kaos123
Topic Starter
Post Merged
We look for post with 0 replies, so when you reply to your own topic, we assume you're being helped.
Please be patient, someone will assist you as soon as possible.
Hi Guys,
Ive been infected again!, i dont know how thou, seems like im just always a victim,
I have been infected by the police virus, which pops up and disables desktop and asked you to pay a fine through ukash etc, i knew it was a scam. I went online and followed some tutorials on how to remove this message. I am able to use my desktop again but i am not sure if i am still infected after running all my spyware and antivirus software. My pc does feel odd, as most of my passwords and emails that log me into websites automatically have been disabled.
While following the tutorials i think i must have got really frustrated and deleted a file on my REGEDIT, called "SHELL" i deleted the whole thing. would that cause problems? HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon "SHELL"
I have also noticed a file which was not there before on my system and i am unable to delete it, its under C:Documents and settingsUsers[Username]zuneteznotno.exe i believe this is a virus,
Also malawarebytes finds this virus each time i do a scan but can not delete it i presume. its a TROJAN FILE under HKLMSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN|REGEDIT32
I really do not want to format my PC and lost everything and it is a hassle to restore everything back to normal.
could you guys help me in diagnosing my COMPUTER, see if i have any viruses or spyware on my system and bring it back up to speed……
HIJACK THIS LOG
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:03:02, on 05/09/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
D:SteamSteam.exe
C:Program Files (x86)CrossriderWebAppsCrossrider.exe
C:UsersKaoszuneteznotno.exe
C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
C:Program Files (x86)NETGEARWG111v2WG111v2.exe
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
C:WindowsSysWOW64svchost.exe
C:Program Files (x86)Mozilla Firefoxfirefox.exe
C:Program Files (x86)Malwarebytes' Anti-Malwarexxxx.exe
C:Program Files (x86)Trend MicroHijackThisHiJackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.co.uk/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = C:WindowsSysWOW64blank.htm
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:Program Files (x86)DeviceVMBrowser Configuration UtilityAddressBarSearch.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll" (file missing)
O4 - HKLM..Run: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
O4 - HKLM..Run: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
O4 - HKLM..Run: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
O4 - HKLM..Run: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
O4 - HKLM..Run: [Update] C:UsersKaosAppDataRoaminggwey362.exe
O4 - HKLM..Run: [Regedit32] C:Windowssystem32regedit.exe
O4 - HKCU..Run: [Steam] "D:Steamsteam.exe" -silent
O4 - HKCU..Run: [Messenger (Yahoo!)] "C:PROGRA~2Yahoo!MessengerYahooMessenger.exe" -quiet
O4 - HKCU..Run: [Facebook Update] "C:UsersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe" /c /nocrashserver
O4 - HKCU..Run: [CrossRiderPlugin] C:Program Files (x86)CrossriderWebAppsCrossrider.exe
O4 - HKCU..Run: [msnmsgr] "C:Program Files (x86)Windows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [zuneteznotno] C:UsersKaoszuneteznotno.exe
O4 - HKCU..Run: [Update] C:UsersKaosAppDataRoaminggwey362.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-21-4283858715-3744055037-2025131688-1003..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUSS-1-5-21-4283858715-3744055037-2025131688-1003..RunOnce: [mctadmin] C:WindowsSystem32mctadmin.exe (User 'UpdatusUser')
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:PROGRA~2MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: @C:Program Files (x86)Windows LiveWriterWindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:Program Files (x86)Windows LiveWriterWindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~2MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O10 - Unknown file in Winsock LSP: c:program files (x86)common filesmicrosoft sharedwindows livewlidnsp.dll
O10 - Unknown file in Winsock LSP: c:program files (x86)common filesmicrosoft sharedwindows livewlidnsp.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%system32Alg.exe,-112 (ALG) - Unknown owner - C:WindowsSystem32alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:Windowssystem32atiesrxx.exe (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:Program FilesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe (file missing)
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:Dragon Agebin_shipDAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%system32efssvc.dll,-100 (EFS) - Unknown owner - C:WindowsSystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32fxsresm.dll,-118 (Fax) - Unknown owner - C:Windowssystem32fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:Program FilesCommon FilesBitDefenderBitDefender Update Servicelivesrv.exe
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:Program Files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:WindowsSystem32msdtc.exe (file missing)
O23 - Service: @%SystemRoot%System32netlogon.dll,-102 (Netlogon) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:Windowssystem32nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe
O23 - Service: @%systemroot%system32psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32Locator.exe,-2 (RpcLocator) - Unknown owner - C:Windowssystem32locator.exe (file missing)
O23 - Service: @%SystemRoot%system32samsrv.dll,-1 (SamSs) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:Program Files (x86)Spybot - Search & DestroySDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:Program Files (x86)SkypeUpdaterUpdater.exe
O23 - Service: @%SystemRoot%system32snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:WindowsSystem32snmptrap.exe (file missing)
O23 - Service: @%systemroot%system32spoolsv.exe,-1 (Spooler) - Unknown owner - C:WindowsSystem32spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%system32sppsvc.exe,-101 (sppsvc) - Unknown owner - C:Windowssystem32sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:Program Files (x86)Common FilesSteamSteamService.exe
O23 - Service: @%SystemRoot%system32ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:Windowssystem32UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe
O23 - Service: @%SystemRoot%system32vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%SystemRoot%system32vds.exe,-100 (vds) - Unknown owner - C:WindowsSystem32vds.exe (file missing)
O23 - Service: @%systemroot%system32vssvc.exe,-102 (VSS) - Unknown owner - C:Windowssystem32vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:Program FilesBitDefenderBitDefender 2010vsserv.exe
O23 - Service: @%SystemRoot%system32WatWatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:Windowssystem32WatWatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%system32wbengine.exe,-104 (wbengine) - Unknown owner - C:Windowssystem32wbengine.exe (file missing)
O23 - Service: @%Systemroot%system32wbemwmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:Windowssystem32wbemWmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%Windows Media Playerwmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:Program Files (x86)Windows Media Playerwmpnetwk.exe (file missing)
–
End of file - 11476 bytes
MALAWAREBYTS LOG
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.09.05.06
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Kaos :: KAOS-PC [administrator]
05/09/2012 14:57:00
mbam-log-2012-09-05 (14-57-00).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 237723
Time elapsed: 2 minute(s), 32 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 1
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun|Regedit32 (Trojan.Agent) -> Data: C:Windowssystem32regedit.exe -> Quarantined and deleted successfully.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
DDS REPORT
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.5.1
Run by [removed] at 15:21:14 on 2012-09-05
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3963.2390 [GMT 1:00]
.
AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
.
============== Running Processes ===============
.
C:Windowssystem32wininit.exe
C:Windowssystem32lsm.exe
C:Windowssystem32svchost.exe -k DcomLaunch
C:Windowssystem32nvvsvc.exe
C:Windowssystem32svchost.exe -k RPCSS
C:Program FilesCommon FilesBitDefenderBitDefender Update Servicelivesrv.exe
C:Program FilesBitDefenderBitDefender 2010vsserv.exe
C:Windowssystem32atiesrxx.exe
C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted
C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted
C:Windowssystem32svchost.exe -k netsvcs
C:Windowssystem32svchost.exe -k LocalService
C:Windowssystem32svchost.exe -k NetworkService
C:Windowssystem32atieclxx.exe
C:Program FilesNVIDIA CorporationDisplaynvxdsync.exe
C:Windowssystem32nvvsvc.exe
C:WindowsSystem32spoolsv.exe
C:Windowssystem32svchost.exe -k LocalServiceNoNetwork
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe
C:Program Files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
C:Program Files (x86)Common FilesMicrosoft SharedVS7DEBUGmdm.exe
C:Windowssystem32svchost.exe -k imgsvc
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXE
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exe
C:Windowssystem32Dwm.exe
C:Program FilesBitDefenderBitDefender 2010bdagent.exe
C:WindowsExplorer.EXE
C:Windowssystem32taskhost.exe
C:Program FilesRealtekAudioHDARAVCpl64.exe
C:WindowsWindowsMobilewmdcBase.exe
D:SteamSteam.exe
C:Program Files (x86)Windows LiveMessengermsnmsgr.exe
C:UsersKaoszuneteznotno.exe
C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
C:Program Files (x86)NETGEARWG111v2WG111v2.exe
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe
C:Program Files (x86)CrossriderWebAppsCrossrider.exe
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
C:Windowssystem32svchost.exe -k WindowsMobile
C:Program FilesNVIDIA CorporationDisplaynvtray.exe
C:Program FilesBitDefenderBitDefender 2010seccenter.exe
C:Windowssystem32SearchIndexer.exe
C:Windowssystem32wbemwmiprvse.exe
C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation
C:WindowsSystem32svchost.exe -k LocalServicePeerNet
C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted
C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe
C:Program FilesBitDefenderBitDefender 2010antispam32bdimguiaux.exe
C:Program Files (x86)Mozilla Firefoxfirefox.exe
C:Windowssystem32svchost.exe
C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe
C:Program Files (x86)Mozilla Firefoxplugin-container.exe
C:WindowsSysWOW64MacromedFlashFlashPlayerPlugin_11_3_300_271.exe
C:WindowsSysWOW64MacromedFlashFlashPlayerPlugin_11_3_300_271.exe
C:WindowsSysWOW64cmd.exe
C:Windowssystem32conhost.exe
C:WindowsSysWOW64cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = about:blank
uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:Program Files (x86)DeviceVMBrowser Configuration UtilityAddressBarSearch.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll"
uRun: [Steam] "D:Steamsteam.exe" -silent
uRun: [Messenger (Yahoo!)] "C:PROGRA~2Yahoo!MessengerYahooMessenger.exe" -quiet
uRun: [Facebook Update] "C:UsersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe" /c /nocrashserver
uRun: [CrossRiderPlugin] C:Program Files (x86)CrossriderWebAppsCrossrider.exe
uRun: [msnmsgr] "C:Program Files (x86)Windows LiveMessengermsnmsgr.exe" /background
uRun: [zuneteznotno] C:UsersKaoszuneteznotno.exe
uRun: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
mRun: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
mRun: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
mRun: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
mRun: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
mRun: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
mRun: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun: [Regedit32] C:Windowssystem32regedit.exe
StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupNETGEA~1.LNK - C:Program Files (x86)NETGEARWG111v2WG111v2.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport; to Microsoft Excel - C:PROGRA~2MICROS~3Office12EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:PROGRA~2MICROS~3Office12REFIEBAR.DLL
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5} : DhcpNameServer = [removed] [removed]
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}244564F4E4 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}2445F40756E6A7F6E656 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}B41697A7F507C6163656 : DhcpNameServer = [removed] [removed]
TCP: Interfaces{342F463D-A9AD-4F02-98E0-ACCFD08BCC24} : DhcpNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
TB-X64: BitDefender Toolbar: {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll"
mRun-x64: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
mRun-x64: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
mRun-x64: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
mRun-x64: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
mRun-x64: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
mRun-x64: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
mRun-x64: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun-x64: [Regedit32] C:Windowssystem32regedit.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:UsersKaosAppDataRoamingMozillaFirefoxProfilesly7rg1o1.default
FF - plugin: C:Program Files (x86)AdobeReader 9.0ReaderAIRnppdf32.dll
FF - plugin: C:Program Files (x86)GoogleGoogle Earthpluginnpgeplugin.dll
FF - plugin: C:Program Files (x86)GoogleUpdate1.3.21.115npGoogleUpdate3.dll
FF - plugin: C:Program Files (x86)Microsoft Silverlight5.1.10411.0npctrlui.dll
FF - plugin: C:Program Files (x86)OracleJavaFX 2.1 Runtimebinplugin2npjp2.dll
FF - plugin: C:Windowssystem32WatnpWatWeb.dll
FF - plugin: C:WindowsSysWOW64MacromedFlashNPSWF32_11_3_300_271.dll
FF - plugin: C:WindowsSysWOW64npDeployJava1.dll
FF - plugin: C:WindowsSysWOW64npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:Windowssystem32DriversPxHlpa64.sys –> C:Windowssystem32DriversPxHlpa64.sys [?]
R0 SCMNdisP;General NDIS Protocol Driver;C:Windowssystem32DRIVERSscmndisp.sys –> C:Windowssystem32DRIVERSscmndisp.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:Windowssystem32atiesrxx.exe –> C:Windowssystem32atiesrxx.exe [?]
R2 BCUService;Browser Configuration Utility Service;C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe [2010-7-24 219360]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe [2010-7-24 13336]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-2-28 2348352]
R2 UNS;Intel® Management & Security Application User Notification Service;C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [2010-7-24 2320920]
R3 HECIx64;Intel® Management Engine Interface;C:Windowssystem32DRIVERSHECIx64.sys –> C:Windowssystem32DRIVERSHECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:Windowssystem32DRIVERSRt64win7.sys –> C:Windowssystem32DRIVERSRt64win7.sys [?]
R3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;C:Windowssystem32DRIVERSwg111v2.sys –> C:Windowssystem32DRIVERSwg111v2.sys [?]
S1 bdfwfpf;bdfwfpf;C:Program FilesCommon FilesBitDefenderBitDefender Firewallbdfwfpf.sys [2010-1-4 89680]
S2 gupdate;Google Update Service (gupdate);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-4-13 116648]
S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2012-2-15 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-7-31 250056]
S3 amdkmdag;amdkmdag;C:Windowssystem32DRIVERSatikmdag.sys –> C:Windowssystem32DRIVERSatikmdag.sys [?]
S3 amdkmdap;amdkmdap;C:Windowssystem32DRIVERSatikmpag.sys –> C:Windowssystem32DRIVERSatikmpag.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;C:Program FilesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe [2009-10-19 278224]
S3 BDFM;BDFM;C:Windowssystem32DRIVERSbdfm.sys –> C:Windowssystem32DRIVERSbdfm.sys [?]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;D:Dragon Agebin_shipdaupdatersvc.service.exe [2010-7-25 25832]
S3 gupdatem;Google Update Service (gupdatem);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-4-13 116648]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2012-7-31 113120]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:Windowssystem32driversrdpvideominiport.sys –> C:Windowssystem32driversrdpvideominiport.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:Windowssystem32driverstsusbflt.sys –> C:Windowssystem32driverstsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:Windowssystem32WatWatAdminSvc.exe –> C:Windowssystem32WatWatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-09-05 13:55:12 ——– d—–w- C:UsersKaosAppDataLocal{E25F9C84-62AF-46FF-B165-7FA432DD5996}
2012-09-05 12:47:39 ——– d—–w- C:ProgramDataSpybot - Search & Destroy
2012-09-05 12:47:39 ——– d—–w- C:Program Files (x86)Spybot - Search & Destroy
2012-09-05 12:47:31 24904 —-a-w- C:WindowsSystem32driversmbam.sys
2012-09-05 03:28:12 ——– d—–w- C:UsersKaosAppDataLocal{7EFE7534-024A-4B23-BC5D-F04B56F59BA9}
2012-09-05 01:36:52 ——– d—–w- C:UsersKaosAppDataLocalMacromedia
2012-09-05 01:35:13 ——– d—–w- C:UsersKaosAppDataLocalMozilla
2012-09-05 01:34:38 ——– d—–w- C:UsersKaosAppDataRoamingMalwarebytes
2012-09-05 01:34:04 ——– d—–w- C:UsersKaosAppDataLocalYahoo
2012-09-05 01:21:44 ——– d—–w- C:UsersKaosAppDataRoamingIntel Corporation
2012-09-05 01:21:24 ——– d—–w- C:UsersKaosAppDataLocalAdobe
2012-09-05 01:21:18 ——– d—–w- C:UsersKaosAppDataRoamingBitDefender
.
==================== Find3M ====================
.
2012-08-15 06:57:31 70344 —-a-w- C:WindowsSysWow64FlashPlayerCPLApp.cpl
2012-08-15 06:57:31 426184 —-a-w- C:WindowsSysWow64FlashPlayerApp.exe
2012-08-06 13:45:45 614 —-a-w- C:WindowsSysWow64PerfStringBackup.TMP
2012-07-18 18:15:06 3148800 —-a-w- C:WindowsSystem32win32k.sys
2012-07-05 21:06:30 772544 —-a-w- C:WindowsSysWow64npDeployJava1.dll
2012-07-05 21:06:20 687544 —-a-w- C:WindowsSysWow64deployJava1.dll
2012-07-04 22:13:27 59392 —-a-w- C:WindowsSystem32browcli.dll
2012-07-04 22:13:27 136704 —-a-w- C:WindowsSystem32browser.dll
2012-07-04 21:14:34 41984 —-a-w- C:WindowsSysWow64browcli.dll
2012-06-27 07:06:53 1188864 —-a-w- C:WindowsSystem32wininet.dll
2012-06-27 05:53:07 981504 —-a-w- C:WindowsSysWow64wininet.dll
2012-06-16 05:16:04 609792 —-a-w- C:WindowsSystem32vbscript.dll
2012-06-16 04:26:57 428032 —-a-w- C:WindowsSysWow64vbscript.dll
.
============= FINISH: 15:21:39.36 ===============
aswMBR REPORT
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-05 15:29:00
—————————–
15:29:00.606 OS Version: Windows x64 6.1.7601 Service Pack 1
15:29:00.606 Number of processors: 4 586 0x2502
15:29:00.606 ComputerName: KAOS-PC UserName: Kaos
15:29:01.129 Initialze error C0000001 - driver not loaded
15:30:47.155 AVAST engine defs: 12090501
15:32:07.212 Service scanning
15:32:07.613 Service 200419957a64f041 C:WindowsSystem32Drivers200419957a64f041.sys **HIDDEN**
15:32:24.314 Modules scanning
15:32:24.316 Disk 0 trace - called modules:
15:32:24.317
15:32:24.827 AVAST engine scan C:Windows
15:32:26.657 AVAST engine scan C:Windowssystem32
15:34:35.801 AVAST engine scan C:Windowssystem32drivers
15:34:43.612 AVAST engine scan C:UsersKaos
15:36:44.204 File: C:UsersKaoszuneteznotno.exe **INFECTED** Win32:Kryptik-JXG [Trj]
15:36:44.777 AVAST engine scan C:ProgramData
15:37:32.956 Scan finished successfully
15:39:23.670 The log file has been saved successfully to "C:UsersKaosDesktopaswMBR.txt"
NO MBR.DAT file was created
COMBO FIX REPORT[
ComboFix 12-09-05.01 - Kaos 05/09/2012 15:41:55.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3963.2322 [GMT 1:00]
Running from: c:usersKaosDesktopComboFix.exe
AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:windowstwain_16.dll
c:usersKaoszuneteznotno.exe . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2012-08-05 to 2012-09-05 )))))))))))))))))))))))))))))))
.
.
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersUpdatusUserAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersUpdatusUser.Kaos-PCAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersPublicAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersDefaultAppDataLocaltemp
2012-09-05 12:47 . 2012-09-05 14:25 ——– d—–w- c:programdataSpybot - Search & Destroy
2012-09-05 12:47 . 2012-09-05 14:21 ——– d—–w- c:program files (x86)Spybot - Search & Destroy
2012-09-05 12:47 . 2012-07-03 12:46 24904 —-a-w- c:windowssystem32driversmbam.sys
2012-09-05 01:36 . 2012-09-05 01:36 ——– d—–w- c:usersKaosAppDataLocalMacromedia
2012-09-05 01:35 . 2012-09-05 01:35 ——– d—–w- c:usersKaosAppDataLocalMozilla
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataRoamingMalwarebytes
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataRoamingYahoo!
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataLocalYahoo
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataRoamingIntel Corporation
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataLocalAdobe
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataRoamingBitDefender
2012-09-04 15:11 . 2012-09-04 15:11 96768 —-a-w- c:usersKaoszuneteznotno.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-16 02:00 . 2010-07-24 01:31 62134624 —-a-w- c:windowssystem32MRT.exe
2012-08-15 06:57 . 2012-07-31 14:33 426184 —-a-w- c:windowsSysWow64FlashPlayerApp.exe
2012-08-15 06:57 . 2011-11-23 20:03 70344 —-a-w- c:windowsSysWow64FlashPlayerCPLApp.cpl
2012-08-06 13:45 . 2012-08-06 13:45 614 —-a-w- c:windowsSysWow64PerfStringBackup.TMP
2012-07-05 21:06 . 2012-08-04 01:12 772544 —-a-w- c:windowsSysWow64npDeployJava1.dll
2012-07-05 21:06 . 2010-08-03 00:13 687544 —-a-w- c:windowsSysWow64deployJava1.dll
2012-06-20 00:08 . 2011-03-28 17:36 19736 —-a-w- c:programdataMicrosoftIdentityCRLproductionppcrlconfig600.dll
2012-06-09 05:43 . 2012-07-10 21:06 14172672 —-a-w- c:windowssystem32shell32.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Steam"="d:steamsteam.exe" [2012-08-04 1353080]
"CrossRiderPlugin"="c:program files (x86)CrossriderWebAppsCrossrider.exe" [2011-05-15 478720]
"zuneteznotno"="c:usersKaoszuneteznotno.exe" [1601-01-01 0]
.
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]
"BCU"="c:program files (x86)DeviceVMBrowser Configuration UtilityBCU.exe" [2009-08-04 346320]
"IAStorIcon"="c:program files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe" [2009-10-02 284696]
"WinampAgent"="c:program files (x86)Winampwinampa.exe" [2008-08-03 36352]
"PWRISOVM.EXE"="c:program files (x86)PowerISOPWRISOVM.EXE" [2009-03-15 180224]
"Adobe Reader Speed Launcher"="c:program files (x86)AdobeReader 9.0ReaderReader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:program files (x86)Common FilesAdobeARM1.0AdobeARM.exe" [2012-01-02 843712]
.
c:programdataMicrosoftWindowsStart MenuProgramsStartup
NETGEAR WG111v2 Smart Wizard.lnk - c:program files (x86)NETGEARWG111v2WG111v2.exe [2010-7-24 1261568]
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversiondrivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrollsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 bdfwfpf;bdfwfpf;c:program filesCommon FilesBitDefenderBitDefender Firewallbdfwfpf.sys [2010-08-04 89680]
R2 gupdate;Google Update Service (gupdate);c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 116648]
R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe [2012-02-15 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-08-15 250056]
R3 amdkmdag;amdkmdag;c:windowssystem32DRIVERSatikmdag.sys [2009-08-18 6037504]
R3 amdkmdap;amdkmdap;c:windowssystem32DRIVERSatikmpag.sys [2010-07-07 265728]
R3 Arrakis3;BitDefender Arrakis Server;c:program filesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe [2009-10-19 278224]
R3 BDFM;BDFM;c:windowssystem32DRIVERSbdfm.sys [2010-01-29 163936]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:dragon agebin_shipDAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 DRHARD;DRHARD;c:windowssystem32DRIVERSDRHARD.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 116648]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:program files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2012-07-14 113120]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:windowssystem32driverstsusbhub.sys [x]
R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2010-07-24 1255736]
S0 PxHlpa64;PxHlpa64;c:windowsSystem32DriversPxHlpa64.sys [2009-07-09 55280]
S0 SCMNdisP;General NDIS Protocol Driver;c:windowssystem32DRIVERSscmndisp.sys [2007-01-19 25312]
S2 AMD External Events Utility;AMD External Events Utility;c:windowssystem32atiesrxx.exe [2009-08-18 203264]
S2 BCUService;Browser Configuration Utility Service;c:program files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe [2009-08-04 219360]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:program files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe [2009-10-02 13336]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:program files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-02-10 2348352]
S2 UNS;Intel® Management & Security Application User Notification Service;c:program files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [2009-09-30 2320920]
S3 HECIx64;Intel® Management Engine Interface;c:windowssystem32DRIVERSHECIx64.sys [2009-09-17 56344]
S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt64win7.sys [2009-08-20 239616]
S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:windowssystem32DRIVERSwg111v2.sys [2007-12-26 340992]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - 200419957a64f041
.
[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionsvchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-05 c:windowsTasksAdobe Flash Player Updater.job
- c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-07-31 06:57]
.
2012-09-05 c:windowsTasksGoogleUpdateTaskMachineCore.job
- c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 00:28]
.
2012-09-05 c:windowsTasksGoogleUpdateTaskMachineUA.job
- c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 00:28]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RtHDVCpl"="c:program filesRealtekAudioHDARAVCpl64.exe" [2009-12-08 9642528]
"AdobeAAMUpdater-1.0"="c:program files (x86)Common FilesAdobeOOBEPDAppUWAUpdaterStartupUtility.exe" [2010-03-06 500208]
"BitDefender Antiphishing Helper 32"="c:program filesBitDefenderBitDefender 2010Antispam32IEShow.exe" [2009-10-19 71152]
"BitDefender Antiphishing Helper"="c:program filesBitDefenderBitDefender 2010IEShow.exe" [2009-10-19 76296]
"BDAgent"="c:program filesBitDefenderBitDefender 2010bdagent.exe" [2012-05-23 1702496]
"Windows Mobile-based device management"="c:windowsWindowsMobilewmdcBase.exe" [2007-05-31 660360]
.
——- Supplementary Scan ——-
.
uLocal Page = c:windowssystem32blank.htm
uStart Page = hxxp://www.google.co.uk/
mStart Page = about:blank
mLocal Page = c:windowsSysWOW64blank.htm
IE: E&xport; to Microsoft Excel - c:progra~2MICROS~3Office12EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:usersKaosAppDataRoamingMozillaFirefoxProfilesly7rg1o1.default
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-Messenger (Yahoo!) - c:progra~2Yahoo!MessengerYahooMessenger.exe
Wow6432Node-HKCU-Run-Facebook Update - c:usersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe
Wow6432Node-HKLM-Run-Update - c:usersKaosAppDataRoaminggwey362.exe
Wow6432Node-HKLM-Run-Regedit32 - c:windowssystem32regedit.exe
AddRemove-Mumble - d:mumbleUninstall.exe
AddRemove-Yahoo! Messenger - c:progra~2Yahoo!MESSEN~1UNWISE.EXE
AddRemove-ZECA Driver Ver 1.42 - c:windowsTempMVInstallUninst.isu
AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:program files (x86)NOSbingetPlus_Helper_3004.dll
.
.
.
[HKEY_LOCAL_MACHINEsystemControlSet001services200419957a64f041]
"ImagePath"="SystemRootSystem32Drivers200419957a64f041.sys"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS.DefaultSoftwareSetIDInternal]
@Denied: (A 2) (LocalSystem)
"DATA"=""
"Device"="xr3Pxr2+yLnPx87MzrzMy8y7zcs="
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_3_300_271_ActiveX.e
xe,-101"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}LocalServer32]
@="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_3_300_271_ActiveX.ex
e"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version]
@="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version]
@="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareWow6432NodeMicrosoftWindows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,
.
[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:program files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
c:program files (x86)Common FilesMicrosoft SharedVS7DEBUGmdm.exe
.
**************************************************************************
.
Completion time: 2012-09-05 15:50:39 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-05 14:50
ComboFix2.txt 2012-08-03 01:41
.
Pre-Run: 92,004,999,168 bytes free
Post-Run: 91,915,968,512 bytes free
.
- - End Of File - - 43A72D45975C2E53B6D173981101B406
Malaware still finds that same virus each time it scans, and that zuneteznotno.exe is still sitting on my system
???
We look for post with 0 replies, so when you reply to your own topic, we assume you're being helped.
Please be patient, someone will assist you as soon as possible.
Hi Guys,
Ive been infected again!, i dont know how thou, seems like im just always a victim,
I have been infected by the police virus, which pops up and disables desktop and asked you to pay a fine through ukash etc, i knew it was a scam. I went online and followed some tutorials on how to remove this message. I am able to use my desktop again but i am not sure if i am still infected after running all my spyware and antivirus software. My pc does feel odd, as most of my passwords and emails that log me into websites automatically have been disabled.
While following the tutorials i think i must have got really frustrated and deleted a file on my REGEDIT, called "SHELL" i deleted the whole thing. would that cause problems? HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon "SHELL"
I have also noticed a file which was not there before on my system and i am unable to delete it, its under C:Documents and settingsUsers[Username]zuneteznotno.exe i believe this is a virus,
Also malawarebytes finds this virus each time i do a scan but can not delete it i presume. its a TROJAN FILE under HKLMSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN|REGEDIT32
I really do not want to format my PC and lost everything and it is a hassle to restore everything back to normal.
could you guys help me in diagnosing my COMPUTER, see if i have any viruses or spyware on my system and bring it back up to speed……
HIJACK THIS LOG
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:03:02, on 05/09/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
D:SteamSteam.exe
C:Program Files (x86)CrossriderWebAppsCrossrider.exe
C:UsersKaoszuneteznotno.exe
C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
C:Program Files (x86)NETGEARWG111v2WG111v2.exe
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
C:WindowsSysWOW64svchost.exe
C:Program Files (x86)Mozilla Firefoxfirefox.exe
C:Program Files (x86)Malwarebytes' Anti-Malwarexxxx.exe
C:Program Files (x86)Trend MicroHijackThisHiJackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.co.uk/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = about:blank
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = C:WindowsSysWOW64blank.htm
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:Program Files (x86)DeviceVMBrowser Configuration UtilityAddressBarSearch.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll" (file missing)
O4 - HKLM..Run: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
O4 - HKLM..Run: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
O4 - HKLM..Run: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
O4 - HKLM..Run: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
O4 - HKLM..Run: [Update] C:UsersKaosAppDataRoaminggwey362.exe
O4 - HKLM..Run: [Regedit32] C:Windowssystem32regedit.exe
O4 - HKCU..Run: [Steam] "D:Steamsteam.exe" -silent
O4 - HKCU..Run: [Messenger (Yahoo!)] "C:PROGRA~2Yahoo!MessengerYahooMessenger.exe" -quiet
O4 - HKCU..Run: [Facebook Update] "C:UsersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe" /c /nocrashserver
O4 - HKCU..Run: [CrossRiderPlugin] C:Program Files (x86)CrossriderWebAppsCrossrider.exe
O4 - HKCU..Run: [msnmsgr] "C:Program Files (x86)Windows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [zuneteznotno] C:UsersKaoszuneteznotno.exe
O4 - HKCU..Run: [Update] C:UsersKaosAppDataRoaminggwey362.exe
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
O4 - HKUSS-1-5-21-4283858715-3744055037-2025131688-1003..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUSS-1-5-21-4283858715-3744055037-2025131688-1003..RunOnce: [mctadmin] C:WindowsSystem32mctadmin.exe (User 'UpdatusUser')
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:PROGRA~2MICROS~3Office12EXCEL.EXE/3000
O9 - Extra button: @C:Program Files (x86)Windows LiveWriterWindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:Program Files (x86)Windows LiveWriterWindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~2MICROS~3Office12REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:Program Files (x86)Spybot - Search & DestroySDHelper.dll
O10 - Unknown file in Winsock LSP: c:program files (x86)common filesmicrosoft sharedwindows livewlidnsp.dll
O10 - Unknown file in Winsock LSP: c:program files (x86)common filesmicrosoft sharedwindows livewlidnsp.dll
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%system32Alg.exe,-112 (ALG) - Unknown owner - C:WindowsSystem32alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:Windowssystem32atiesrxx.exe (file missing)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:Program FilesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_state.exe (file missing)
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - D:Dragon Agebin_shipDAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%system32efssvc.dll,-100 (EFS) - Unknown owner - C:WindowsSystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32fxsresm.dll,-118 (Fax) - Unknown owner - C:Windowssystem32fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:Program FilesCommon FilesBitDefenderBitDefender Update Servicelivesrv.exe
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:Program Files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:WindowsSystem32msdtc.exe (file missing)
O23 - Service: @%SystemRoot%System32netlogon.dll,-102 (Netlogon) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:Windowssystem32nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe
O23 - Service: @%systemroot%system32psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%systemroot%system32Locator.exe,-2 (RpcLocator) - Unknown owner - C:Windowssystem32locator.exe (file missing)
O23 - Service: @%SystemRoot%system32samsrv.dll,-1 (SamSs) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:Program Files (x86)Spybot - Search & DestroySDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:Program Files (x86)SkypeUpdaterUpdater.exe
O23 - Service: @%SystemRoot%system32snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:WindowsSystem32snmptrap.exe (file missing)
O23 - Service: @%systemroot%system32spoolsv.exe,-1 (Spooler) - Unknown owner - C:WindowsSystem32spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%system32sppsvc.exe,-101 (sppsvc) - Unknown owner - C:Windowssystem32sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:Program Files (x86)Common FilesSteamSteamService.exe
O23 - Service: @%SystemRoot%system32ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:Windowssystem32UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe
O23 - Service: @%SystemRoot%system32vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:Windowssystem32lsass.exe (file missing)
O23 - Service: @%SystemRoot%system32vds.exe,-100 (vds) - Unknown owner - C:WindowsSystem32vds.exe (file missing)
O23 - Service: @%systemroot%system32vssvc.exe,-102 (VSS) - Unknown owner - C:Windowssystem32vssvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:Program FilesBitDefenderBitDefender 2010vsserv.exe
O23 - Service: @%SystemRoot%system32WatWatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:Windowssystem32WatWatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%system32wbengine.exe,-104 (wbengine) - Unknown owner - C:Windowssystem32wbengine.exe (file missing)
O23 - Service: @%Systemroot%system32wbemwmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:Windowssystem32wbemWmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%Windows Media Playerwmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:Program Files (x86)Windows Media Playerwmpnetwk.exe (file missing)
–
End of file - 11476 bytes
MALAWAREBYTS LOG
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.09.05.06
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Kaos :: KAOS-PC [administrator]
05/09/2012 14:57:00
mbam-log-2012-09-05 (14-57-00).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 237723
Time elapsed: 2 minute(s), 32 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 1
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun|Regedit32 (Trojan.Agent) -> Data: C:Windowssystem32regedit.exe -> Quarantined and deleted successfully.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
DDS REPORT
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.5.1
Run by [removed] at 15:21:14 on 2012-09-05
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3963.2390 [GMT 1:00]
.
AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
.
============== Running Processes ===============
.
C:Windowssystem32wininit.exe
C:Windowssystem32lsm.exe
C:Windowssystem32svchost.exe -k DcomLaunch
C:Windowssystem32nvvsvc.exe
C:Windowssystem32svchost.exe -k RPCSS
C:Program FilesCommon FilesBitDefenderBitDefender Update Servicelivesrv.exe
C:Program FilesBitDefenderBitDefender 2010vsserv.exe
C:Windowssystem32atiesrxx.exe
C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted
C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted
C:Windowssystem32svchost.exe -k netsvcs
C:Windowssystem32svchost.exe -k LocalService
C:Windowssystem32svchost.exe -k NetworkService
C:Windowssystem32atieclxx.exe
C:Program FilesNVIDIA CorporationDisplaynvxdsync.exe
C:Windowssystem32nvvsvc.exe
C:WindowsSystem32spoolsv.exe
C:Windowssystem32svchost.exe -k LocalServiceNoNetwork
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe
C:Program Files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
C:Program Files (x86)Common FilesMicrosoft SharedVS7DEBUGmdm.exe
C:Windowssystem32svchost.exe -k imgsvc
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSVC.EXE
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLIDSvcM.exe
C:Windowssystem32Dwm.exe
C:Program FilesBitDefenderBitDefender 2010bdagent.exe
C:WindowsExplorer.EXE
C:Windowssystem32taskhost.exe
C:Program FilesRealtekAudioHDARAVCpl64.exe
C:WindowsWindowsMobilewmdcBase.exe
D:SteamSteam.exe
C:Program Files (x86)Windows LiveMessengermsnmsgr.exe
C:UsersKaoszuneteznotno.exe
C:Program Files (x86)Spybot - Search & DestroyTeaTimer.exe
C:Program Files (x86)NETGEARWG111v2WG111v2.exe
C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe
C:Program Files (x86)CrossriderWebAppsCrossrider.exe
C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
C:Windowssystem32svchost.exe -k WindowsMobile
C:Program FilesNVIDIA CorporationDisplaynvtray.exe
C:Program FilesBitDefenderBitDefender 2010seccenter.exe
C:Windowssystem32SearchIndexer.exe
C:Windowssystem32wbemwmiprvse.exe
C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation
C:WindowsSystem32svchost.exe -k LocalServicePeerNet
C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted
C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe
C:Program FilesBitDefenderBitDefender 2010antispam32bdimguiaux.exe
C:Program Files (x86)Mozilla Firefoxfirefox.exe
C:Windowssystem32svchost.exe
C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe
C:Program Files (x86)Mozilla Firefoxplugin-container.exe
C:WindowsSysWOW64MacromedFlashFlashPlayerPlugin_11_3_300_271.exe
C:WindowsSysWOW64MacromedFlashFlashPlayerPlugin_11_3_300_271.exe
C:WindowsSysWOW64cmd.exe
C:Windowssystem32conhost.exe
C:WindowsSysWOW64cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = about:blank
uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - C:Program Files (x86)DeviceVMBrowser Configuration UtilityAddressBarSearch.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll"
uRun: [Steam] "D:Steamsteam.exe" -silent
uRun: [Messenger (Yahoo!)] "C:PROGRA~2Yahoo!MessengerYahooMessenger.exe" -quiet
uRun: [Facebook Update] "C:UsersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe" /c /nocrashserver
uRun: [CrossRiderPlugin] C:Program Files (x86)CrossriderWebAppsCrossrider.exe
uRun: [msnmsgr] "C:Program Files (x86)Windows LiveMessengermsnmsgr.exe" /background
uRun: [zuneteznotno] C:UsersKaoszuneteznotno.exe
uRun: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
mRun: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
mRun: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
mRun: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
mRun: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
mRun: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
mRun: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun: [Regedit32] C:Windowssystem32regedit.exe
StartupFolder: C:PROGRA~3MICROS~1WindowsSTARTM~1ProgramsStartupNETGEA~1.LNK - C:Program Files (x86)NETGEARWG111v2WG111v2.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport; to Microsoft Excel - C:PROGRA~2MICROS~3Office12EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:Program Files (x86)Windows LiveWriterWriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:PROGRA~2MICROS~3Office12REFIEBAR.DLL
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5} : DhcpNameServer = [removed] [removed]
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}244564F4E4 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}2445F40756E6A7F6E656 : DhcpNameServer = 192.168.22.22 192.168.22.23
TCP: Interfaces{10F43C16-576B-4D7D-BEF1-CF467FC8F8C5}B41697A7F507C6163656 : DhcpNameServer = [removed] [removed]
TCP: Interfaces{342F463D-A9AD-4F02-98E0-ACCFD08BCC24} : DhcpNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~2COMMON~1SkypeSKYPE4~1.DLL
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinssv.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program Files (x86)Common FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)OracleJavaFX 2.1 Runtimebinjp2ssv.dll
TB-X64: BitDefender Toolbar: {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - "C:Program FilesBitDefenderBitDefender 2010Antispam32IEToolbar.dll"
mRun-x64: [BCU] "C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCU.exe"
mRun-x64: [IAStorIcon] C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe
mRun-x64: [WinampAgent] "C:Program Files (x86)Winampwinampa.exe"
mRun-x64: [PWRISOVM.EXE] C:Program Files (x86)PowerISOPWRISOVM.EXE
mRun-x64: [Adobe Reader Speed Launcher] "C:Program Files (x86)AdobeReader 9.0ReaderReader_sl.exe"
mRun-x64: [Adobe ARM] "C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe"
mRun-x64: [Update] C:UsersKaosAppDataRoaminggwey362.exe
mRun-x64: [Regedit32] C:Windowssystem32regedit.exe
.
================= FIREFOX ===================
.
FF - ProfilePath - C:UsersKaosAppDataRoamingMozillaFirefoxProfilesly7rg1o1.default
FF - plugin: C:Program Files (x86)AdobeReader 9.0ReaderAIRnppdf32.dll
FF - plugin: C:Program Files (x86)GoogleGoogle Earthpluginnpgeplugin.dll
FF - plugin: C:Program Files (x86)GoogleUpdate1.3.21.115npGoogleUpdate3.dll
FF - plugin: C:Program Files (x86)Microsoft Silverlight5.1.10411.0npctrlui.dll
FF - plugin: C:Program Files (x86)OracleJavaFX 2.1 Runtimebinplugin2npjp2.dll
FF - plugin: C:Windowssystem32WatnpWatWeb.dll
FF - plugin: C:WindowsSysWOW64MacromedFlashNPSWF32_11_3_300_271.dll
FF - plugin: C:WindowsSysWOW64npDeployJava1.dll
FF - plugin: C:WindowsSysWOW64npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:Windowssystem32DriversPxHlpa64.sys –> C:Windowssystem32DriversPxHlpa64.sys [?]
R0 SCMNdisP;General NDIS Protocol Driver;C:Windowssystem32DRIVERSscmndisp.sys –> C:Windowssystem32DRIVERSscmndisp.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:Windowssystem32atiesrxx.exe –> C:Windowssystem32atiesrxx.exe [?]
R2 BCUService;Browser Configuration Utility Service;C:Program Files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe [2010-7-24 219360]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe [2010-7-24 13336]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-2-28 2348352]
R2 UNS;Intel® Management & Security Application User Notification Service;C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [2010-7-24 2320920]
R3 HECIx64;Intel® Management Engine Interface;C:Windowssystem32DRIVERSHECIx64.sys –> C:Windowssystem32DRIVERSHECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:Windowssystem32DRIVERSRt64win7.sys –> C:Windowssystem32DRIVERSRt64win7.sys [?]
R3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;C:Windowssystem32DRIVERSwg111v2.sys –> C:Windowssystem32DRIVERSwg111v2.sys [?]
S1 bdfwfpf;bdfwfpf;C:Program FilesCommon FilesBitDefenderBitDefender Firewallbdfwfpf.sys [2010-1-4 89680]
S2 gupdate;Google Update Service (gupdate);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-4-13 116648]
S2 SkypeUpdate;Skype Updater;C:Program Files (x86)SkypeUpdaterUpdater.exe [2012-2-15 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-7-31 250056]
S3 amdkmdag;amdkmdag;C:Windowssystem32DRIVERSatikmdag.sys –> C:Windowssystem32DRIVERSatikmdag.sys [?]
S3 amdkmdap;amdkmdap;C:Windowssystem32DRIVERSatikmpag.sys –> C:Windowssystem32DRIVERSatikmpag.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;C:Program FilesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe [2009-10-19 278224]
S3 BDFM;BDFM;C:Windowssystem32DRIVERSbdfm.sys –> C:Windowssystem32DRIVERSbdfm.sys [?]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;D:Dragon Agebin_shipdaupdatersvc.service.exe [2010-7-25 25832]
S3 gupdatem;Google Update Service (gupdatem);C:Program Files (x86)GoogleUpdateGoogleUpdate.exe [2012-4-13 116648]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:Program Files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2012-7-31 113120]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:Windowssystem32driversrdpvideominiport.sys –> C:Windowssystem32driversrdpvideominiport.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:Windowssystem32driverstsusbflt.sys –> C:Windowssystem32driverstsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:Windowssystem32WatWatAdminSvc.exe –> C:Windowssystem32WatWatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-09-05 13:55:12 ——– d—–w- C:UsersKaosAppDataLocal{E25F9C84-62AF-46FF-B165-7FA432DD5996}
2012-09-05 12:47:39 ——– d—–w- C:ProgramDataSpybot - Search & Destroy
2012-09-05 12:47:39 ——– d—–w- C:Program Files (x86)Spybot - Search & Destroy
2012-09-05 12:47:31 24904 —-a-w- C:WindowsSystem32driversmbam.sys
2012-09-05 03:28:12 ——– d—–w- C:UsersKaosAppDataLocal{7EFE7534-024A-4B23-BC5D-F04B56F59BA9}
2012-09-05 01:36:52 ——– d—–w- C:UsersKaosAppDataLocalMacromedia
2012-09-05 01:35:13 ——– d—–w- C:UsersKaosAppDataLocalMozilla
2012-09-05 01:34:38 ——– d—–w- C:UsersKaosAppDataRoamingMalwarebytes
2012-09-05 01:34:04 ——– d—–w- C:UsersKaosAppDataLocalYahoo
2012-09-05 01:21:44 ——– d—–w- C:UsersKaosAppDataRoamingIntel Corporation
2012-09-05 01:21:24 ——– d—–w- C:UsersKaosAppDataLocalAdobe
2012-09-05 01:21:18 ——– d—–w- C:UsersKaosAppDataRoamingBitDefender
.
==================== Find3M ====================
.
2012-08-15 06:57:31 70344 —-a-w- C:WindowsSysWow64FlashPlayerCPLApp.cpl
2012-08-15 06:57:31 426184 —-a-w- C:WindowsSysWow64FlashPlayerApp.exe
2012-08-06 13:45:45 614 —-a-w- C:WindowsSysWow64PerfStringBackup.TMP
2012-07-18 18:15:06 3148800 —-a-w- C:WindowsSystem32win32k.sys
2012-07-05 21:06:30 772544 —-a-w- C:WindowsSysWow64npDeployJava1.dll
2012-07-05 21:06:20 687544 —-a-w- C:WindowsSysWow64deployJava1.dll
2012-07-04 22:13:27 59392 —-a-w- C:WindowsSystem32browcli.dll
2012-07-04 22:13:27 136704 —-a-w- C:WindowsSystem32browser.dll
2012-07-04 21:14:34 41984 —-a-w- C:WindowsSysWow64browcli.dll
2012-06-27 07:06:53 1188864 —-a-w- C:WindowsSystem32wininet.dll
2012-06-27 05:53:07 981504 —-a-w- C:WindowsSysWow64wininet.dll
2012-06-16 05:16:04 609792 —-a-w- C:WindowsSystem32vbscript.dll
2012-06-16 04:26:57 428032 —-a-w- C:WindowsSysWow64vbscript.dll
.
============= FINISH: 15:21:39.36 ===============
aswMBR REPORT
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-05 15:29:00
—————————–
15:29:00.606 OS Version: Windows x64 6.1.7601 Service Pack 1
15:29:00.606 Number of processors: 4 586 0x2502
15:29:00.606 ComputerName: KAOS-PC UserName: Kaos
15:29:01.129 Initialze error C0000001 - driver not loaded
15:30:47.155 AVAST engine defs: 12090501
15:32:07.212 Service scanning
15:32:07.613 Service 200419957a64f041 C:WindowsSystem32Drivers200419957a64f041.sys **HIDDEN**
15:32:24.314 Modules scanning
15:32:24.316 Disk 0 trace - called modules:
15:32:24.317
15:32:24.827 AVAST engine scan C:Windows
15:32:26.657 AVAST engine scan C:Windowssystem32
15:34:35.801 AVAST engine scan C:Windowssystem32drivers
15:34:43.612 AVAST engine scan C:UsersKaos
15:36:44.204 File: C:UsersKaoszuneteznotno.exe **INFECTED** Win32:Kryptik-JXG [Trj]
15:36:44.777 AVAST engine scan C:ProgramData
15:37:32.956 Scan finished successfully
15:39:23.670 The log file has been saved successfully to "C:UsersKaosDesktopaswMBR.txt"
NO MBR.DAT file was created
COMBO FIX REPORT[
ComboFix 12-09-05.01 - Kaos 05/09/2012 15:41:55.3.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3963.2322 [GMT 1:00]
Running from: c:usersKaosDesktopComboFix.exe
AV: BitDefender Antivirus *Disabled/Updated* {982ADE23-275B-0766-37C5-DE01A484098E}
SP: BitDefender Antispyware *Disabled/Updated* {234B3FC7-0161-08E8-0D75-E573DF034333}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:windowstwain_16.dll
c:usersKaoszuneteznotno.exe . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2012-08-05 to 2012-09-05 )))))))))))))))))))))))))))))))
.
.
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersUpdatusUserAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersUpdatusUser.Kaos-PCAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersPublicAppDataLocaltemp
2012-09-05 14:44 . 2012-09-05 14:44 ——– d—–w- c:usersDefaultAppDataLocaltemp
2012-09-05 12:47 . 2012-09-05 14:25 ——– d—–w- c:programdataSpybot - Search & Destroy
2012-09-05 12:47 . 2012-09-05 14:21 ——– d—–w- c:program files (x86)Spybot - Search & Destroy
2012-09-05 12:47 . 2012-07-03 12:46 24904 —-a-w- c:windowssystem32driversmbam.sys
2012-09-05 01:36 . 2012-09-05 01:36 ——– d—–w- c:usersKaosAppDataLocalMacromedia
2012-09-05 01:35 . 2012-09-05 01:35 ——– d—–w- c:usersKaosAppDataLocalMozilla
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataRoamingMalwarebytes
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataRoamingYahoo!
2012-09-05 01:34 . 2012-09-05 01:34 ——– d—–w- c:usersKaosAppDataLocalYahoo
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataRoamingIntel Corporation
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataLocalAdobe
2012-09-05 01:21 . 2012-09-05 01:21 ——– d—–w- c:usersKaosAppDataRoamingBitDefender
2012-09-04 15:11 . 2012-09-04 15:11 96768 —-a-w- c:usersKaoszuneteznotno.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-16 02:00 . 2010-07-24 01:31 62134624 —-a-w- c:windowssystem32MRT.exe
2012-08-15 06:57 . 2012-07-31 14:33 426184 —-a-w- c:windowsSysWow64FlashPlayerApp.exe
2012-08-15 06:57 . 2011-11-23 20:03 70344 —-a-w- c:windowsSysWow64FlashPlayerCPLApp.cpl
2012-08-06 13:45 . 2012-08-06 13:45 614 —-a-w- c:windowsSysWow64PerfStringBackup.TMP
2012-07-05 21:06 . 2012-08-04 01:12 772544 —-a-w- c:windowsSysWow64npDeployJava1.dll
2012-07-05 21:06 . 2010-08-03 00:13 687544 —-a-w- c:windowsSysWow64deployJava1.dll
2012-06-20 00:08 . 2011-03-28 17:36 19736 —-a-w- c:programdataMicrosoftIdentityCRLproductionppcrlconfig600.dll
2012-06-09 05:43 . 2012-07-10 21:06 14172672 —-a-w- c:windowssystem32shell32.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"Steam"="d:steamsteam.exe" [2012-08-04 1353080]
"CrossRiderPlugin"="c:program files (x86)CrossriderWebAppsCrossrider.exe" [2011-05-15 478720]
"zuneteznotno"="c:usersKaoszuneteznotno.exe" [1601-01-01 0]
.
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun]
"BCU"="c:program files (x86)DeviceVMBrowser Configuration UtilityBCU.exe" [2009-08-04 346320]
"IAStorIcon"="c:program files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe" [2009-10-02 284696]
"WinampAgent"="c:program files (x86)Winampwinampa.exe" [2008-08-03 36352]
"PWRISOVM.EXE"="c:program files (x86)PowerISOPWRISOVM.EXE" [2009-03-15 180224]
"Adobe Reader Speed Launcher"="c:program files (x86)AdobeReader 9.0ReaderReader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:program files (x86)Common FilesAdobeARM1.0AdobeARM.exe" [2012-01-02 843712]
.
c:programdataMicrosoftWindowsStart MenuProgramsStartup
NETGEAR WG111v2 Smart Wizard.lnk - c:program files (x86)NETGEARWG111v2WG111v2.exe [2010-7-24 1261568]
.
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversiondrivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrollsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 bdfwfpf;bdfwfpf;c:program filesCommon FilesBitDefenderBitDefender Firewallbdfwfpf.sys [2010-08-04 89680]
R2 gupdate;Google Update Service (gupdate);c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 116648]
R2 SkypeUpdate;Skype Updater;c:program files (x86)SkypeUpdaterUpdater.exe [2012-02-15 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-08-15 250056]
R3 amdkmdag;amdkmdag;c:windowssystem32DRIVERSatikmdag.sys [2009-08-18 6037504]
R3 amdkmdap;amdkmdap;c:windowssystem32DRIVERSatikmpag.sys [2010-07-07 265728]
R3 Arrakis3;BitDefender Arrakis Server;c:program filesCommon FilesBitDefenderBitDefender Arrakis Serverbinarrakis3.exe [2009-10-19 278224]
R3 BDFM;BDFM;c:windowssystem32DRIVERSbdfm.sys [2010-01-29 163936]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;d:dragon agebin_shipDAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 DRHARD;DRHARD;c:windowssystem32DRIVERSDRHARD.SYS [x]
R3 gupdatem;Google Update Service (gupdatem);c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 116648]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:program files (x86)Mozilla Maintenance Servicemaintenanceservice.exe [2012-07-14 113120]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:windowssystem32driverssynth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:windowssystem32driverstsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:windowssystem32driverstsusbhub.sys [x]
R3 VGPU;VGPU;c:windowssystem32driversrdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:windowssystem32WatWatAdminSvc.exe [2010-07-24 1255736]
S0 PxHlpa64;PxHlpa64;c:windowsSystem32DriversPxHlpa64.sys [2009-07-09 55280]
S0 SCMNdisP;General NDIS Protocol Driver;c:windowssystem32DRIVERSscmndisp.sys [2007-01-19 25312]
S2 AMD External Events Utility;AMD External Events Utility;c:windowssystem32atiesrxx.exe [2009-08-18 203264]
S2 BCUService;Browser Configuration Utility Service;c:program files (x86)DeviceVMBrowser Configuration UtilityBCUService.exe [2009-08-04 219360]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:program files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe [2009-10-02 13336]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:program files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe [2012-02-10 2348352]
S2 UNS;Intel® Management & Security Application User Notification Service;c:program files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe [2009-09-30 2320920]
S3 HECIx64;Intel® Management Engine Interface;c:windowssystem32DRIVERSHECIx64.sys [2009-09-17 56344]
S3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt64win7.sys [2009-08-20 239616]
S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:windowssystem32DRIVERSwg111v2.sys [2007-12-26 340992]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - 200419957a64f041
.
[HKEY_LOCAL_MACHINEsoftwarewow6432nodemicrosoftwindows ntcurrentversionsvchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-05 c:windowsTasksAdobe Flash Player Updater.job
- c:windowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe [2012-07-31 06:57]
.
2012-09-05 c:windowsTasksGoogleUpdateTaskMachineCore.job
- c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 00:28]
.
2012-09-05 c:windowsTasksGoogleUpdateTaskMachineUA.job
- c:program files (x86)GoogleUpdateGoogleUpdate.exe [2012-04-13 00:28]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"RtHDVCpl"="c:program filesRealtekAudioHDARAVCpl64.exe" [2009-12-08 9642528]
"AdobeAAMUpdater-1.0"="c:program files (x86)Common FilesAdobeOOBEPDAppUWAUpdaterStartupUtility.exe" [2010-03-06 500208]
"BitDefender Antiphishing Helper 32"="c:program filesBitDefenderBitDefender 2010Antispam32IEShow.exe" [2009-10-19 71152]
"BitDefender Antiphishing Helper"="c:program filesBitDefenderBitDefender 2010IEShow.exe" [2009-10-19 76296]
"BDAgent"="c:program filesBitDefenderBitDefender 2010bdagent.exe" [2012-05-23 1702496]
"Windows Mobile-based device management"="c:windowsWindowsMobilewmdcBase.exe" [2007-05-31 660360]
.
——- Supplementary Scan ——-
.
uLocal Page = c:windowssystem32blank.htm
uStart Page = hxxp://www.google.co.uk/
mStart Page = about:blank
mLocal Page = c:windowsSysWOW64blank.htm
IE: E&xport; to Microsoft Excel - c:progra~2MICROS~3Office12EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:usersKaosAppDataRoamingMozillaFirefoxProfilesly7rg1o1.default
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-Messenger (Yahoo!) - c:progra~2Yahoo!MessengerYahooMessenger.exe
Wow6432Node-HKCU-Run-Facebook Update - c:usersKaosAppDataLocalFacebookUpdateFacebookUpdate.exe
Wow6432Node-HKLM-Run-Update - c:usersKaosAppDataRoaminggwey362.exe
Wow6432Node-HKLM-Run-Regedit32 - c:windowssystem32regedit.exe
AddRemove-Mumble - d:mumbleUninstall.exe
AddRemove-Yahoo! Messenger - c:progra~2Yahoo!MESSEN~1UNWISE.EXE
AddRemove-ZECA Driver Ver 1.42 - c:windowsTempMVInstallUninst.isu
AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:program files (x86)NOSbingetPlus_Helper_3004.dll
.
.
.
[HKEY_LOCAL_MACHINEsystemControlSet001services200419957a64f041]
"ImagePath"="SystemRootSystem32Drivers200419957a64f041.sys"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS.DefaultSoftwareSetIDInternal]
@Denied: (A 2) (LocalSystem)
"DATA"=""
"Device"="xr3Pxr2+yLnPx87MzrzMy8y7zcs="
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:WindowsSysWOW64MacromedFlashFlashUtil32_11_3_300_271_ActiveX.e
xe,-101"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}LocalServer32]
@="c:WindowsSysWOW64MacromedFlashFlashUtil32_11_3_300_271_ActiveX.ex
e"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{A483C63A-CDBC-426E-BF93-872502E8144E}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}InprocServer32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}Version]
@="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB6E-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}InprocServer32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}ToolboxBitmap32]
@="c:WindowsSysWOW64MacromedFlashFlash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}Version]
@="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeCLSID{D27CDB70-AE6D-11cf-96B8-444553540000}VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINEsoftwareClassesWow6432NodeInterface{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINEsoftwareWow6432NodeMicrosoftWindows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,
.
[HKEY_LOCAL_MACHINEsystemControlSet001ControlPCWSecurity]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:program files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe
c:program files (x86)Common FilesMicrosoft SharedVS7DEBUGmdm.exe
.
**************************************************************************
.
Completion time: 2012-09-05 15:50:39 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-05 14:50
ComboFix2.txt 2012-08-03 01:41
.
Pre-Run: 92,004,999,168 bytes free
Post-Run: 91,915,968,512 bytes free
.
- - End Of File - - 43A72D45975C2E53B6D173981101B406
Malaware still finds that same virus each time it scans, and that zuneteznotno.exe is still sitting on my system
???
