-1000\Software\SecuROM\License information*]
"datasecu"=hex:08,8f,8b,c7,9a,fe,86,50,2f,ea,d6,9a,ff,d6,ad,e7,2b,b7,54,cd,c0,
21,d1,d5,b0,d2,e3,4a,41,a9,05,f7,60,42,ba,fa,1e,89,d1,e5,0e,5b,d6,ac,8f,52,\
"rkeysecu"=hex:91,10,40,14,21,50,eb,12,66,05,84,60,6e,52,b2,d9
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-05-20 23:02:46
ComboFix-quarantined-files.txt 2012-05-21 06:02
ComboFix2.txt 2012-05-20 05:23
ComboFix3.txt 2012-05-18 00:43
ComboFix4.txt 2012-05-15 17:32
.
Pre-Run: 42,098,982,912 bytes free
Post-Run: 42,044,063,744 bytes free
.
- - End Of File - - 73EEA02719769AAC9F5AB923A76EAB12
Blade81
Hi,
Does Kaspersky still fail to load? If it does then it has to be reinstalled. Infection harmed one or more of its files.
Coug01
Hi,
Yes it does and thought as much.
Blade81
Ok, please reinstall Kaspersky and let me know if it works.
Coug01
Hi,
Can't find the disk.
Blade81
Hi,
If you can't find installation media then only option at this point is to replace Kaspersky product with other antivirus protection.
Good free antivirus programs are:
Antivir and
Avast!
If you can't find installation media then only option at this point is to replace Kaspersky product with other antivirus protection.
Good free antivirus programs are:
Antivir and
Avast!
Coug01
Hi,
Thanks.
Blade81
Any other issues left or should we move on to the final steps?
Coug01
Hi,
No issues that stand out presently.
Blade81
Good, it's time to secure your system to prevent against further intrusions.
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
A To disable the System Restore feature:
1. Click on the Start button.
2. Hover over the Computer option, right click on it and then click Properties.
3. On the left hand side, click Advanced Settings.
4. If asked to permit the action, click on Allow.
5. Click on the System Protection tab.
6. Uncheck any checkboxes listed for your hard drives.
7. Press OK.
B. Reboot.
C Turn ON System Restore.
Follow the steps like you did when disabling system restore but on step 6. check any checkboxes listed for your hard drives.
Now lets uninstall ComboFix:
Time to uninstall OTL next:
Note: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.
Download and run Secunia Personal Software Inspector (PSI) and fix its findings. Leave the program installed so you'll stay alarmed about vulnerable components in future too.
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system… problems etc.
Have a great day,
Blade
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
A To disable the System Restore feature:
1. Click on the Start button.
2. Hover over the Computer option, right click on it and then click Properties.
3. On the left hand side, click Advanced Settings.
4. If asked to permit the action, click on Allow.
5. Click on the System Protection tab.
6. Uncheck any checkboxes listed for your hard drives.
7. Press OK.
B. Reboot.
C Turn ON System Restore.
Follow the steps like you did when disabling system restore but on step 6. check any checkboxes listed for your hard drives.
Now lets uninstall ComboFix:
- Click START then RUN
- Now copy-paste Combofix /uninstall in the runbox and click OK
Time to uninstall OTL next:
- Double-click OTL.exe.
- Click the CleanUp! button.
- Select Yes when the
Begin cleanup Process?
prompt appears. - If you are prompted to Reboot during the cleanup, select Yes.
- The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.
Download and run Secunia Personal Software Inspector (PSI) and fix its findings. Leave the program installed so you'll stay alarmed about vulnerable components in future too.
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system… problems etc.
Have a great day,
Blade
Coug01
a RMBR.3xe? and a handle viewer popped up during the combofix uninstall on Kaspersky. What should I do? Now that combofix is uninstalled?
Blade81
If ComboFix uninstallation was successful follow rest of the instructions in my previous post, please.
Blade81
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI