What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Possible golrjkntt.dll infection [Closed]

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
malware results Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.03.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 A Southard Design :: ASOUTHARDDESIGN [administrator] 8/3/2012 5:35:57 PM mbam-log-2012-08-03 (17-40-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 255578 Time elapsed: 3 minute(s), 49 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 5 HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> No action taken. HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6} (Adware.GamePlayLab) -> No action taken. HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> No action taken. HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> No action taken. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 4 C:\Users\A Southard Design.asoutharddesign\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> No action taken. C:\Users\A Southard Design.asoutharddesign\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> No action taken. C:\Users\A Southard Design.asoutharddesign\AppData\Local\funmoods.crx (PUP.Funmoods) -> No action taken. C:\Users\A Southard Design.asoutharddesign\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> No action taken. (end)
Post #18
Yes, I've tried to uninstall vgrabber, but it don't budge. here is the log from the last log C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\4jEIPlug.dll.vir Win32/Toolbar.MyWebSearch application C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\4jEZSETP.dll.vir Win32/Toolbar.MyWebSearch.Q application C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4jEI\Installr\1.bin\NP4jEISb.dll.vir Win32/Toolbar.MyWebSearch application C:\Users\A Southard Design.asoutharddesign\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\components\xpcomponent.dll probably a variant of Win32/Adware.Gamevance.CI application
Post #19
Hi nikid506, Thanks for the information. You didn't take any action on the malicious files that Malwarebytes detected. I need you to run a quick scan again, click show results when it has finished, check every entry that it found, then click remove selected. Post the log again after it has finished. We can deal with vGrabber manually after this.
Post #21
oh, i see what your saying. sorry, i thought i did select remove all, but okay let me try again. sorry i'm just getting back to you – i thought i was waiting on your reply.
Post #23
here is the log. i didn't have to remove anything. ty Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.07.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 A Southard Design :: ASOUTHARDDESIGN [administrator] 8/7/2012 5:22:02 PM mbam-log-2012-08-07 (17-22-02).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 258235 Time elapsed: 4 minute(s), 40 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #24 last edited
Hi nikid506,

Looking good :)

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :folderfind
*vgrabber*

:filefind
*vgrabber*

:regfind
vgrabber
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #25
here you go. SystemLook 30.07.11 by jpshortstuff Log created at 22:32 on 08/08/2012 by A Southard Design Administrator - Elevation successful WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results. ========== folderfind ========== Searching for "*vgrabber*" C:\Program Files (x86)\vGrabber d—— [02:01 23/10/2011] C:\Users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber d—— [02:01 23/10/2011] ========== filefind ========== Searching for "*vgrabber*" C:\Users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber\vGrabber.lnk –a—- 1050 bytes [02:01 23/10/2011] [02:01 23/10/2011] 26C4504364FE1AF3C3DD7CE0EF8E2021 C:\Users\a southard design\Desktop\vGrabber YouTube Download.lnk –a—- 1890 bytes [02:01 23/10/2011] [02:01 23/10/2011] BEB5AA020AF910EBEE5D1EBEFDB8DB38 ========== regfind ========== Searching for "vgrabber" [HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\vGrabber] [HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files (x86)\vGrabber] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "DisplayName"="vGrabber" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "UninstallString"=""C:\Program Files (x86)\vGrabber\uninstall.exe"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "QuietUninstallString"=""C:\Program Files (x86)\vGrabber\uninstall.exe" /S" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "DisplayIcon"="C:\Program Files (x86)\vGrabber\Applications\vGrabber\appicon.ico" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "Publisher"="http://vgrabber.org" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "RegOwner"="http://vgrabber.org" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "RegCompany"="http://vgrabber.org" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "HelpLink"="http://vgrabber.org" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "InstallLocation"="C:\Program Files (x86)\vGrabber" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vGrabber] "Comments"="vGrabber setup" [HKEY_USERS\S-1-5-21-2729111025-2427052716-901129613-1005\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files (x86)\vGrabber] [HKEY_USERS\S-1-5-21-2729111025-2427052716-901129613-1005\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files (x86)\vGrabber] -= EOF =-
Post #26
Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

Folder::
C:\Program Files (x86)\vGrabber
C:\Users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber

File::
C:\Users\a southard design\Desktop\vGrabber YouTube Download.lnk
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste
Post #27
ComboFix 12-08-08.03 - A Southard Design 08/09/2012 3:10.5.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.2060 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\A Southard Design.asoutharddesign\Desktop\CFScript.txt AV: Bitdefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92} FW: Bitdefender Firewall *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9} SP: Bitdefender Antispyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . FILE :: "c:\users\a southard design\Desktop\vGrabber YouTube Download.lnk" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\vGrabber c:\program files (x86)\vGrabber\appicon.ico c:\program files (x86)\vGrabber\imageformats\qgif4.dll c:\program files (x86)\vGrabber\imageformats\qjpeg4.dll c:\program files (x86)\vGrabber\libgcc_s_dw2-1.dll c:\program files (x86)\vGrabber\mingwm10.dll c:\program files (x86)\vGrabber\phonon4.dll c:\program files (x86)\vGrabber\QtCore4.dll c:\program files (x86)\vGrabber\QtGui4.dll c:\program files (x86)\vGrabber\QtNetwork4.dll c:\program files (x86)\vGrabber\QtWebKit4.dll c:\program files (x86)\vGrabber\Uninstall.exe c:\program files (x86)\vGrabber\youtubeDL.exe c:\users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber c:\users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber\Uninstall.lnk c:\users\a southard design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\vGrabber\vGrabber.lnk c:\users\a southard design\Desktop\vGrabber YouTube Download.lnk . . ((((((((((((((((((((((((( Files Created from 2012-07-09 to 2012-08-09 ))))))))))))))))))))))))))))))) . . 2012-08-09 07:20 . 2012-08-09 07:20 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-08-09 07:20 . 2012-08-09 07:20 ——– d—–w- c:\users\Ryan\AppData\Local\temp 2012-08-09 07:20 . 2012-08-09 07:20 ——– d—–w- c:\users\Mia\AppData\Local\temp 2012-08-09 07:20 . 2012-08-09 07:20 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-08-09 07:20 . 2012-08-09 07:20 ——– d—–w- c:\users\a southard design\AppData\Local\temp 2012-08-07 09:06 . 2012-08-07 09:06 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8EB9FF8F-AC70-402F-BF79-0F40BE0C4096}\offreg.dll 2012-08-07 09:05 . 2012-06-29 10:04 9133488 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8EB9FF8F-AC70-402F-BF79-0F40BE0C4096}\mpengine.dll 2012-08-03 21:49 . 2012-08-03 21:49 ——– d—–w- c:\program files (x86)\ESET 2012-08-03 21:35 . 2012-08-03 21:35 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Malwarebytes 2012-08-03 21:34 . 2012-08-03 21:34 ——– d—–w- c:\programdata\Malwarebytes 2012-08-03 21:34 . 2012-08-07 21:21 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-08-03 21:34 . 2012-07-03 17:46 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-08-03 21:29 . 2012-08-03 21:29 ——– d—–w- c:\program files (x86)\Common Files\Java 2012-08-03 21:29 . 2012-08-03 21:29 ——– d—–w- c:\program files (x86)\Oracle 2012-08-03 21:28 . 2012-07-06 02:06 772544 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-08-02 21:57 . 2012-08-02 21:57 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\ArcSoft 2012-07-27 04:48 . 2012-01-12 13:28 57976 —-a-r- c:\windows\system32\drivers\SBREDrv.sys 2012-07-27 04:33 . 2012-07-27 04:33 388096 —-a-r- c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-07-27 04:33 . 2012-07-27 04:33 ——– d—–w- c:\program files (x86)\Trend Micro 2012-07-27 04:21 . 2012-07-27 04:21 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Macromedia 2012-07-27 04:19 . 2012-07-27 04:19 ——– d—–w- c:\users\A Southard Design.asoutharddesign\AppData\Local\Mozilla 2012-07-27 04:18 . 2012-08-01 01:24 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-07-27 04:18 . 2012-08-02 04:51 ——– d—–w- c:\program files\PrivacySafeGuard 2012-07-25 16:34 . 2012-07-25 16:34 ——– d—–w- c:\users\Mia\AppData\Local\Apple Computer 2012-07-25 16:33 . 2012-07-25 16:33 ——– d—–w- c:\users\Mia\AppData\Local\CrashDumps 2012-07-18 16:50 . 2012-07-23 01:23 ——– d—–w- c:\programdata\Tarma Installer 2012-07-12 02:54 . 2012-06-12 03:08 3148800 —-a-w- c:\windows\system32\win32k.sys 2012-07-11 19:18 . 2012-06-09 05:43 14172672 —-a-w- c:\windows\system32\shell32.dll 2012-07-11 19:17 . 2012-06-06 06:05 495616 —-a-w- c:\program files\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 06:05 466944 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 06:05 1499136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 06:05 258048 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll 2012-07-11 19:17 . 2012-06-06 05:05 1019904 —-a-w- c:\program files (x86)\Common Files\System\ado\msado15.dll 2012-07-11 19:17 . 2012-06-06 05:03 805376 —-a-w- c:\windows\SysWow64\cdosys.dll 2012-07-11 19:17 . 2012-06-06 06:05 61440 —-a-w- c:\program files\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 06:02 1133568 —-a-w- c:\windows\system32\cdosys.dll 2012-07-11 19:17 . 2012-06-06 05:05 143360 —-a-w- c:\program files (x86)\Common Files\System\ado\msjro.dll 2012-07-11 19:17 . 2012-06-06 05:05 372736 —-a-w- c:\program files (x86)\Common Files\System\ado\msadox.dll 2012-07-11 19:17 . 2012-06-06 05:05 57344 —-a-w- c:\program files (x86)\Common Files\System\ado\msador15.dll 2012-07-11 19:17 . 2012-06-06 05:05 352256 —-a-w- c:\program files (x86)\Common Files\System\ado\msadomd.dll 2012-07-11 19:17 . 2012-06-06 05:05 212992 —-a-w- c:\program files (x86)\Common Files\System\msadc\msadco.dll 2012-07-11 03:53 . 2012-07-11 03:53 ——– d—–w- c:\users\Mia\AppData\Roaming\.minecraft . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-03 13:24 . 2012-04-04 10:38 426184 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-08-03 13:24 . 2011-10-11 17:37 70344 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-29 02:22 . 2012-07-29 02:23 416 —-a-w- c:\windows\Fonts\HARRINGT.pfm 2012-07-12 02:52 . 2011-10-03 17:12 59701280 —-a-w- c:\windows\system32\MRT.exe 2012-07-06 02:06 . 2011-05-09 00:58 687544 —-a-w- c:\windows\SysWow64\deployJava1.dll 2012-07-02 16:01 . 2012-07-02 16:01 21656 —-a-w- c:\windows\system32\drivers\evolve.sys 2012-06-02 22:19 . 2012-06-19 10:13 38424 —-a-w- c:\windows\system32\wups.dll 2012-06-02 22:19 . 2012-06-19 10:13 2428952 —-a-w- c:\windows\system32\wuaueng.dll 2012-06-02 22:19 . 2012-06-19 10:13 57880 —-a-w- c:\windows\system32\wuauclt.exe 2012-06-02 22:19 . 2012-06-19 10:13 44056 —-a-w- c:\windows\system32\wups2.dll 2012-06-02 22:19 . 2012-06-19 10:13 701976 —-a-w- c:\windows\system32\wuapi.dll 2012-06-02 22:15 . 2012-06-19 10:13 2622464 —-a-w- c:\windows\system32\wucltux.dll 2012-06-02 22:15 . 2012-06-19 10:13 99840 —-a-w- c:\windows\system32\wudriver.dll 2012-06-02 19:19 . 2012-06-19 10:13 186752 —-a-w- c:\windows\system32\wuwebv.dll 2012-06-02 19:15 . 2012-06-19 10:13 36864 —-a-w- c:\windows\system32\wuapp.exe 2012-05-31 16:25 . 2011-11-02 04:31 279656 ——w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((( SnapShot@2012-08-02_04.55.33 ))))))))))))))))))))))))))))))))))))))))) . - 2012-07-31 17:09 . 2012-07-31 17:09 13271 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2012-08-03 21:41 . 2012-08-03 21:41 13271 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat + 2011-05-09 01:02 . 2012-08-03 21:44 44018 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-08-03 21:44 40190 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-12-29 00:17 . 2008-05-08 00:59 99840 c:\windows\system32\spool\prtprocs\x64\2_HPZPPLHN.DLL + 2012-03-06 03:04 . 2012-08-03 21:44 7536 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2729111025-2427052716-901129613-1005_UserData.bin - 2012-08-01 01:25 . 2012-08-01 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-08-03 21:42 . 2012-08-03 21:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-08-03 21:42 . 2012-08-03 21:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-08-01 01:25 . 2012-08-01 06:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-08-03 13:24 . 2012-08-03 13:24 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_Plugin.exe + 2012-08-03 12:24 . 2012-08-03 12:24 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe + 2012-08-03 12:24 . 2012-08-03 12:24 466632 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.dll - 2012-04-04 10:38 . 2012-07-27 04:24 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-04-04 10:38 . 2012-08-03 13:24 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe + 2012-08-03 21:28 . 2012-07-06 02:06 227760 c:\windows\SysWOW64\javaws.exe + 2012-08-03 21:28 . 2012-08-03 21:28 174064 c:\windows\SysWOW64\javaw.exe + 2012-08-03 21:28 . 2012-08-03 21:28 174064 c:\windows\SysWOW64\java.exe + 2011-09-20 23:04 . 2012-08-04 01:24 294566 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2011-09-02 23:55 . 2012-08-09 00:41 273734 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 02:36 . 2012-08-09 06:07 633770 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-08-02 04:13 633770 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-08-02 04:13 111114 c:\windows\system32\perfc009.dat + 2009-07-14 02:36 . 2012-08-09 06:07 111114 c:\windows\system32\perfc009.dat + 2012-08-03 13:24 . 2012-08-03 13:24 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_Plugin.exe + 2012-08-03 12:24 . 2012-08-03 12:24 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.exe + 2012-08-03 12:24 . 2012-08-03 12:24 513224 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.dll - 2009-07-14 05:01 . 2012-07-31 17:09 449064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-08-03 21:41 449064 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2012-08-03 21:29 . 2012-08-03 21:29 179200 c:\windows\Installer\384b6.msi + 2012-08-03 21:28 . 2012-08-03 21:28 461312 c:\windows\Installer\384b0.msi + 2012-08-03 13:24 . 2012-08-03 13:24 9465032 c:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll + 2012-08-03 13:24 . 2012-08-03 13:24 1536712 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe + 2012-08-03 13:24 . 2012-08-03 13:24 12315336 c:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll + 2012-03-06 03:50 . 2012-08-03 21:41 27553882 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2729111025-2427052716-901129613-1005-8192.dat + 2012-03-06 03:50 . 2012-08-03 21:24 20110936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2729111025-2427052716-901129613-1005-4096.dat - 2012-03-06 03:50 . 2012-07-31 17:09 20110936 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2729111025-2427052716-901129613-1005-4096.dat + 2012-08-03 21:27 . 2012-08-03 21:27 17379840 c:\windows\Installer\384ac.msi . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240] "Facebook Update"="c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-04-04 35736] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-08-19 487562] "Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528] "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112] "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "AgentMonitor"="c:\program files (x86)\VTech\DownloadManager\System\AgentMonitor.exe" [2012-06-28 365512] "AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 960032] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056] R3 AthDfu;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys [2010-12-16 51872] R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [2012-03-02 545064] R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [2012-02-03 79952] R3 EvolveVirtualAdapter;Evolve Virtual Miniport Driver;c:\windows\system32\DRIVERS\evolve.sys [2012-07-02 21656] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 136176] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-31 113120] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184] R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-01 250984] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-15 466736] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-09-22 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [2012-04-06 691896] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-15 90192] S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-15 103504] S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [2010-01-19 103944] S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2012-01-12 57976] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Dell Wireless\Ath_CoexAgent.exe [2010-10-01 151552] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2010-12-17 53920] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280] S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-04-06 66096] S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2010-12-17 36000] S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [2011-11-25 258736] S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2010-12-17 298144] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2010-12-16 28832] S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2010-12-16 201376] S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2010-12-17 55456] S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2010-12-16 154272] S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2010-12-17 275616] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-19 80384] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-19 181248] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240] S3 SafeBox;SafeBox;c:\program files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [2012-03-02 75384] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920] . . Contents of the 'Scheduled Tasks' folder . 2012-08-09 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 13:24] . 2012-08-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-30 20:56] . 2012-08-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005Core.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1005UA.job - c:\users\A Southard Design.asoutharddesign\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-29 01:11] . 2012-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-03 12:12] . 2012-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000Core.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1000UA.job - c:\users\a southard design\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-07 06:16] . 2012-08-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006Core.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2729111025-2427052716-901129613-1006UA.job - c:\users\Mia\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-01 19:05] . 2012-08-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . 2012-08-09 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:32] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox1] @="{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}" [HKEY_CLASSES_ROOT\CLSID\{152C96EB-288E-4EDC-B7C6-D21F8250ADF3}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox2] @="{342DAA0B-D796-460D-8566-901E08A1CCAD}" [HKEY_CLASSES_ROOT\CLSID\{342DAA0B-D796-460D-8566-901E08A1CCAD}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox3] @="{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}" [HKEY_CLASSES_ROOT\CLSID\{57595DAE-1AE1-4D97-A49E-67CBB53B52DF}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\__SafeBox4] @="{33816773-98AE-4723-ADE0-EBE54C8B5A67}" [HKEY_CLASSES_ROOT\CLSID\{33816773-98AE-4723-ADE0-EBE54C8B5A67}] 2012-03-02 02:12 266952 ——w- c:\program files\Bitdefender\Bitdefender Safebox\safeboxshell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-12-14 6561384] "AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2010-12-17 613536] "AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2010-12-17 379040] "BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-04-06 1067256] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-07 167256] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-07 391512] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-07 415064] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mLocal Page = c:\windows\SysWOW64\blank.htm Trusted Zone: state.nj.us\vpn1.judiciary TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\A Southard Design.asoutharddesign\AppData\Roaming\Mozilla\Firefox\Profiles\3xbe4tw4.default\ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-10 - (no file) AddRemove-vGrabber - c:\program files (x86)\vGrabber\uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11, d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54 "{5911488E-9D1E-40EC-8CBB-06B231CC153F}"=hex:51,66,7a,6c,4c,1d,38,12,e0,4b,02, 5d,2c,d3,82,05,f3,ad,45,f2,34,92,51,2b "{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a, eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c "{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90, 43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87 "{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8, 89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b "{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54, 06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64 "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34, 5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38 "{5AB7104A-B71F-49AD-9154-F7F8806AE848}"=hex:51,66,7a,6c,4c,1d,38,12,24,13,a4, 5e,2d,f9,c3,0c,ee,42,b4,b8,85,34,ac,5c "{6E13D095-45C3-4271-9475-F3B48227DD9F}"=hex:51,66,7a,6c,4c,1d,38,12,fb,d3,00, 6a,f1,0b,1f,07,eb,63,b0,f4,87,79,99,8b "{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}"=hex:51,66,7a,6c,4c,1d,38,12,aa,f5,03, 89,33,40,ba,0e,f9,17,52,ec,1a,81,c5,32 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce, 9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d "{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f, aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04 "{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}"=hex:51,66,7a,6c,4c,1d,38,12,07,5b,93, aa,6e,60,ba,0b,f0,6d,b2,b7,80,44,00,83 "{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd, d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b "{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}"=hex:51,66,7a,6c,4c,1d,38,12,b0,f3,37, dc,52,73,39,0a,e1,a7,25,43,3b,93,ce,af "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f, e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec "{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be, f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95 "{182EC0BE-5110-49C8-A062-BEB1D02A220B}"=hex:51,66,7a,6c,4c,1d,38,12,d0,c3,3d, 1c,22,1f,a6,0c,df,74,fd,f1,d5,74,66,1f "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-08-09 03:22:57 ComboFix-quarantined-files.txt 2012-08-09 07:22 ComboFix2.txt 2012-08-03 12:14 ComboFix3.txt 2012-08-02 05:02 . Pre-Run: 233,429,446,656 bytes free Post-Run: 233,793,835,008 bytes free . - - End Of File - - EF035BE1DEF50DF1C18A0A55782A2E29

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI