What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser hijacked by conduit [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Well, things seem to be running ok and up to speed. I deleted Realplayer because I kept getting errors that something was corrupt and it would have me click to fix it, then I would get an error that it had to close because it had stopped working. I went back onto Download.com and was going to download a new copy when I read the same thing happening to almost everyone who uses it or who recently downloaded it so I guess it's the program, not just my copy. Other than that, I guess things are ok.
Post #18
Ok good….let's check for anything else hiding.

[external image: Posted Image]

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Installed Applications and Applets
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.
———-

[external image: Posted Image] Please download Malwarebytes Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:

Windows 2000 & Windows XP:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs

Windows Vista & Win7:
C:\Users\\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #19
OK, 1st, Cannot locate anything called Java Cache and I went to the java page to look, too. I know I have done this before on my own a while back so I don't know why I can't find it now. Malware bytes found 12 items! :o Heading for the ESET scanner right now. Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.08.22.10 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 arwen :: ARWEN-PC [administrator] 8/22/2013 10:31:39 PM mbam-log-2013-08-22 (22-31-39).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 228480 Time elapsed: 5 minute(s), 37 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCR\CLSID\{CF190686-9E72-403C-B99D-682ABDB63C5B} (PUP.Optional.TopArcadeHits.A) -> No action taken. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3} (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin (PUP.Optional.TopArcadeHits.A) -> No action taken. Files Detected: 7 C:\Users\arwen\Downloads\winamp565_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome.manifest (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\icon.png (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\install.rdf (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content\browser.xul (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content\toparcadehits.js (PUP.Optional.TopArcadeHits.A) -> No action taken. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin\style.css (PUP.Optional.TopArcadeHits.A) -> No action taken. (end)
Post #20
ESET Scan C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe a variant of Win32/Bundled.Toolbar.Ask.D application C:\Users\arwen\Downloads\cbsidlm-cbsi118-RealPlayer-ORG-10073040.exe probably a variant of Win32/CNETInstaller.A application C:\Users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792 (1).exe Win32/DownloadAdmin.G application C:\Users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792.exe Win32/DownloadAdmin.G application C:\Users\arwen\Downloads\winamp565_full_emusic-7plus_all.exe Win32/OpenCandy application D:\Everything\Antivirus\avira_free_antivirus_en.exe a variant of Win32/Bundled.Toolbar.Ask application
Post #21
Hi,

Ok don't worry about Java. :)

Run Malwarebytes again but this time be sure to remove everything that is found and then post that new log.
———-

ComboFix
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


    ClearJavaCache::

    File::
    C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe
    C:\Users\arwen\Downloads\cbsidlm-cbsi118-RealPlayer-ORG-10073040.exe
    C:\Users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792 (1).exe
    C:\Users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792.exe
    C:\Users\arwen\Downloads\winamp565_full_emusic-7plus_all.exe
    D:\Everything\Antivirus\avira_free_antivirus_en.exe

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Post the new ComboFix log and let me know what remaining malware problems you are having. :)
Post #22
mbam log Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.08.23.08 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 arwen :: ARWEN-PC [administrator] 8/23/2013 8:14:04 PM mbam-log-2013-08-23 (20-14-04).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 228692 Time elapsed: 3 minute(s), 30 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCR\CLSID\{CF190686-9E72-403C-B99D-682ABDB63C5B} (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3} (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. Files Detected: 7 C:\Users\arwen\Downloads\winamp565_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome.manifest (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\icon.png (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\install.rdf (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content\browser.xul (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content\toparcadehits.js (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. C:\Users\arwen\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin\style.css (PUP.Optional.TopArcadeHits.A) -> Quarantined and deleted successfully. (end)
Post #23
ComboFix 13-08-22.01 - arwen 08/23/2013 20:31:10.3.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.4024.2044 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\arwen\Desktop\CFScript.txt AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\program files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe" "c:\users\arwen\Downloads\cbsidlm-cbsi118-RealPlayer-ORG-10073040.exe" "c:\users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792 (1).exe" "c:\users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792.exe" "c:\users\arwen\Downloads\winamp565_full_emusic-7plus_all.exe" "d:\everything\Antivirus\avira_free_antivirus_en.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe c:\users\arwen\AppData\Local\Temp\RtkBtMnt.exe c:\users\arwen\Downloads\cbsidlm-cbsi118-RealPlayer-ORG-10073040.exe c:\users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792 (1).exe c:\users\arwen\Downloads\cbsidlm-tr1_14-Winamp-ORG-10251792.exe d:\everything\Antivirus\avira_free_antivirus_en.exe . . ((((((((((((((((((((((((( Files Created from 2013-07-24 to 2013-08-24 ))))))))))))))))))))))))))))))) . . 2013-08-24 01:37 . 2013-08-24 01:37 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-08-23 03:51 . 2013-08-23 03:51 ——– d—–w- c:\program files (x86)\ESET 2013-08-23 03:29 . 2013-08-23 03:29 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2013-08-23 03:29 . 2013-04-04 19:50 25928 —-a-w- c:\windows\system32\drivers\mbam.sys 2013-08-22 09:51 . 2013-08-22 09:51 ——– d—–w- c:\windows\ERUNT 2013-08-18 04:52 . 2013-08-18 04:52 388096 —-a-r- c:\users\arwen\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2013-08-18 04:40 . 2013-08-18 04:40 ——– d—–w- c:\program files (x86)\Trend Micro 2013-08-17 10:40 . 2013-08-17 10:40 ——– d—–w- c:\program files\CCleaner 2013-08-16 09:38 . 2009-09-04 22:29 1892184 —-a-w- c:\windows\SysWow64\D3DX9_42.dll 2013-08-16 09:38 . 2006-09-28 21:05 2414360 —-a-w- c:\windows\SysWow64\d3dx9_31.dll 2013-08-16 09:38 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp Detect 2013-08-16 09:37 . 2013-08-16 09:37 ——– d—–w- c:\program files (x86)\Common Files\PX Storage Engine 2013-08-16 09:37 . 2013-08-22 10:40 ——– d—–w- c:\users\arwen\AppData\Roaming\Winamp 2013-08-16 09:37 . 2013-08-16 09:38 ——– d—–w- c:\program files (x86)\Winamp 2013-08-16 09:12 . 2013-08-20 07:15 ——– d—–w- c:\users\AppData 2013-08-15 00:15 . 2013-07-08 04:51 4691904 —-a-w- c:\windows\system32\ntoskrnl.exe 2013-08-12 05:32 . 2013-08-12 05:32 ——– d—–w- c:\users\arwen\AppData\Local\Apple Computer 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll 2013-08-04 07:08 . 2013-08-04 07:08 159744 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\program files (x86)\QuickTime 2013-08-04 07:08 . 2013-08-04 07:08 ——– d—–w- c:\programdata\Apple Computer 2013-07-31 23:42 . 2013-07-31 23:42 ——– d—–w- c:\users\arwen\AppData\Roaming\Apple Computer 2013-07-31 10:30 . 2013-07-31 10:30 ——– d—–w- c:\program files (x86)\Common Files\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\users\arwen\AppData\Local\Apple 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\program files (x86)\Apple Software Update 2013-07-31 10:29 . 2013-07-31 10:29 ——– d—–w- c:\programdata\Apple 2013-07-30 06:49 . 2013-07-30 06:49 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-07-30 06:49 . 2013-07-30 06:48 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-07-30 06:49 . 2013-07-30 06:48 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-07-30 06:48 . 2013-07-30 06:48 ——– d—–w- c:\program files (x86)\Java 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\users\arwen\AppData\Roaming\Leader Technologies 2013-07-27 06:15 . 2013-07-27 06:15 ——– d—–w- c:\program files (x86)\LTCM Client . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-15 04:55 . 2006-11-02 12:35 78161360 —-a-w- c:\windows\system32\mrt.exe 2013-07-20 06:57 . 2013-07-20 06:57 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-20 06:57 . 2013-07-20 06:57 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-17 10:55 . 2013-07-17 10:55 161792 —-a-w- c:\windows\SysWow64\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 74752 —-a-w- c:\windows\SysWow64\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 63488 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 367104 —-a-w- c:\windows\SysWow64\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 152064 —-a-w- c:\windows\SysWow64\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 35840 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 11776 —-a-w- c:\windows\SysWow64\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 101888 —-a-w- c:\windows\SysWow64\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 222208 —-a-w- c:\windows\system32\msls31.dll 2013-07-17 10:55 . 2013-07-17 10:55 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2013-07-17 10:55 . 2013-07-17 10:55 55296 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-07-17 10:55 . 2013-07-17 10:55 49664 —-a-w- c:\windows\system32\imgutil.dll 2013-07-17 10:55 . 2013-07-17 10:55 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-07-17 10:55 . 2013-07-17 10:55 267776 —-a-w- c:\windows\system32\ieaksie.dll 2013-07-17 10:55 . 2013-07-17 10:55 197120 —-a-w- c:\windows\system32\msrating.dll 2013-07-17 10:55 . 2013-07-17 10:55 163840 —-a-w- c:\windows\system32\ieakui.dll 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\ieakeng.dll 2013-07-17 10:55 . 2013-07-17 10:55 145920 —-a-w- c:\windows\system32\iepeers.dll 2013-07-17 10:55 . 2013-07-17 10:55 136192 —-a-w- c:\windows\system32\advpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 135168 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-07-17 10:55 . 2013-07-17 10:55 12288 —-a-w- c:\windows\system32\mshta.exe 2013-07-17 10:55 . 2013-07-17 10:55 114176 —-a-w- c:\windows\system32\admparse.dll 2013-07-17 10:55 . 2013-07-17 10:55 111616 —-a-w- c:\windows\system32\iesysprep.dll 2013-07-17 10:55 . 2013-07-17 10:55 10752 —-a-w- c:\windows\system32\msfeedssync.exe 2013-07-17 10:55 . 2013-07-17 10:55 89088 —-a-w- c:\windows\system32\ie4uinit.exe 2013-07-17 10:55 . 2013-07-17 10:55 85504 —-a-w- c:\windows\system32\iesetup.dll 2013-07-17 10:55 . 2013-07-17 10:55 82432 —-a-w- c:\windows\system32\icardie.dll 2013-07-17 10:55 . 2013-07-17 10:55 76800 —-a-w- c:\windows\system32\tdc.ocx 2013-07-17 10:55 . 2013-07-17 10:55 534528 —-a-w- c:\windows\system32\ieapfltr.dll 2013-07-17 10:55 . 2013-07-17 10:55 452608 —-a-w- c:\windows\system32\dxtmsft.dll 2013-07-17 10:55 . 2013-07-17 10:55 448512 —-a-w- c:\windows\system32\html.iec 2013-07-17 10:55 . 2013-07-17 10:55 403248 —-a-w- c:\windows\system32\iedkcs32.dll 2013-07-17 10:55 . 2013-07-17 10:55 39936 —-a-w- c:\windows\system32\iernonce.dll 2013-07-17 10:55 . 2013-07-17 10:55 3695416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-07-17 10:55 . 2013-07-17 10:55 30720 —-a-w- c:\windows\system32\licmgr10.dll 2013-07-17 10:55 . 2013-07-17 10:55 282112 —-a-w- c:\windows\system32\dxtrans.dll 2013-07-17 10:55 . 2013-07-17 10:55 249344 —-a-w- c:\windows\system32\webcheck.dll 2013-07-17 10:55 . 2013-07-17 10:55 165888 —-a-w- c:\windows\system32\iexpress.exe 2013-07-17 10:55 . 2013-07-17 10:55 160256 —-a-w- c:\windows\system32\wextract.exe 2013-07-17 10:55 . 2013-07-17 10:55 103936 —-a-w- c:\windows\system32\inseng.dll 2013-07-17 10:55 . 2013-07-17 10:55 65024 —-a-w- c:\windows\system32\pngfilt.dll 2013-07-17 10:55 . 2013-07-17 10:55 149504 —-a-w- c:\windows\system32\occache.dll 2013-07-17 10:53 . 2013-07-17 10:53 979456 —-a-w- c:\windows\SysWow64\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 1257984 —-a-w- c:\windows\system32\MFH264Dec.dll 2013-07-17 10:53 . 2013-07-17 10:53 98816 —-a-w- c:\windows\SysWow64\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 428544 —-a-w- c:\windows\system32\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 377344 —-a-w- c:\windows\system32\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 357376 —-a-w- c:\windows\SysWow64\MFHEAACdec.dll 2013-07-17 10:53 . 2013-07-17 10:53 3548672 —-a-w- c:\windows\system32\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 345088 —-a-w- c:\windows\system32\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 34304 —-a-w- c:\windows\system32\mfpmp.exe 2013-07-17 10:53 . 2013-07-17 10:53 302592 —-a-w- c:\windows\SysWow64\mfmp4src.dll 2013-07-17 10:53 . 2013-07-17 10:53 2873344 —-a-w- c:\windows\SysWow64\mf.dll 2013-07-17 10:53 . 2013-07-17 10:53 278528 —-a-w- c:\windows\system32\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 261632 —-a-w- c:\windows\SysWow64\mfreadwrite.dll 2013-07-17 10:53 . 2013-07-17 10:53 209920 —-a-w- c:\windows\SysWow64\mfplat.dll 2013-07-17 10:53 . 2013-07-17 10:53 195072 —-a-w- c:\windows\system32\mfps.dll 2013-07-17 10:53 . 2013-07-17 10:53 748544 —-a-w- c:\windows\system32\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 586240 —-a-w- c:\windows\SysWow64\stobject.dll 2013-07-17 10:53 . 2013-07-17 10:53 1204224 —-a-w- c:\windows\system32\shdocvw.dll 2013-07-17 10:53 . 2013-07-17 10:53 231936 —-a-w- c:\windows\system32\XpsRasterService.dll 2013-07-17 10:53 . 2013-07-17 10:53 847360 —-a-w- c:\windows\SysWow64\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 625152 —-a-w- c:\windows\system32\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 478720 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-07-17 10:53 . 2013-07-17 10:53 366592 —-a-w- c:\windows\system32\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 35840 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2013-07-17 10:53 . 2013-07-17 10:53 258048 —-a-w- c:\windows\SysWow64\winspool.drv 2013-07-17 10:53 . 2013-07-17 10:53 1461760 —-a-w- c:\windows\system32\OpcServices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1032192 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2013-07-17 10:53 . 2013-07-17 10:53 3068416 —-a-w- c:\windows\system32\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 1554432 —-a-w- c:\windows\SysWow64\xpsservices.dll 2013-07-17 10:53 . 2013-07-17 10:53 135680 —-a-w- c:\windows\SysWow64\XpsRasterService.dll 2013-07-17 10:52 . 2013-07-17 10:52 519680 —-a-w- c:\windows\SysWow64\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 449024 —-a-w- c:\windows\system32\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 369664 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-07-17 10:52 . 2013-07-17 10:52 328192 —-a-w- c:\windows\system32\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 262656 —-a-w- c:\windows\system32\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 252928 —-a-w- c:\windows\SysWow64\dxdiag.exe 2013-07-17 10:52 . 2013-07-17 10:52 195584 —-a-w- c:\windows\SysWow64\dxdiagn.dll 2013-07-17 10:52 . 2013-07-17 10:52 974848 —-a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-07-17 10:52 . 2013-07-17 10:52 792576 —-a-w- c:\windows\system32\d3d11.dll 2013-07-17 10:52 . 2013-07-17 10:52 411648 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 321024 —-a-w- c:\windows\SysWow64\PhotoMetadataHandler.dll 2013-07-17 10:52 . 2013-07-17 10:52 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 189440 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-07-17 10:52 . 2013-07-17 10:52 1209856 —-a-w- c:\windows\system32\WindowsCodecs.dll 2013-07-13 12:32 . 2013-07-13 12:44 58696 —-a-w- c:\windows\SysWow64\AOLParconLink.exe 2013-07-13 09:03 . 2013-07-13 09:06 28600 —-a-w- c:\windows\system32\drivers\avkmgr.sys 2013-07-13 09:03 . 2013-07-13 09:06 130016 —-a-w- c:\windows\system32\drivers\avipbb.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:52 121392 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-07-13 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-12 781824] "BkupTray"="c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672] "LManager"="c:\progra~2\LAUNCH~1\QtZgAcer.EXE" [2008-06-04 817672] "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-07-24 147456] "CLMLServer"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-07-24 167936] "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-07-18 167936] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-07-13 345144] "HostManager"="c:\program files (x86)\Common Files\AOL\1373719338\ee\AOLSoftware.exe" [2010-03-08 41800] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "LTCM Client"="c:\program files (x86)\LTCM Client\ltcmClient.exe" [2011-04-07 2756864] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Start GeekBuddy.lnk - c:\program files (x86)\Comodo\GeekBuddy\launcher.exe "unit_manager.exe" [2013-4-17 49352] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-08-22 11:09 1177552 —-a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . 2013-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-13 07:03] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-30 01:53 50736 —-a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-08-01 481792] "eDataSecurity Loader"="c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-07-30 561200] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 151064] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 209432] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 181784] "RtHDVCpl"="RAVCpl64.exe" [2008-09-18 6495264] "Skytel"="Skytel.exe" [2008-09-18 1833504] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1237288] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=2&o=vp64&d=0713&m=aspire_6930 mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll TCP: DhcpNameServer = [removed] [removed] . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0011) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0011) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0011) @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0011) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-08-23 20:40:12 ComboFix-quarantined-files.txt 2013-08-24 01:40 ComboFix2.txt 2013-08-21 00:51 ComboFix3.txt 2013-08-20 07:15 . Pre-Run: 82,198,028,288 bytes free Post-Run: 81,972,203,520 bytes free . - - End Of File - - 56AA72132B1FAFCBF707FDE2F19CA465 BB9D3A6A13C5010348DA7C900BB6AF50
Post #24
OK, so I don't know what to think after malwarebytes found all those files, again. I immediately got the message that Malwarebytes trial period had expired and I guess with that version, I need to pay, yet it did do the update when I told it to, plus it appears to have found those 12 bits of malware and removed them. But I am still not sure if I am ok or not. I want to reactivate my Comodo firewall but I am waiting for the all clear since I am not supposed to download anything until we are done. Thanks!
Post #25
Don't worry that Malwarebytes found those entries. It is quite common to find residual entries at the end of cleaning a system. The trial period for Malwarebytes Pro probably ended, but you can scan and update on command and I would do that regularly. :) Go ahead and start up Comodo firewall and give your system a good run around today. I am leaving town and won't be back until later tonight so let me know later how things are running.
Post #28
Updated and ran Malwarebytes, again. Nothing found. Reactivated or installed Comodo, running fine. The only other issue is the same error message I am getting about having disabled the internet protection and that I need to enable it. I have no clue how, but I can always download a new copy, I guess. lol
Post #30
I have been doing some reading and I believe that this is something occurring with Comodo Firewall. I have not experienced it (yet) but from what I am reading these may be due to Comodo.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI