Jump to content

Chrome infected? Help =(


Recommended Posts

  • Replies 60
  • Created
  • Last Reply

Top Posters In This Topic

SystemLook 30.07.11 by jpshortstuff

Log created at 20:58 on 11/07/2012 by Marc

Administrator - Elevation successful

========== folderfind ==========

Searching for "*torrent*"

C:\Qoobox\Quarantine\C\Users\Marc\AppData\Local\uTorrent d------ [06:49 10/07/2012]

C:\Qoobox\Quarantine\C\Users\Marc\Documents\Torrents d------ [06:49 10/07/2012]

========== regfind ==========

Searching for "torrent"

[HKEY_CURRENT_USER\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent]

"Extension"=".torrent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{FDDD8E30-CA42-42E8-AD0E-3CDC9E578135}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{88A4D3F4-8B33-47B4-BDCB-3A69590D10A0}"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files\uTorrent\uTorrent.exe|Name=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"TCP Query User{FDA56C29-B91C-4FA8-B472-4CEEDC48EC92}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"UDP Query User{E7ED8748-38A2-4649-8715-D36A53C19F5D}C:\program files\utorrent\utorrent.exe"="v2.0|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\program files\utorrent\utorrent.exe|Name=µTorrent|Desc=µTorrent|Edge=FALSE|"

[HKEY_USERS\S-1-5-21-3952486750-2209785099-4280780671-1000\Software\Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

[HKEY_USERS\S-1-5-21-3952486750-2209785099-4280780671-1000_Classes\MIME\DataBase\Content Type\application/x-bittorrentsearchdescription+xml]

-= EOF =-

Link to post
Share on other sites

On my existing profiles, there's nothing there.

"Boo... You have no extensions :-( Want to browse the gallery instead?"

If I create a new user and then go to the Extensions options page, it shows the same thing (no extensions) for about ten or twenty seconds, and then the uTorrentControl2 extension appears (along with the button next to the tab URL). I have clicked on the garbage can icon to remove the extension every time.

--

Marc.

Link to post
Share on other sites


  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :folderfind
    *CRE*


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Link to post
Share on other sites

SystemLook 30.07.11 by jpshortstuff

Log created at 15:50 on 15/07/2012 by Marc

Administrator - Elevation successful

========== folderfind ==========

Searching for "*CRE*"

C:\Program Files\Common Files\microsoft shared\THEMES12\CONCRETE d------ [18:55 30/07/2008]

C:\Program Files\Hewlett-Packard\HP Software UI\PC Registration d------ [11:21 21/12/2006]

C:\Program Files\LEGO Company\LEGO Digital Designer\HTML\StarterModels\Creator d------ [04:09 24/01/2012]

C:\Program Files\Microsoft SDKs\Windows\v7.0A\Bootstrapper\Packages\vcredist_x64 d------ [02:29 01/09/2010]

C:\Program Files\Microsoft SDKs\Windows\v7.0A\Bootstrapper\Packages\vcredist_x86 d------ [02:30 01/09/2010]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\CSharp\WPF\1033\WPFSplashScreen.zip d------ [08:25 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\VisualBasic\Windows Forms\1033\SplashScreen.zip d------ [08:26 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ItemTemplatesCache\VisualBasic\WPF\1033\WPFSplashScreen.zip d------ [08:26 14/03/2012]

C:\Program Files\Microsoft Visual Studio 10.0\VB\Snippets\1033\data\xml\XML - Create d------ [02:27 01/09/2010]

C:\Program Files\Microsoft Visual Studio 10.0\VC\VCResourceTemplates d------ [02:27 01/09/2010]

C:\Program Files\Notepad++\user.manual\Images\Screenshots d------ [00:54 13/03/2011]

C:\System.sav\TSCREEN d------ [20:21 27/11/2006]

C:\Users\Marc\AppData\Local\Bizarre Creations d------ [19:02 14/01/2010]

C:\Users\Marc\AppData\Local\CRE d------ [02:42 28/05/2012]

C:\Users\Marc\AppData\Local\Google\GBScreensaver d------ [23:16 19/09/2009]

C:\Users\Marc\AppData\Local\Microsoft\Credentials d---s-- [10:12 03/01/2008]

C:\Users\Marc\AppData\Roaming\Ipswitch\WS_FTP\HTML\Res_409_12.0.1\SSHCLIENTKEYCREATE d------ [23:22 10/08/2009]

C:\Users\Marc\AppData\Roaming\Ipswitch\WS_FTP\HTML\Res_409_12.0.1\SSLCREATECERTWIZ d------ [23:22 10/08/2009]

C:\Users\Marc\AppData\Roaming\Microsoft\Credentials d---s-- [10:12 03/01/2008]

C:\Users\Marc\brickstore-cache\M\cre001 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre002 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre003 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre004 d------ [20:56 29/05/2011]

C:\Users\Marc\brickstore-cache\M\cre005 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre006 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre010 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\M\cre011 d------ [07:02 08/03/2012]

C:\Users\Marc\brickstore-cache\P\crssprt02pb72 d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb77 d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb38b d------ [04:40 27/12/2011]

C:\Users\Marc\brickstore-cache\P\crssprt02pb64a d------ [04:40 27/12/2011]

C:\Users\Marc\Calibre Library\J. K. Rowling\Harry Potter and the Chamber of Secrets (462) d------ [02:20 30/12/2010]

C:\Users\Marc\Documents\LEGO Creations d------ [20:22 27/07/2009]

C:\Users\Mcx1\AppData\Local\Microsoft\Credentials d---s-- [03:39 23/11/2011]

C:\Users\Mcx1\AppData\Roaming\Microsoft\Credentials d---s-- [03:39 23/11/2011]

C:\Windows\assembly\GAC_MSIL\IEExecRemote dr----- [11:18 02/11/2006]

C:\Windows\ehome\CreateDisc d------ [12:37 02/11/2006]

C:\Windows\ehome\CreateDisc\SonicResources d------ [12:37 02/11/2006]

C:\Windows\System32\config\systemprofile\AppData\Local\Google\GBScreensaver d------ [20:54 24/01/2010]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.16386_none_ef9a51cfc4df6184 d------ [11:18 02/11/2006]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.16720_none_ef94d833c4e430f8 d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6000.20883_none_d8cceed7de8675eb d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.18000_none_ef6ed38bc5370a50 d------ [11:21 24/09/2008]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.18111_none_ef6fbce9c5363d99 d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6001.22230_none_d8a42d85dedbb6ac d------ [14:37 15/02/2009]

C:\Windows\winsxs\msil_ieexecremote_b03f5f7f11d50a3a_6.0.6002.18005_none_ef4a58c7c5889e64 d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6000.16386_none_3fd3e2bdc5a2408e d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6001.18000_none_420aa4b9c28d5162 d------ [11:21 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_6.0.6002.18005_none_43f61dc5bfaf1cae d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.0.6000.16386_en-us_5fe4036ea556b4f7 d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6000.16386_none_d9008ac592026334 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6001.18000_none_db374cc18eed7408 d------ [11:20 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-credui_31bf3856ad364e35_6.0.6002.18005_none_dd22c5cd8c0f3f54 d------ [11:46 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-credwiz.resources_31bf3856ad364e35_6.0.6000.16386_en-us_0dcdf312c69f3fe9 d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-credwiz_31bf3856ad364e35_6.0.6000.16386_none_9da3eeaf6eea0db4 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-eventcreate.resources_31bf3856ad364e35_6.0.6000.16386_en-us_163f93beca50608f d------ [12:41 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.0.6000.16386_none_d32c0ea842a8cb28 d------ [11:18 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16386_none_6997bcdc5b8aeeb5 d------ [12:36 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16510_none_69dd6e605b578d62 d------ [04:10 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.16552_none_69b42f445b762fd4 d------ [04:24 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20625_none_6a613cb17478c7d0 d------ [04:10 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6000.20671_none_6a272bed74a4ee29 d------ [04:24 04/01/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6001.18000_none_6bce7ed85875ff89 d------ [11:23 24/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.0.6002.18005_none_6db9f7e45597cad5 d------ [11:47 18/09/2009]

C:\Windows\winsxs\x86_microsoft-windows-security-credssp_31bf3856ad364e35_6.0.6000.16386_none_c1816f73a4a4f3fd d------ [11:19 02/11/2006]

C:\Windows\winsxs\x86_microsoft-windows-security-credssp_31bf3856ad364e35_6.0.6001.18000_none_c3b8316fa19004d1 d------ [01:03 20/09/2008]

C:\Windows\winsxs\x86_microsoft-windows-sonic-createdisc_31bf3856ad364e35_6.0.6000.16386_none_3dbfc4bbf1adf534 d------ [12:35 02/11/2006]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.16386_none_e106c2e628087e97 d------ [11:19 02/11/2006]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e101494a280d4e0b d------ [14:34 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6000.20883_none_ca395fee41af92fe d------ [14:34 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e0dc2e00285f5aac d------ [14:33 15/02/2009]

C:\Windows\winsxs\x86_netfx-aspnet_webadmin_locres_res_b03f5f7f11d50a3a_6.0.6001.22230_none_ca109e9c4204d3bf d------ [14:33 15/02/2009]

-= EOF =-

Link to post
Share on other sites

Wow. That appears to have fixed it. It had the side effect of deleting my other Chrome profiles for some reason, but they were pretty easy to set up again. And when I did so, the uTorrent thing was not coming up like before! Thanks!'

--

Marc.

Link to post
Share on other sites

  • Staff

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.