maldini
Thank you again for all your help and I hope you have a great day tomorrow.
Spyware / Malware / Virus Removal
"The specified device does not exist as an installed service"
53 min read
patndoris
Since you can't connect to the internet, let's give this a try. I'm hoping this will run in Safe Mode. This particular virus is very good at hiding from tools and it doesn't affect any two machines quite the same. This tool is designed to find and fix. . It could take hours to run depending on how much is on the machine so be patient.
Happy Thanksgiving!!
Kaspersky Virus Removal Tool
The Kaspersky Virus Removal Tool is a scan-and-remove solution from Kaspersky that searches out the most common malware and attempts to remove it from your computer.
Please download the Kaspersky Virus Removal Tool from Kaspersky's Official Link and save it to your Desktop.
Happy Thanksgiving!!
Kaspersky Virus Removal Tool
The Kaspersky Virus Removal Tool is a scan-and-remove solution from Kaspersky that searches out the most common malware and attempts to remove it from your computer.
Please download the Kaspersky Virus Removal Tool from Kaspersky's Official Link and save it to your Desktop.
- Double-click the Setup file to install it on your computer.
- Once it has installed, review and accept the agreement and press the Start button.
- You will presented with the main interface, but don't scan yet, click the options tab (gear icon):
[external image: Posted Image] - On the Scan Scope tab, make sure to checkmark all the options, except for the CD/DVD drive:
[external image: Posted Image] - On the Security Level tab, make sure to move the slider up denoting "Current Security Level: High"
[external image: Posted Image] - Now, go back to the Automatic Scan tab, and choose "Start Scanning". It may take several hours to complete. Please allow it to do so.
- Once done scanning, choose the Report tab (page icon), select Detected Threats tab on left, and choose Disinfect All:
[external image: Posted Image] - Then, choose Save. Also, in the Automatic Report tab, select Save:
[external image: Posted Image] - Please post the reports in your next reply.
- Once you exit, the tool should uninstall automatically.
maldini
Hi,
I have possible good news but I am not proceeding until I hear back to make sure I don't make a mistake.
*I booted into safe mode and ran the Kaspersky tool and then went off to Thanksgiving Dinner at my relatives.
*When I came home the tool has paused at 49%.
*It has found 9 threats so far and has detected one malicious software.
*It has paused waiting for input to see whether I want to "delete" the malicious software or "skip" it.
The malicious software trojan program found is called
Trojan-Spy.Win32.Zbot.gizg
Should I delete or skip this object before allowing the tool to continue?
Thanks
I have possible good news but I am not proceeding until I hear back to make sure I don't make a mistake.
*I booted into safe mode and ran the Kaspersky tool and then went off to Thanksgiving Dinner at my relatives.
*When I came home the tool has paused at 49%.
*It has found 9 threats so far and has detected one malicious software.
*It has paused waiting for input to see whether I want to "delete" the malicious software or "skip" it.
The malicious software trojan program found is called
Trojan-Spy.Win32.Zbot.gizg
Should I delete or skip this object before allowing the tool to continue?
Thanks
patndoris
Go ahead and delete it and then allow the tool to continue.
maldini
Ok it is proceeding now.
Should I check in every time it pauses or just go ahead and delete the Trojans when found?
patndoris
You can go ahead and delete them. We want to disinfect anything it finds. The cleaner we can get the machine right now the better 
If we can remove threats then at least we know they won't be part of the problem if it remains. And we can hope that once done we will resolve some or all of the problem.
Malware can hide almost anywhere these days. And since no one tool looks in every location, it's a good thing we have so many tools to use. Some depend on the internet for their scans. I'm glad this is running well in safe mode.
If we can remove threats then at least we know they won't be part of the problem if it remains. And we can hope that once done we will resolve some or all of the problem.
Malware can hide almost anywhere these days. And since no one tool looks in every location, it's a good thing we have so many tools to use. Some depend on the internet for their scans. I'm glad this is running well in safe mode.
maldini
It has completed
There were 9 total issues found
2 were deleted during the run
7 were considered low vulnerability.
After rebooting into safe mode, all original symptoms still remain
>select Detected Threats tab on left, and choose Disinfect All:
I am not convinced that the tool actually did anything on this step. There was no feedback and it was almost as if the icon could not really be selected.
I am including one log as a paste below. I do not know what to do with the second log as it is too big to either attach or paste (150meg). I think it is a log of every file that was checked by the program.
===================================================
Status: Deleted (events: 2)
11/22/2012 9:06:19 PM Deleted Trojan program Trojan-Spy.Win32.Zbot.gizq C:\Qoobox\Quarantine\C\Users\T61p\AppData\Roaming\793BEB\793BEB.exe.vir High
11/22/2012 9:06:23 PM Deleted Trojan program Trojan-Spy.Win32.Zbot.gixx C:\Qoobox\Quarantine\C\Users\T61p\AppData\Roaming\Ydid\keybk.exe.vir High
Status: Vulnerability (events: 7)
11/22/2012 2:07:23 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/50949 C:\Program Files\Java\jre6\bin\java.exe Low
11/22/2012 2:45:30 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/43269 C:\Windows.old\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.dll Low
11/22/2012 2:45:38 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/47133 C:\Windows.old\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe Low
11/22/2012 2:52:41 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/41345 C:\Windows.old\Program Files\cvsnt\cvs.exe Low
11/22/2012 2:54:14 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/20845 C:\Windows.old\Program Files\InterActual\InterActual Player\iPlayer.exe Low
11/22/2012 2:54:14 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/20845 C:\Windows.old\Program Files\InterActual\InterActual Player\bin\pcfpatch Low
11/22/2012 2:54:39 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/50949 C:\Windows.old\Program Files\Java\jre6\bin\java.exe Low
There were 9 total issues found
2 were deleted during the run
7 were considered low vulnerability.
After rebooting into safe mode, all original symptoms still remain
>select Detected Threats tab on left, and choose Disinfect All:
I am not convinced that the tool actually did anything on this step. There was no feedback and it was almost as if the icon could not really be selected.
I am including one log as a paste below. I do not know what to do with the second log as it is too big to either attach or paste (150meg). I think it is a log of every file that was checked by the program.
===================================================
Status: Deleted (events: 2)
11/22/2012 9:06:19 PM Deleted Trojan program Trojan-Spy.Win32.Zbot.gizq C:\Qoobox\Quarantine\C\Users\T61p\AppData\Roaming\793BEB\793BEB.exe.vir High
11/22/2012 9:06:23 PM Deleted Trojan program Trojan-Spy.Win32.Zbot.gixx C:\Qoobox\Quarantine\C\Users\T61p\AppData\Roaming\Ydid\keybk.exe.vir High
Status: Vulnerability (events: 7)
11/22/2012 2:07:23 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/50949 C:\Program Files\Java\jre6\bin\java.exe Low
11/22/2012 2:45:30 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/43269 C:\Windows.old\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.dll Low
11/22/2012 2:45:38 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/47133 C:\Windows.old\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe Low
11/22/2012 2:52:41 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/41345 C:\Windows.old\Program Files\cvsnt\cvs.exe Low
11/22/2012 2:54:14 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/20845 C:\Windows.old\Program Files\InterActual\InterActual Player\iPlayer.exe Low
11/22/2012 2:54:14 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/20845 C:\Windows.old\Program Files\InterActual\InterActual Player\bin\pcfpatch Low
11/22/2012 2:54:39 PM Vulnerability vulnerability http://www.securelist.com/en/advisories/50949 C:\Windows.old\Program Files\Java\jre6\bin\java.exe Low
patndoris
Unfortunately, the 2 items it found were already in quarantine by Combofix. Nothing new
When you do an F5 to boot into safe mode, on that same screen is there an option further down the screen for for Advance Options? Don't choose it, I'd just like to know if it exists. We may have a preinstalled repair option to try.
Also, please go to your internet Options > Connections > LAN settings and make sure there is no Proxy selected. From your logs there should not be but it's a good idea to double check and I should have had you do this previously. If there is uncheck the box. And make sure the box at the top for Auto-detect settings is selected instead.
Can you please download a fresh copy of Combofix, delete the one off the desktop of the infected machine, and go ahead and run a clean copy in safe mode please and paste the results?
After we get a fresh Combofix log, I'm going to consult with some of my colleagues because I'm just not seeing any further malware issues here. I'm not sure if this is something hiding from me, if we really need a repair disc for a 32-bit system to do a repair, or if it could be a hardware issue - or if it could be some combination of those.
When you do an F5 to boot into safe mode, on that same screen is there an option further down the screen for for Advance Options? Don't choose it, I'd just like to know if it exists. We may have a preinstalled repair option to try.
Also, please go to your internet Options > Connections > LAN settings and make sure there is no Proxy selected. From your logs there should not be but it's a good idea to double check and I should have had you do this previously. If there is uncheck the box. And make sure the box at the top for Auto-detect settings is selected instead.
Can you please download a fresh copy of Combofix, delete the one off the desktop of the infected machine, and go ahead and run a clean copy in safe mode please and paste the results?
After we get a fresh Combofix log, I'm going to consult with some of my colleagues because I'm just not seeing any further malware issues here. I'm not sure if this is something hiding from me, if we really need a repair disc for a 32-bit system to do a repair, or if it could be a hardware issue - or if it could be some combination of those.
maldini
These are the choices in the Safe mode screen
Repair Your Computer
Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt
Enable Boot Logging
Enable Low Resolution video
Last Known Good Configuration
Directory Services Restore Mode
Debugging Mode
Disable Automatic Restart on system failure
Disable Driver Signature Enforcement
Start Windows Normally
=======================================================
There was no proxy selected and the box for Auto_detect is checked.
I will work on comboFix next and post shortly
patndoris
Please try the Repair your computer option and see if that does any good. It may take some time and it may say it can't fix the system. Sometimes even when it says that a reboot will still show that it has worked. Give it a try and see what happens. Can't hurt.
maldini
Please try the Repair your computer option and see if that does any good. It may take some time and it may say it can't fix the system. Sometimes even when it says that a reboot will still show that it has worked. Give it a try and see what happens. Can't hurt.
Sounds good. After combo fix completes I will try that option.
maldini
Here is the comboFix log. I am running Repair Your Computer now
====================================
ComboFix 12-11-23.02 - T61p 11/23/2012 11:28:05.4.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2509 [GMT -5:00]
Running from: E:\ComboFix.exe
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2012-10-23 to 2012-11-23 )))))))))))))))))))))))))))))))
.
.
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(180)
c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2012-11-23 11:35:44
ComboFix-quarantined-files.txt 2012-11-23 16:35
ComboFix2.txt 2012-11-21 14:45
ComboFix3.txt 2012-11-20 20:30
ComboFix4.txt 2012-11-20 00:32
.
Pre-Run: 182,143,418,368 bytes free
Post-Run: 182,015,557,632 bytes free
.
- - End Of File - - 3DACADCC371CE1BF095A823B7F59698C
====================================
ComboFix 12-11-23.02 - T61p 11/23/2012 11:28:05.4.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2509 [GMT -5:00]
Running from: E:\ComboFix.exe
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2012-10-23 to 2012-11-23 )))))))))))))))))))))))))))))))
.
.
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(180)
c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2012-11-23 11:35:44
ComboFix-quarantined-files.txt 2012-11-23 16:35
ComboFix2.txt 2012-11-21 14:45
ComboFix3.txt 2012-11-20 20:30
ComboFix4.txt 2012-11-20 00:32
.
Pre-Run: 182,143,418,368 bytes free
Post-Run: 182,015,557,632 bytes free
.
- - End Of File - - 3DACADCC371CE1BF095A823B7F59698C
maldini
Repair Your Computer boots the machine into a special mode in which I have the following option choices.
Startup Repair - Automatically Fixes problems that are preventing Windows from starting
System Restore - Restore Windows to an earlier point
System Image Recovery - Recover your computer using a system image you created earlier
Windows Memory Diagnostic - Check your computer for memory hardware errors
Command Prompt - Open a command prompt window
patndoris
Please try the Startup Repair.
maldini
Please try the Startup Repair.
I tried that option and it was not able to detect any problems with the machine.
It then rebooted into normal mode and as expected the symptoms remain.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI