What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

illegitimate explorer.exe on start up in location [Closed]

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I knew there were many things changing and not right happening on my computer. I have never experienced anything as crazy as this. I have tried many scanners and nothing was reported. I believe my my computer is infected with many worms. I have always used Microsoft Security Client and this is the first time it has completely failed me! Please help me get rid of them. Tawny
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!! :thumbup:
———-

Please download DDS from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
    Vista and Windows 7 users right click the icon and choose "Run as administrator".
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe. :)
Post #3 last edited
Hi Jeff, When I ran the aswMBR.exe it caused my computer to reboot. I had to then use my Windows 7 back up disc to repair it said system configuration settings. Before I tried that again I wanted to ask you if that's a good or bad idea? :pullhair: Tawny

Attachments:

Post #4
Hi,

Yes it would be good to ask before doing anything just to be on the safe side. :)

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • click OK
  • Press Start Scan
  • If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
  • Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct
    items.
  • Attach the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)
———-
Post #6
Hi,

Download Combofix from the link below, and save it to your desktop.
Link

**Note: It is important that it is saved directly to your desktop**
If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.


——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
———-
Post #8
Hi,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

**If you are using a 64bit system please use either of the following links for your download instead:
Link 1
Link 2

  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content within the following codebox into the main textfield:
    :dir
c:\users\Tawny\AppData\Local\ArcadeCandy /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #10
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


    ClearJavaCache::

    Folder::
    c:\users\Tawny\AppData\Roaming\IObit
    c:\program files\IObit

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #11
:D Hi Jeff,
That was cool and a little scary all at the same time!

ComboFix 12-08-22.03 - Tawny 08/23/2012 23:02:32.2.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.2040.1001 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Tawny\Desktop\CFScript.txt
AV: Microsoft Security Essentials Prerelease *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: Microsoft Security Essentials Prerelease *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\IObit
c:\program files\IObit\RegOptimizer\JetClean_Log.txt
c:\program files\IObit\RegOptimizer\RegOptimizerBackWork.ini
c:\program files\IObit\RegOptimizer\Update\Update.Ini
c:\users\Tawny\AppData\Roaming\IObit
c:\users\Tawny\AppData\Roaming\IObit\RegOptimizer\Config.ini
c:\users\Tawny\AppData\Roaming\IObit\RegOptimizer\Ignore.ini
c:\users\Tawny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchU3.exe.lnk
.
.
((((((((((((((((((((((((( Files Created from 2012-07-24 to 2012-08-24 )))))))))))))))))))))))))))))))
.
.
2012-08-24 06:14 . 2012-08-24 06:14 ——– d—–w- c:\users\Guest\AppData\Local\temp
2012-08-24 06:14 . 2012-08-24 06:14 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-08-24 05:39 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F989E51-DEF8-4889-A07D-84DA743FBD72}\mpengine.dll
2012-08-24 01:19 . 2012-08-24 01:19 ——– d—–w- c:\users\Tawny\AppData\Local\e-academy Inc
2012-08-24 01:19 . 2012-08-24 01:19 ——– d—–w- c:\users\Tawny\AppData\Roaming\e-academy Inc
2012-08-23 23:03 . 2012-08-23 23:03 ——– d—–w- c:\programdata\U3
2012-08-23 02:01 . 2012-08-01 22:51 7023536 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-22 23:35 . 2012-08-17 04:37 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-08-22 23:35 . 2012-08-17 04:37 740784 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7BD7D5C5-AE60-40EB-920B-EB6AF7F8433B}\gapaengine.dll
2012-08-21 22:22 . 2012-08-23 00:25 ——– d—–w- c:\program files\Emsisoft Anti-Malware
2012-08-21 08:31 . 2012-08-23 00:25 ——– d—–w- c:\programdata\Norton
2012-08-21 08:31 . 2012-08-23 00:25 ——– d—–w- c:\program files\Norton PC Checkup
2012-08-21 08:28 . 2012-08-21 08:28 ——– d—–w- c:\program files\NortonInstaller
2012-08-21 06:47 . 2012-08-21 06:47 ——– d—–w- c:\users\Tawny\AppData\Local\DoNotTrackPlus
2012-08-21 05:29 . 2012-08-21 05:29 ——– d—–w- c:\programdata\UAB
2012-08-21 05:28 . 2012-08-21 05:28 ——– d—–w- c:\programdata\Driver Boost
2012-08-21 05:27 . 2012-08-21 05:27 ——– d—–w- c:\program files\DriverBoost
2012-08-18 20:11 . 2012-08-18 20:11 ——– d—–w- c:\users\Tawny\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-18 09:21 . 2009-08-20 07:50 22872 —-a-r- c:\windows\system32\AdobePDFUI.dll
2012-08-18 09:15 . 2012-07-30 21:52 103904 —-a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-08-17 06:50 . 2012-08-17 06:50 ——– d—–w- c:\windows\en
2012-08-17 06:49 . 2012-07-28 09:53 49088 —-a-w- c:\windows\system32\drivers\fssfltr.sys
2012-08-17 06:44 . 2010-06-02 11:55 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll
2012-08-17 06:44 . 2010-06-02 11:55 527192 —-a-w- c:\windows\system32\XAudio2_7.dll
2012-08-17 06:44 . 2010-05-26 18:41 248672 —-a-w- c:\windows\system32\d3dx11_43.dll
2012-08-17 06:44 . 2010-05-26 18:41 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll
2012-08-17 06:41 . 2012-08-17 06:41 ——– d—–w- c:\program files\Microsoft SkyDrive
2012-08-17 06:41 . 2012-08-17 06:40 5563840 —-a-w- c:\program files\Common Files\Windows Live\.cache\2ca2124d1cd7c4304\skydrivesetup.exe
2012-08-17 06:41 . 2012-08-17 06:41 ——– d—–r- c:\users\Tawny\SkyDrive
2012-08-17 06:41 . 2012-08-17 06:41 ——– d—–w- c:\programdata\Microsoft SkyDrive
2012-08-17 06:40 . 2012-08-17 06:40 525656 —-a-w- c:\program files\Common Files\Windows Live\.cache\2fbd67b31cd7c4305\DXSETUP.exe
2012-08-17 06:40 . 2012-08-17 06:40 1691480 —-a-w- c:\program files\Common Files\Windows Live\.cache\2fbd67b31cd7c4305\dsetup32.dll
2012-08-17 06:40 . 2012-08-17 06:40 94040 —-a-w- c:\program files\Common Files\Windows Live\.cache\2fbd67b31cd7c4305\DSETUP.dll
2012-08-17 06:40 . 2012-08-17 06:40 537432 —-a-w- c:\program files\Common Files\Windows Live\.cache\29685f061cd7c4303\DXSETUP.exe
2012-08-17 06:40 . 2012-08-17 06:40 1801048 —-a-w- c:\program files\Common Files\Windows Live\.cache\29685f061cd7c4303\dsetup32.dll
2012-08-17 06:40 . 2012-08-17 06:40 89944 —-a-w- c:\program files\Common Files\Windows Live\.cache\29685f061cd7c4303\DSETUP.dll
2012-08-17 06:39 . 2012-08-17 06:39 537432 —-a-w- c:\program files\Common Files\Windows Live\.cache\17ae4ce41cd7c4301\DXSETUP.exe
2012-08-17 06:39 . 2012-08-17 06:39 1801048 —-a-w- c:\program files\Common Files\Windows Live\.cache\17ae4ce41cd7c4301\dsetup32.dll
2012-08-17 06:39 . 2012-08-17 06:39 89944 —-a-w- c:\program files\Common Files\Windows Live\.cache\17ae4ce41cd7c4301\DSETUP.dll
2012-08-17 05:05 . 2012-08-17 05:05 ——– d—–w- c:\users\Tawny\AppData\Local\eSupport.com
2012-08-17 05:05 . 2012-08-17 05:05 23456 —-a-w- c:\windows\system32\drivers\DrvAgent32.sys
2012-08-17 04:32 . 2012-08-23 22:52 ——– d—–w- c:\program files\Microsoft Security Client
2012-08-17 04:23 . 2012-08-17 04:33 ——– d—–w- C:\b455b1800e03e87c0548fc764d
2012-08-15 10:03 . 2012-06-29 00:00 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-08-15 10:03 . 2012-06-29 01:00 140920 —-a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-08-15 10:03 . 2012-06-29 00:06 194560 —-a-w- c:\program files\Internet Explorer\ieproxy.dll
2012-08-15 10:03 . 2012-06-29 00:06 194048 —-a-w- c:\program files\Internet Explorer\IEShims.dll
2012-08-15 05:37 . 2012-05-05 07:46 400896 —-a-w- c:\windows\system32\srcore.dll
2012-08-15 05:37 . 2012-07-18 17:47 2345984 —-a-w- c:\windows\system32\win32k.sys
2012-08-15 05:37 . 2012-07-04 21:14 41984 —-a-w- c:\windows\system32\browcli.dll
2012-08-15 05:37 . 2012-07-04 21:14 102912 —-a-w- c:\windows\system32\browser.dll
2012-08-15 05:37 . 2012-02-11 05:43 492032 —-a-w- c:\windows\system32\win32spl.dll
2012-08-15 05:37 . 2012-02-11 05:37 317440 —-a-w- c:\windows\system32\spoolsv.exe
2012-08-15 05:37 . 2012-05-14 04:33 769024 —-a-w- c:\windows\system32\localspl.dll
2012-08-12 07:39 . 2012-08-23 00:25 ——– d—–w- c:\program files\Coupons
2012-08-12 03:22 . 2012-08-23 00:24 ——– d—–w- c:\program files\Coupon AlertChr
2012-08-12 03:16 . 2012-08-23 00:25 ——– d—–w- c:\program files\The Weather Channel FW
2012-08-12 03:16 . 2012-08-23 00:25 ——– d—–w- c:\users\Tawny\AppData\Local\The Weather Channel
2012-08-12 03:15 . 2012-08-23 00:25 ——– d—–w- c:\users\Tawny\AppData\Local\ArcadeCandy
2012-08-10 04:52 . 2012-08-10 04:52 ——– d—–w- c:\users\Tawny\AppData\Roaming\BlueSprig
2012-08-09 18:46 . 2012-08-09 18:46 182192 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-04 21:29 . 2012-08-04 21:29 ——– d—–w- c:\program files\DoNotTrackPlus
2012-08-03 20:36 . 2012-08-03 20:36 63120 —-a-r- c:\users\Tawny\AppData\Roaming\Microsoft\Installer\{C199DEA2-657E-46C2-9FDB-7C1C068B6B35}\ARPPRODUCTICON.exe
2012-08-03 20:36 . 2012-08-03 20:36 ——– d—–w- c:\users\Tawny\AppData\Local\DIRECTV Player
2012-08-01 21:40 . 2012-08-01 21:40 74703 —-a-w- c:\windows\system32\mfc45.dll
2012-08-01 21:39 . 2012-08-01 21:59 ——– d—–w- c:\programdata\iolo
2012-07-31 04:23 . 2012-07-31 04:23 ——– d—–w- c:\programdata\Trymedia
2012-07-31 04:22 . 2012-07-31 04:22 ——– d—–w- c:\users\Tawny\AppData\Roaming\Sahmon Games
2012-07-28 10:09 . 2012-07-28 10:09 57792 —-a-w- c:\windows\system32\sirenacm.dll
2012-07-28 09:54 . 2012-07-28 09:54 321472 —-a-w- c:\windows\WLXPGSS.SCR
2012-07-27 02:08 . 2012-07-27 02:08 862664 —-a-w- c:\windows\system32\msvcr110.dll
2012-07-27 02:08 . 2012-07-27 02:08 534480 —-a-w- c:\windows\system32\msvcp110.dll
2012-07-27 02:08 . 2012-07-27 02:08 251864 —-a-w- c:\windows\system32\vccorlib110.dll
2012-07-27 02:08 . 2012-07-27 02:08 153536 —-a-w- c:\windows\system32\atl110.dll
2012-07-27 02:08 . 2012-07-27 02:08 115656 —-a-w- c:\windows\system32\vcomp110.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-15 07:44 . 2012-04-02 23:21 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-15 07:44 . 2012-02-15 20:16 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-09 18:46 . 2012-06-05 14:29 90160 —-a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-07-17 21:49 . 2012-07-17 21:49 209648 —-a-w- c:\windows\system32\LIVESSP.DLL
2012-07-17 21:37 . 2012-07-17 21:37 19736 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-07-16 09:41 . 2012-07-19 07:40 6891424 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB3FA6EB-DEB3-40EA-9CB9-C59A844F460D}\mpengine.dll
2012-06-20 16:54 . 2012-01-30 04:25 71104 —-a-w- c:\windows\CouponPrinter.ocx
2012-06-07 03:59 . 2012-06-07 03:59 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-06 05:05 . 2012-07-11 21:16 1390080 —-a-w- c:\windows\system32\msxml6.dll
2012-06-06 05:05 . 2012-07-11 21:16 1236992 —-a-w- c:\windows\system32\msxml3.dll
2012-06-06 05:03 . 2012-07-11 21:16 805376 —-a-w- c:\windows\system32\cdosys.dll
2012-06-02 22:19 . 2012-06-18 22:53 171904 —-a-w- c:\windows\system32\wuwebv.dll
2012-06-02 22:19 . 2012-06-18 22:53 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-18 22:53 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-18 22:53 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-18 22:53 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-18 22:53 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-18 22:53 2422272 —-a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-18 22:53 33792 —-a-w- c:\windows\system32\wuapp.exe
2012-06-02 22:12 . 2012-06-18 22:53 88576 —-a-w- c:\windows\system32\wudriver.dll
2012-06-02 04:45 . 2012-07-11 21:16 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 04:45 . 2012-07-11 21:16 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 04:40 . 2012-07-11 21:16 369336 —-a-w- c:\windows\system32\drivers\cng.sys
2012-06-02 04:40 . 2012-07-11 21:16 225280 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 04:39 . 2012-07-11 21:16 219136 —-a-w- c:\windows\system32\ncrypt.dll
2012-07-19 07:43 . 2012-06-28 13:50 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
2011-05-09 08:49 176936 —-a-w- c:\program files\ZoneAlarm_Security\prxtbZone.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91da5e8a-3318-4f8c-b67e-5964de3ab546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{91DA5E8A-3318-4F8C-B67E-5964DE3AB546}"= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-08-17 06:41 220608 —-a-w- c:\users\Tawny\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-08-17 06:41 220608 —-a-w- c:\users\Tawny\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-08-17 06:41 220608 —-a-w- c:\users\Tawny\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-07-30 640480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-07-11 73392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-08-16 946632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OfficeSAS.lnk]
backup=c:\windows\pss\OfficeSAS.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Tawny^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk]
backup=c:\windows\pss\MagicDisc.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Tawny^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2012-07-31 11:19 41944 —-a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2010-01-20 15:52 611712 —-a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0ENQBO]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
1998-12-01 02:04 497376 —-a-w- c:\windows\p_981116.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-12-09 18:03 136176 —-atw- c:\users\Tawny\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2012-07-28 10:09 4272064 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 MpKsl923a6488;MpKsl923a6488; [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 dc3d;MS Hardware Device Detection Driver (HID);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 MR97310_VGA_DUAL_CAMERA;VGA Dual-Mode Camera;c:\windows\system32\DRIVERS\mr97310v.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SrvHsfPCI;SrvHsfPCI;c:\windows\system32\DRIVERS\VSTBS23.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R4 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [x]
R4 BingDesktopUpdate;Bing Desktop Update service;c:\program files\Microsoft\BingDesktop\BingDesktopUpdater.exe [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [x]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - NISDRV
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 07:44]
.
2012-08-24 c:\windows\Tasks\CandyUpdater.job
- c:\users\Tawny\AppData\Local\ArcadeCandy\candyUpdater.exe [2012-07-09 22:07]
.
2012-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 07:06]
.
2012-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 07:06]
.
2012-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4129062583-865487202-1947993722-1000Core.job
- c:\users\Tawny\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-09 18:03]
.
2012-08-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4129062583-865487202-1947993722-1000UA.job
- c:\users\Tawny\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-09 18:03]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.directv.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH;=WM&Br;=EM&Loc;=ENG_US&Sys;=DTP&M;=W3653
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki…
TCP: DhcpNameServer = 192.168.1.254
DPF: {8B67B37E-1AE2-4B99-B8CF-55AF4D58DF0D} - file:///E:/win/setup/iamce.dll
FF - ProfilePath - c:\users\Tawny\AppData\Roaming\Mozilla\Firefox\Profiles\ggyxl3fh.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.zonealarm.com/search?Source=Browser&oemCode;=ZLN28014896093591-1001&toolbarId;=base&affiliateId;=1025&Lan;=en&utid;=bc141559000000000000001e9037d515&q;={searchTerms}
FF - prefs.js: network.proxy.type - 4
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm_i.hmpg - true
FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?Source=Homepage&oemCode;=ZLN28014896093591-1001&toolbarId;=base&affiliateId;=1025&Lan;=en&utid;=bc141559000000000000001e9037d515
FF - user.js: extensions.zonealarm.dfltSrch - true
FF - user.js: extensions.zonealarm.srchPrvdr - Search By ZoneAlarm
FF - user.js: extensions.zonealarm.keyWordUrl - hxxp://search.zonealarm.com/search?Source=Browser&oemCode;=ZLN28014896093591-1001&toolbarId;=base&affiliateId;=1025&Lan;=en&utid;=bc141559000000000000001e9037d515&q;={searchTerms}
FF - user.js: extensions.zonealarm_i.dnsErr - true
FF - user.js: extensions.zonealarm_i.newTab - true
FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?Source=Newtab&oemCode;=ZLN28014896093591-1001&toolbarId;=base&affiliateId;=1025&Lan;=en&utid;=bc141559000000000000001e9037d515
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode;=ZLN28014896093591-1001&toolbarId;=base&affiliateId;=1025&Lan;={dfltLng}&utid;=bc141559000000000000001e9037d515&q;=
FF - user.js: extensions.zonealarm.id - bc141559000000000000001e9037d515
FF - user.js: extensions.zonealarm.instlDay - 15541
FF - user.js: extensions.zonealarm.vrsn - [removed]
FF - user.js: extensions.zonealarm.vrsni - [removed]
FF - user.js: extensions.zonealarm_i.vrsnTs - [removed]:58
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base
FF - user.js: extensions.zonealarm.instlRef - ZLN28014896093591-1001
FF - user.js: extensions.zonealarm.dfltLng - en
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.admin - false
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ISW - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(548)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2012-08-23 23:17:27
ComboFix-quarantined-files.txt 2012-08-24 06:17
ComboFix2.txt 2012-08-23 01:16
.
Pre-Run: 187,683,848,192 bytes free
Post-Run: 187,647,266,816 bytes free
.
- - End Of File - - B6ABA39FA6276228A5CC2BF6098F0D1A
Post #12

That was cool and a little scary all at the same time!

:D

Clear Java Cache

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.
———-

Please download Malwarebytes' Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #13
:unsure:Here is the first one. One of my favorite things is emoticons! :) I can't help it. My name is Tawny I love emoticons and I am a download junkie. Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.24.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 Tawny :: TIRED-PC [administrator] Protection: Enabled 8/24/2012 11:20:43 AM mbam-log-2012-08-24 (11-20-43).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 220849 Time elapsed: 8 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 6 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CouponAlert_2p.SkinLauncher (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CouponAlert_2p.SkinLauncher.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CouponAlert_2p.SkinLauncherSettings (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKCR\CouponAlert_2p.SkinLauncherSettings.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #15
Hi Jeff, It took nine hours to scan my computer. Now what? It's acting better and I haven't witnessed anything being crazy today! C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\2pdatact.dll.vir a variant of Win32/Toolbar.MyWebSearch.A application C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\2phtmlmu.dll.vir probably a variant of Win32/Toolbar.MyWebSearch.B application C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\2pieovr.dll.vir probably a variant of Win32/Toolbar.MyWebSearch.P application C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\2pPlugin.dll.vir probably a variant of Win32/Toolbar.MyWebSearch application C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\2pskin.dll.vir a variant of Win32/Toolbar.MyWebSearch.P application C:\Qoobox\Quarantine\C\Program Files\CouponAlert_2p\bar\2.bin\T8HTML.DLL.vir probably a variant of Win32/Toolbar.MyWebSearch.F application C:\Users\Tawny\Downloads\CouponAlertSetup2.5.5.6.CDfox000.exe probably a variant of Win32/Toolbar.MyWebSearch.L application C:\Users\Tawny\Downloads\DownloadsPCWorld\speedupmypc.exe Win32/SpeedUpMyPC application C:\Users\Tawny\Downloads\New folder\FixBeeV1.exe Win32/Toolbar.SearchSuite application

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI