Jump to content


Photo
- - - - -

Torpig botnet infection


  • This topic is locked This topic is locked
37 replies to this topic

#1 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 08 September 2013 - 09:47 PM

My IP address has been blocked from sending emails by spamhaus, which claims that my computer is infected with torpig.

 

I have no idea whether the spamhaus diagnosis is accurate.

 

I am a complete novice at detecting malware and removing it from my system. My anti-virus does not detect any issues, nor does the Microsoft Malicious Software Removal Tool.
 

I should be grateful for any informed advice and suggestions.

 

 



#2 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 09 September 2013 - 12:22 AM

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 

 

 

Scan with DDS

Download DDS and save it to your desktop from here or here or
here.

Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs

DDS.txt: save to your desktop then post its contents in your topic
Attach.txt: save to your desktop then attach it to your next reply

 

 

 

Scan with aswMBR

Please download aswMBR ( 4.5MB ) to your desktop.

  • Double click the aswMBR.exe icon, and click Run.
  • There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
  • When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
  • Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
  • Click the Scan button to start the scan once the update has finished downloading
  • On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.

Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#3 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 03:05 AM

Dear Marius, Thank you indeed for such a quick and constructive reply. Before I start on your instructions, I suspect (from my very minimal knowledge) that I should let you know that I ran a Quick Scan with the Malwarebytes Antimalware tool (the generic advice on this site recommends that one do so as a first step). I am so dim with these things that I cannot interpret the log. I assume it is not safe merely to delete all of the results, as false positives can also be produced by scanning process. I copy the log below. If none of the results indicates a torpig infection, is this conclusive evidence that I am in fact not infected? Many thanks again for your assistance. I will of course proceed with your instructions pending your advice regarding the scan I have performed. - - - - - Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.09.08.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19453 C D Larcombe :: CDLARCOMBE-PC [administrator] 9/09/2013 2:22:58 PM MBAM-log-2013-09-09 (17-52-07).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 694373 Time elapsed: 3 hour(s), 14 minute(s), 43 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 7 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> No action taken. HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> No action taken. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken. HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken. HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> No action taken. HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken. Registry Values Detected: 3 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0G1G1H2Z1L1U1TtF0Z1E -> No action taken. HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {9FA7CDE0-EB4B-11E0-9A8A-00214F4B9636} -> No action taken. HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {9FA7CDE0-EB4B-11E0-9A8A-00214F4B9636} -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 1 C:\Users\C D Larcombe\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> No action taken. Files Detected: 11 C:\Users\C D Larcombe\AppData\Local\Temp\6rMU6I1u.exe.part (PUP.Optional.Installex) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Temp\_C11dQiO.exe.part (PUP.Optional.Installex) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Temp\xR01kB2D.exe.part (PUP.Optional.Installex) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Temp\r5PMMSSU.exe.part (PUP.Optional.Installex) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Temp\{D47AD21F-BF0B-B0AB-5240-F7290F99F0E9}\sweetim.exe (PUP.Optional.SweetIM) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Temp\is1988980107\MyBabylonTB.exe (PUP.Optional.Babylon.A) -> No action taken. C:\Users\C D Larcombe\Downloads\winamp563_full_bundle_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> No action taken. C:\Users\C D Larcombe\Local Settings\Temporary Internet Files\Content.IE5\I6IP52P3\sweetim[1].exe (PUP.Optional.SweetIM) -> No action taken. C:\Users\C D Larcombe\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> No action taken. C:\Users\C D Larcombe\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> No action taken. C:\Users\C D Larcombe\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> No action taken. (end) - - - -

#4 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 03:08 AM

Incidentally, I performed the scan before receiving your response above, and the advice you give not to run scans unless instructed.

#5 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 03:15 AM

Apologies - I did not properly attach the Malwarebytes log. Please find log attached.

#6 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 03:19 AM

Apologies - I did not properly attach the Malwarebyte.s log. Please find log attached: Attached File  MBAM-log-2013-09-09 (17-52-07).txt   6.69KB   9 downloads



#7 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 07:12 AM

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.19453  BrowserJavaVersion: 1.6.0_26
Run by C D Larcombe at 22:03:07 on 2013-09-09
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.61.1033.18.3070.1106 [GMT 10:00]
.
AV: Kaspersky PURE 3.0 *Enabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Kaspersky PURE 3.0 *Enabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky PURE 3.0 *Enabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvservice.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\RtkAudioService.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Sony\Network Utility\NSUService.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDms.exe
C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDs.exe
C:\Program Files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
C:\Program Files\Common Files\Sony Shared\SOHLib\SOHCImp.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe
C:\Program Files\Sony\Network Utility\LANUtil.exe
C:\Windows\ehome\ehtray.exe
C:\Users\C D Larcombe\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Sony\VAIO Update\VUAgent.exe
C:\Windows\system32\conime.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k SDRSVC
.
============== Pseudo HJT Report ===============
.




BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Kaspersky Passsword Manager Toolbar: {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - c:\program files\kaspersky lab\kaspersky pure 3.0\kaspersky password manager\spIEBho.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\contentblocker\ie_content_blocker_plugin.dll
BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -
BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\virtualkeyboard\ie_virtual_keyboard_plugin.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\onlinebanking\online_banking_bho.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\urladvisor\klwtbbho.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
TB: Kaspersky Passsword Manager Toolbar: {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - c:\program files\kaspersky lab\kaspersky pure 3.0\kaspersky password manager\spIEBho.dll
uRun: [NSUFloatingUI] "c:\program files\sony\network utility\LANUtil.exe"
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Spotify Web Helper] "c:\users\c d larcombe\appdata\roaming\spotify\data\SpotifyWebHelper.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [KSS] "c:\program files\kaspersky lab\kaspersky security scan 2.0\kss.exe" /autorun
mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [CDAServer] c:\program files\common files\common desktop agent\CDASrv.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky pure 3.0\avp.exe"
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:28
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky pure 3.0\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll
IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\virtualkeyboard\ie_virtual_keyboard_plugin.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky pure 3.0\ieext\urladvisor\klwtbbho.dll
IE: {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm



TCP: NameServer = 10.0.0.138
TCP: Interfaces\{2C0E2C70-A966-44F6-BF49-7BDCB8581403} : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{6965D9E8-23BD-4D58-8668-8902A576C458} : DHCPNameServer = 10.0.0.138
TCP: Interfaces\{75B90F3A-AD59-4F62-8CFE-895B4311856C} : DHCPNameServer = 10.0.0.138
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: VESWinlogon - VESWinlogon.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} -
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\c d larcombe\appdata\roaming\mozilla\firefox\profiles\5waw5psb.default\


FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\program files\tracker software\pdf viewer\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1202122.dll
FF - ExtSQL: 2013-08-02 22:27; kitsune@kitsune.sourceforge.net; c:\users\c d larcombe\appdata\roaming\mozilla\firefox\profiles\5waw5psb.default\extensions\kitsune@kitsune.sourceforge.net
FF - ExtSQL: 2013-09-09 13:03; anti_banner@kaspersky.com; c:\program files\kaspersky lab\kaspersky pure 3.0\ffext\anti_banner@kaspersky.com
FF - ExtSQL: 2013-09-09 13:03; content_blocker@kaspersky.com; c:\program files\kaspersky lab\kaspersky pure 3.0\ffext\content_blocker@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; online_banking@kaspersky.com; c:\program files\kaspersky lab\kaspersky pure 3.0\ffext\online_banking@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; url_advisor@kaspersky.com; c:\program files\kaspersky lab\kaspersky pure 3.0\ffext\url_advisor@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; virtual_keyboard@kaspersky.com; c:\program files\kaspersky lab\kaspersky pure 3.0\ffext\virtual_keyboard@kaspersky.com
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110808&tt=3412_4
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar.id - 5414ff5600000000000000234ddfeecf
FF - user.js: extensions.BabylonToolbar.instlDay - 15577
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.60:16:43
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.searchya.hmpg - true

FF - user.js: extensions.searchya.dfltSrch - true
FF - user.js: extensions.searchya.srchPrvdr - SearchYa!
FF - user.js: extensions.searchya.dnsErr - true
FF - user.js: extensions.searchya_i.newTab - false


FF - user.js: extensions.searchya.id - 00234DDFEECFFF56
FF - user.js: extensions.searchya.instlDay - 15763
FF - user.js: extensions.searchya.vrsn - 1.8.8.0
FF - user.js: extensions.searchya.vrsni - 1.8.8.0
FF - user.js: extensions.searchya_i.vrsnTs - 1.8.8.02:18:14
FF - user.js: extensions.searchya.prtnrId - searchya
FF - user.js: extensions.searchya.prdct - searchya
FF - user.js: extensions.searchya.aflt - dnldyho
FF - user.js: extensions.searchya_i.smplGrp - none
FF - user.js: extensions.searchya.tlbrId - base
FF - user.js: extensions.searchya.instlRef -
FF - user.js: extensions.searchya.dfltLng -
FF - user.js: extensions.searchya.appId - {1973277F-87B0-4EA3-9ED2-470A91D284CF}
FF - user.js: extensions.searchya.excTlbr - false
FF - user.js: extensions.searchya_i.hmpg - true
FF - user.js: extensions.irspeeddial.aflt - dnldyho
FF - user.js: extensions.irspeeddial.instlRef -
FF - user.js: extensions.irspeeddial.cr - 1170014487
FF - user.js: extensions.irspeeddial.cd - 2XzuyEtN2Y1L1QzutDtDtBtAyE0D0D0F0E0E0C0F0F0FyDyCtN0D0Tzu0CyEtBtAtN1L2XzutBtFtBtFtCtFyDtDtAtN1L1Czu1Q1G1I1Q2U1M1F
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [2013-5-22 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [2013-5-22 175176]
R0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\drivers\CSCrySec.sys [2013-9-9 88632]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-6-5 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-6-13 369584]
R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\drivers\CSVirtualDiskDrv.sys [2013-9-9 39736]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2012-8-2 24408]
R1 kltdi;kltdi;c:\windows\system32\drivers\kltdi.sys [2012-10-18 44000]
R1 kneps;kneps;c:\windows\system32\drivers\kneps.sys [2012-8-13 145040]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\common files\abbyy\finereader\9.00\licensing\pe\NetworkLicenseServer.exe [2008-10-27 759072]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\adobe\photoshop elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-17 169312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-6-13 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-6-13 66336]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-2 46808]
R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky pure 3.0\avp.exe [2012-12-20 356968]
R2 CSObjectsSrv;CryptoStorage control service;c:\program files\common files\infowatch\cryptostorage\ProtectedObjectsSrv.exe [2012-12-21 819040]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
R2 NSUService;NSUService;c:\program files\sony\network utility\NSUService.exe [2009-1-3 303104]
R2 nvservice;NVIDIA GuardService;c:\windows\system32\nvservice.exe [2013-3-17 160544]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2012-11-29 38608]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R2 RtkAudioService;Realtek Audio Service;c:\windows\RTKAUDIOSERVICE.EXE [2008-12-5 102400]
R2 Samsung Network Fax Server;Samsung Network Fax Server;c:\windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [2013-5-27 181760]
R2 SOHCImp;VAIO Media plus Content Importer;c:\program files\common files\sony shared\sohlib\SOHCImp.exe [2013-7-17 122008]
R2 SOHDBSvr;VAIO Media plus Database Manager;c:\program files\common files\sony shared\sohlib\SOHDBSvr.exe [2013-7-17 72856]
R2 SOHDms;VAIO Media plus Digital Media Server;c:\program files\common files\sony shared\sohlib\SOHDms.exe [2013-7-17 392344]
R2 SOHDs;VAIO Media plus Device Searcher;c:\program files\common files\sony shared\sohlib\SOHDs.exe [2013-7-17 76952]
R2 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files\common files\sony shared\sohlib\SOHPlMgr.exe [2013-7-17 93336]
R2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.SYS [2012-2-15 5120]
R2 uCamMonitor;CamMonitor;c:\program files\arcsoft\magic-i visual effects 2\uCamMonitor.exe [2009-1-3 104960]
R2 VAIO Power Management;VAIO Power Management;c:\program files\sony\vaio power management\SPMService.exe [2009-5-30 415584]
R2 VCFw;VAIO Content Folder Watcher;c:\program files\common files\sony shared\vaio content folder watcher\VCFw.exe [2009-3-5 5189992]
R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2011-4-20 480624]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [2009-1-3 17920]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y6032.sys [2008-12-4 225408]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\drivers\klkbdflt.sys [2012-9-3 25944]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2012-9-3 25944]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-9-9 40776]
R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2008-12-4 9344]
R3 VUAgent;VUAgent;c:\program files\sony\vaio update\VUAgent.exe [2012-11-22 1013808]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 KSS;Kaspersky Security Scan Service;c:\program files\kaspersky lab\kaspersky security scan 2.0\kss.exe [2012-12-7 202328]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-12-5 29736]
S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v2.sys [2010-5-15 206336]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2010-11-18 83312]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\Winword.exe="c:\program files\microsoft office\office12\WINWORD.EXE" /n /dde [UserChoice] [default=edit - 'Open' doesn't exist]
ShellExec: VCExporterLaunch.exe: open="c:\program files\sony\vaio vp utilities\VCELaunch.exe" "%1"
.
=============== Created Last 30 ================
.
2013-09-09 11:25:14    40776    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2013-09-09 11:02:39    --------    d-----w-    c:\users\c d larcombe\appdata\local\{7BDDC5CD-DB09-47B7-9D7F-D64DE15DE7B8}
2013-09-09 04:21:54    22856    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-09-09 04:21:54    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2013-09-09 03:05:02    39736    ----a-w-    c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2013-09-09 03:04:46    88632    ----a-w-    c:\windows\system32\drivers\CSCrySec.sys
2013-09-09 03:03:55    --------    d-----w-    c:\program files\common files\InfoWatch
2013-09-09 02:55:13    74848    ----a-w-    c:\windows\system32\drivers\klflt.sys
2013-09-09 00:17:32    --------    d-----w-    c:\programdata\Kaspersky Lab
2013-09-09 00:17:32    --------    d-----w-    c:\program files\Kaspersky Lab
2013-09-08 23:35:37    --------    d-----w-    C:\TDSSKiller_Quarantine
2013-09-08 23:01:27    --------    d-----w-    c:\users\c d larcombe\appdata\local\{368CA0E9-F771-493F-89AA-6C36826855B4}
2013-09-08 00:54:17    --------    d-----w-    c:\users\c d larcombe\appdata\local\{0CBF12F5-6DE0-4AFF-832D-1B61BE8EC0C9}
2013-09-07 02:12:44    --------    d-----w-    c:\users\c d larcombe\appdata\local\{6C91A057-1D35-4E30-BAAE-D18230676053}
2013-09-06 15:56:02    7166848    ----a-w-    c:\programdata\microsoft\windows defender\definition updates\{869e30a0-fa0b-4163-a8fd-b9ee06642009}\mpengine.dll
2013-09-06 14:08:26    --------    d-----w-    c:\users\c d larcombe\appdata\local\{B4D82C52-E254-4EB5-A986-11D44817957D}
2013-09-06 01:41:29    --------    d-----w-    c:\users\c d larcombe\appdata\local\{30B144A6-6449-413C-86A9-DC375EC5BDE3}
2013-09-05 14:33:05    --------    d-----w-    c:\users\c d larcombe\appdata\local\{49F6364F-37AB-42F4-AA95-C93260014633}
2013-09-05 02:19:10    --------    d-----w-    c:\users\c d larcombe\appdata\local\{2606083F-F601-4B60-8C21-596BA8658AB8}
2013-09-03 23:43:57    --------    d-----w-    c:\users\c d larcombe\appdata\local\{E515E1C9-BF8B-404D-B466-358970FA89A5}
2013-09-03 02:39:32    --------    d-----w-    c:\users\c d larcombe\appdata\local\{2B6D5380-C84E-4720-AEFE-B7D9BF2EE929}
2013-09-02 02:23:46    --------    d-----w-    c:\users\c d larcombe\appdata\local\{CAEFE10E-CE1D-4D1C-83E0-CD2F807C2901}
2013-09-01 14:05:34    --------    d-----w-    c:\users\c d larcombe\appdata\local\{6A75BDD7-4FCC-4830-B35D-70B027C08A77}
2013-09-01 01:50:35    --------    d-----w-    c:\users\c d larcombe\appdata\local\{5491E519-0883-4458-9B0B-246EB39CB9B3}
2013-08-31 13:40:05    --------    d-----w-    c:\users\c d larcombe\appdata\local\{A6868B4B-2853-489C-9761-BC0F9D6D52FD}
2013-08-31 00:48:13    --------    d-----w-    c:\users\c d larcombe\appdata\local\{6CC057F7-41EC-413D-84C2-2122F9F7B0F1}
2013-08-31 00:40:47    --------    d-----w-    c:\users\c d larcombe\appdata\local\{559BB7BB-CA8D-4598-9B40-2BE6D210603C}
2013-08-30 09:38:02    --------    d-----w-    c:\users\c d larcombe\appdata\local\{DEBAF5D8-C6CA-4C40-8823-96C57580390B}
2013-08-29 15:08:18    --------    d-----w-    c:\users\c d larcombe\appdata\local\{7FE79887-68FB-46AF-830B-04A6E1152C48}
2013-08-29 02:29:51    --------    d-----w-    c:\users\c d larcombe\appdata\local\{FBB0D241-0D5E-43A0-9A54-7CAD36846AC1}
2013-08-28 10:25:12    1548288    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2013-08-28 10:22:08    --------    d-----w-    c:\users\c d larcombe\appdata\local\{D6FA43A0-19AA-415A-BF68-6D022203C629}
2013-08-27 20:24:56    --------    d-----w-    c:\users\c d larcombe\appdata\local\{13FD319E-31EF-4FF5-8D83-FBE0549568BA}
2013-08-27 03:36:15    --------    d-----w-    c:\users\c d larcombe\appdata\local\{DD9862F9-671E-4D98-8CBC-CDC51DDBAAA9}
2013-08-26 15:15:30    --------    d-----w-    c:\users\c d larcombe\appdata\local\{DABC5FEB-A2A7-44A4-B6BD-474792E3F160}
2013-08-26 15:05:02    --------    d-----w-    c:\users\c d larcombe\appdata\local\{2E76A85A-896C-4448-AC7A-5F4E18DAC0CF}
2013-08-26 03:02:28    --------    d-----w-    c:\users\c d larcombe\appdata\local\{8FCEA357-CDC0-4121-955C-4B22C3BDF56B}
2013-08-25 15:02:04    --------    d-----w-    c:\users\c d larcombe\appdata\local\{205BDF1A-DCB2-4D50-B9DD-B7A24EF18A4C}
2013-08-25 03:01:40    --------    d-----w-    c:\users\c d larcombe\appdata\local\{6475999F-CF09-4D36-8635-C34B490561D4}
2013-08-24 04:51:20    --------    d-----w-    c:\users\c d larcombe\appdata\local\{E671AC10-6F90-4743-8DFF-D9D0E8B558E5}
2013-08-24 03:52:55    --------    d-----w-    c:\users\c d larcombe\appdata\local\{D77746CA-60CB-4E43-BFEB-1E174B41CF54}
2013-08-23 15:20:40    --------    d-----w-    c:\users\c d larcombe\appdata\local\{1AFCAC29-6241-4967-8877-97564C269A37}
2013-08-23 03:20:17    --------    d-----w-    c:\users\c d larcombe\appdata\local\{B1826BFD-2039-4BE1-B6B5-7CB142AA5420}
2013-08-22 14:31:44    --------    d-----w-    c:\users\c d larcombe\appdata\local\{087AC138-70C2-4629-86E0-7923B0C9EF32}
2013-08-22 02:22:17    --------    d-----w-    c:\users\c d larcombe\appdata\local\{F5DDC6C4-DA44-4DA1-BD5C-36F509EF95BD}
2013-08-21 03:24:20    --------    d-----w-    c:\users\c d larcombe\appdata\local\{108453CD-CCA0-4760-A7DC-8014DABA33A6}
2013-08-20 15:00:50    --------    d-----w-    c:\users\c d larcombe\appdata\local\{5CC438BF-ADEA-42AE-A5F2-895FCFE3C356}
2013-08-20 14:47:46    --------    d-----w-    c:\users\c d larcombe\appdata\local\{D9D574BB-D64F-4196-81BC-C1930848CBEE}
2013-08-20 14:36:25    --------    d-----w-    c:\users\c d larcombe\appdata\local\{24E1EE6C-736E-427B-92DD-4AFB5FEB2C91}
2013-08-20 14:33:01    --------    d-----w-    c:\users\c d larcombe\appdata\local\{9879017B-4EA2-4165-947B-23EAD8D21C6E}
2013-08-20 14:20:59    --------    d-----w-    c:\users\c d larcombe\appdata\local\{1885B3C8-F788-4981-AF52-F933679A9CA7}
2013-08-20 13:54:25    --------    d-----w-    c:\users\c d larcombe\appdata\local\{171B10CA-3A03-411D-9C11-0A129320B50A}
2013-08-20 13:43:07    --------    d-----w-    c:\users\c d larcombe\appdata\local\{DF248175-12DB-434E-917C-103F859C0A0B}
2013-08-20 13:15:55    --------    d-----w-    c:\users\c d larcombe\appdata\local\{91AEA189-CF7D-4E8F-B4AD-2454651CFE5A}
2013-08-20 13:11:05    --------    d-----w-    c:\users\c d larcombe\appdata\local\{F55DE9E7-68D5-4053-914D-FC42BF7A7251}
2013-08-20 13:08:54    --------    d-----w-    c:\users\c d larcombe\appdata\local\{55D51E36-69F6-49AC-A1C7-3C15C5FEA176}
2013-08-20 01:06:42    --------    d-----w-    c:\users\c d larcombe\appdata\local\{991BD0A7-8DAB-4474-A27B-2BBDE65B9DDC}
2013-08-19 08:28:34    --------    d-----w-    c:\users\c d larcombe\appdata\local\{02B04C32-8ACD-4CE8-8A39-6DC7CCE8DFBA}
2013-08-18 15:02:15    --------    d-----w-    c:\users\c d larcombe\appdata\local\{9128EEBA-22D5-406A-9B38-A3B5A5CC75F1}
2013-08-18 02:57:22    --------    d-----w-    c:\users\c d larcombe\appdata\local\{19C20AD2-B087-4218-BF5E-B7D543F63C7B}
2013-08-17 13:08:55    --------    d-----w-    c:\users\c d larcombe\appdata\local\{EAEF891E-07DE-4D2C-8DE4-6D7A434D81CD}
2013-08-17 00:50:35    --------    d-----w-    c:\users\c d larcombe\appdata\local\{AFB84056-66DF-49CA-84D9-A97C040D7F50}
2013-08-16 08:26:30    --------    d-----w-    c:\users\c d larcombe\appdata\local\{1C76A654-A812-42FC-A910-B748296A3791}
2013-08-15 15:21:46    --------    d-----w-    c:\users\c d larcombe\appdata\local\{09F2E3D2-666D-4E14-AA6D-3AB8A0D217B1}
2013-08-15 02:37:28    --------    d-----w-    c:\users\c d larcombe\appdata\local\{2EF64EF7-4F56-45C6-85E4-B1B9AF5D5DA1}
2013-08-14 15:58:13    --------    d-----w-    c:\windows\system32\MRT
2013-08-14 13:17:00    --------    d-----w-    c:\users\c d larcombe\appdata\local\{4C35DC6C-DB8A-47A0-A4A5-2BEA38FAD20C}
2013-08-14 10:52:19    24064    ----a-w-    c:\windows\system32\drivers\tssecsrv.sys
2013-08-14 10:52:17    15872    ----a-w-    c:\windows\system32\icaapi.dll
2013-08-14 10:52:13    905664    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2013-08-14 01:16:22    --------    d-----w-    c:\users\c d larcombe\appdata\local\{0C624780-46F5-4BE8-BDA1-EE3A09B1E497}
2013-08-13 10:07:04    --------    d-----w-    c:\users\c d larcombe\appdata\local\{6B2C07C1-A9D3-4725-BAAA-00A978C407EA}
2013-08-12 16:29:33    --------    d-----w-    c:\users\c d larcombe\appdata\local\{9D99F667-F55A-4E50-A57F-9A29C3C92EAC}
2013-08-12 15:50:05    --------    d-----w-    c:\users\c d larcombe\appdata\local\{E8C180B0-66F7-4C49-BA96-CBB94F85F00C}
2013-08-12 15:41:40    --------    d-----w-    c:\users\c d larcombe\appdata\local\{4A5A692C-8A27-4A75-829A-3205D790CD7C}
2013-08-12 02:56:11    --------    d-----w-    c:\users\c d larcombe\appdata\local\{B0ADD78B-2C26-4564-B7A2-5A10CC1BE07E}
2013-08-11 05:52:26    --------    d-----w-    c:\users\c d larcombe\appdata\local\{A84F6C96-22B2-475D-A2EC-1A47CD60DAA5}
2013-08-10 16:10:17    --------    d-----w-    c:\users\c d larcombe\appdata\local\{1D8854FF-F0D9-40EE-924D-053A226A74BB}
2013-08-10 13:47:01    --------    d-----w-    c:\users\c d larcombe\appdata\local\{359A4FDC-96E7-48ED-BDD9-37467DB0F4A5}
.
==================== Find3M  ====================
.
2013-09-09 03:31:39    145040    ----a-w-    c:\windows\system32\drivers\kneps.sys
2013-09-09 03:31:38    44000    ----a-w-    c:\windows\system32\drivers\kltdi.sys
2013-07-24 00:33:07    916480    ----a-w-    c:\windows\system32\wininet.dll
2013-07-24 00:32:57    43520    ----a-w-    c:\windows\system32\licmgr10.dll
2013-07-24 00:32:56    1469440    ----a-w-    c:\windows\system32\inetcpl.cpl
2013-07-24 00:32:56    109056    ----a-w-    c:\windows\system32\iesysprep.dll
2013-07-24 00:32:55    71680    ----a-w-    c:\windows\system32\iesetup.dll
2013-07-23 23:56:25    385024    ----a-w-    c:\windows\system32\html.iec
2013-07-23 23:49:27    133632    ----a-w-    c:\windows\system32\ieUnatt.exe
2013-07-23 23:49:13    1638912    ----a-w-    c:\windows\system32\mshtml.tlb
2013-07-17 19:41:34    2048    ----a-w-    c:\windows\system32\tzres.dll
2013-07-10 09:47:00    783360    ----a-w-    c:\windows\system32\rpcrt4.dll
2013-07-09 12:10:36    1205168    ----a-w-    c:\windows\system32\ntdll.dll
2013-07-08 04:55:51    3603904    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-07-08 04:55:51    3551680    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-07-08 04:20:04    172544    ----a-w-    c:\windows\system32\wintrust.dll
2013-07-08 04:16:55    98304    ----a-w-    c:\windows\system32\cryptnet.dll
2013-07-08 04:16:55    133120    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-07-08 04:16:54    992768    ----a-w-    c:\windows\system32\crypt32.dll
2013-06-28 00:15:43    770344    ----a-w-    c:\windows\system32\drivers\aswSnx.sys
2013-06-28 00:15:43    175176    ----a-w-    c:\windows\system32\drivers\aswVmm.sys
2007-12-07 11:13:46    4192768    ----a-r-    c:\program files\ABBYY FineReader 9.0 Professional Edition.msi
2007-12-06 14:15:52    390432    ----a-r-    c:\program files\Setup.exe
2003-04-21 04:09:50    245408    ----a-r-    c:\program files\unicows.dll
2002-03-11 01:06:30    1822520    ----a-r-    c:\program files\instmsiw.exe
.
============= FINISH: 22:06:38.54 ===============
 



#8 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 07:19 AM

Relevant file attached. Thank you.

Attached Files



#9 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 09 September 2013 - 08:37 AM

Don´t forget to create and post the aswMBR log


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#10 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 09 September 2013 - 08:59 AM

Thank you for that reminder. Here is the log:

 

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software

Run date: 2013-09-09 22:36:40

-----------------------------

22:36:40.065    OS Version: Windows 6.0.6002 Service Pack 2

22:36:40.065    Number of processors: 2 586 0x170A

22:36:40.066    ComputerName: CDLARCOMBE-PC  UserName: C D Larcombe

22:36:41.379    Initialize success

22:36:44.167    AVAST engine defs: 13090900

22:37:23.548    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

22:37:23.550    Disk 0 Vendor: ST3500820AS AD2X Size: 476940MB BusType: 3

22:37:23.552    Disk 1  \Device\Harddisk1\DR1 -> \Device\00000064

22:37:23.554    Disk 1 Vendor: RICOH 01 Size: 476940MB BusType: 0

22:37:23.557    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000065

22:37:23.559    Disk 2 Vendor: RICOH 02 Size: 476940MB BusType: 0

22:37:23.564    Disk 0 MBR read successfully

22:37:23.566    Disk 0 MBR scan

22:37:24.058    Disk 0 Windows VISTA default MBR code

22:37:24.070    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12429 MB offset 2048

22:37:24.772    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       464509 MB offset 25456640

22:37:24.821    Disk 0 scanning sectors +976771120

22:37:25.349    Disk 0 scanning C:\Windows\system32\drivers

22:37:44.801    Service scanning

22:37:54.345    Service kl1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5

22:37:54.471    Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5

22:37:54.502    Service klkbdflt C:\Windows\system32\DRIVERS\klkbdflt.sys **LOCKED** 5

22:37:54.555    Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5

22:37:54.605    Service kltdi C:\Windows\system32\DRIVERS\kltdi.sys **LOCKED** 5

22:37:54.643    Service kneps C:\Windows\system32\DRIVERS\kneps.sys **LOCKED** 5

22:38:11.096    Modules scanning

22:38:22.659    Disk 0 trace - called modules:

22:38:22.676    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x86cf71e8]<<

22:38:22.679    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f63a18]

22:38:22.683    3 CLASSPNP.SYS[8c3a78b3] -> nt!IofCallDriver -> [0x86020918]

22:38:22.686    5 acpi.sys[807b86bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8600e528]

22:38:22.690    \Driver\atapi[0x86393758] -> IRP_MJ_CREATE -> 0x86cf71e8

22:38:24.097    AVAST engine scan C:\Windows

22:38:27.893    AVAST engine scan C:\Windows\system32

22:42:22.997    AVAST engine scan C:\Windows\system32\drivers

22:42:47.458    AVAST engine scan C:\Users\C D Larcombe

22:48:47.596    Disk 0 MBR has been saved successfully to "C:\Users\C D Larcombe\Desktop\MBR.dat"

22:48:47.598    The log file has been saved successfully to "C:\Users\C D Larcombe\Desktop\aswMBR.txt"

 

 

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software

Run date: 2013-09-09 22:36:40

-----------------------------

22:36:40.065    OS Version: Windows 6.0.6002 Service Pack 2

22:36:40.065    Number of processors: 2 586 0x170A

22:36:40.066    ComputerName: CDLARCOMBE-PC  UserName: C D Larcombe

22:36:41.379    Initialize success

22:36:44.167    AVAST engine defs: 13090900

22:37:23.548    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

22:37:23.550    Disk 0 Vendor: ST3500820AS AD2X Size: 476940MB BusType: 3

22:37:23.552    Disk 1  \Device\Harddisk1\DR1 -> \Device\00000064

22:37:23.554    Disk 1 Vendor: RICOH 01 Size: 476940MB BusType: 0

22:37:23.557    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000065

22:37:23.559    Disk 2 Vendor: RICOH 02 Size: 476940MB BusType: 0

22:37:23.564    Disk 0 MBR read successfully

22:37:23.566    Disk 0 MBR scan

22:37:24.058    Disk 0 Windows VISTA default MBR code

22:37:24.070    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12429 MB offset 2048

22:37:24.772    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       464509 MB offset 25456640

22:37:24.821    Disk 0 scanning sectors +976771120

22:37:25.349    Disk 0 scanning C:\Windows\system32\drivers

22:37:44.801    Service scanning

22:37:54.345    Service kl1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5

22:37:54.471    Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5

22:37:54.502    Service klkbdflt C:\Windows\system32\DRIVERS\klkbdflt.sys **LOCKED** 5

22:37:54.555    Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5

22:37:54.605    Service kltdi C:\Windows\system32\DRIVERS\kltdi.sys **LOCKED** 5

22:37:54.643    Service kneps C:\Windows\system32\DRIVERS\kneps.sys **LOCKED** 5

22:38:11.096    Modules scanning

22:38:22.659    Disk 0 trace - called modules:

22:38:22.676    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x86cf71e8]<<

22:38:22.679    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f63a18]

22:38:22.683    3 CLASSPNP.SYS[8c3a78b3] -> nt!IofCallDriver -> [0x86020918]

22:38:22.686    5 acpi.sys[807b86bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8600e528]

22:38:22.690    \Driver\atapi[0x86393758] -> IRP_MJ_CREATE -> 0x86cf71e8

22:38:24.097    AVAST engine scan C:\Windows

22:38:27.893    AVAST engine scan C:\Windows\system32

22:42:22.997    AVAST engine scan C:\Windows\system32\drivers

22:42:47.458    AVAST engine scan C:\Users\C D Larcombe

22:48:47.596    Disk 0 MBR has been saved successfully to "C:\Users\C D Larcombe\Desktop\MBR.dat"

22:48:47.598    The log file has been saved successfully to "C:\Users\C D Larcombe\Desktop\aswMBR.txt"

23:04:19.846    Disk 0 MBR has been saved successfully to "C:\Users\C D Larcombe\Desktop\MBR.dat"

23:04:19.847    The log file has been saved successfully to "C:\Users\C D Larcombe\Desktop\aswMBR.txt"

 

 

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software

Run date: 2013-09-09 23:09:26

-----------------------------

23:09:26.503    OS Version: Windows 6.0.6002 Service Pack 2

23:09:26.503    Number of processors: 2 586 0x170A

23:09:26.504    ComputerName: CDLARCOMBE-PC  UserName: C D Larcombe

23:09:29.662    Initialize success

23:09:32.588    AVAST engine defs: 13090900

23:09:45.400    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

23:09:45.427    Disk 0 Vendor: ST3500820AS AD2X Size: 476940MB BusType: 3

23:09:45.430    Disk 1  \Device\Harddisk1\DR1 -> \Device\00000064

23:09:45.432    Disk 1 Vendor: RICOH 01 Size: 476940MB BusType: 0

23:09:45.435    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000065

23:09:45.437    Disk 2 Vendor: RICOH 02 Size: 476940MB BusType: 0

23:09:45.551    Disk 0 MBR read successfully

23:09:45.559    Disk 0 MBR scan

23:09:45.563    Disk 0 Windows VISTA default MBR code

23:09:45.602    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        12429 MB offset 2048

23:09:45.622    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS       464509 MB offset 25456640

23:09:45.689    Disk 0 scanning sectors +976771120

23:09:45.908    Disk 0 scanning C:\Windows\system32\drivers

23:10:17.111    Service scanning

23:10:26.530    Service kl1 C:\Windows\system32\DRIVERS\kl1.sys **LOCKED** 5

23:10:26.713    Service KLIM6 C:\Windows\system32\DRIVERS\klim6.sys **LOCKED** 5

23:10:26.753    Service klkbdflt C:\Windows\system32\DRIVERS\klkbdflt.sys **LOCKED** 5

23:10:26.806    Service klmouflt C:\Windows\system32\DRIVERS\klmouflt.sys **LOCKED** 5

23:10:26.863    Service kltdi C:\Windows\system32\DRIVERS\kltdi.sys **LOCKED** 5

23:10:26.894    Service kneps C:\Windows\system32\DRIVERS\kneps.sys **LOCKED** 5

23:10:40.682    Modules scanning

23:11:19.059    Disk 0 trace - called modules:

23:11:19.079    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x86cf71e8]<<

23:11:19.083    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f63a18]

23:11:19.086    3 CLASSPNP.SYS[8c3a78b3] -> nt!IofCallDriver -> [0x86020918]

23:11:19.090    5 acpi.sys[807b86bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8600e528]

23:11:19.093    \Driver\atapi[0x86393758] -> IRP_MJ_CREATE -> 0x86cf71e8

23:11:21.838    AVAST engine scan C:\Windows

23:12:01.970    AVAST engine scan C:\Windows\system32

23:18:08.651    AVAST engine scan C:\Windows\system32\drivers

23:18:51.121    AVAST engine scan C:\Users\C D Larcombe

23:21:29.919    Disk 0 MBR has been saved successfully to "C:\Users\C D Larcombe\Desktop\MBR.dat"

23:21:29.926    The log file has been saved successfully to "C:\Users\C D Larcombe\Desktop\aswMBR.txt"



#11 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 10 September 2013 - 12:34 AM

Ah, there we go!

 

 

Combofix

Combofix should only be run when adviced by a team member!

Link


Important - Save the file to your desktop!


  • Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
  • Run Combofix.exe


When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.

Note: When receiving an error message containing ""Illegal operation attempted on a registry key that has been marked for deletion" simply restart your computer to fix this.


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#12 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 10 September 2013 - 09:15 PM

Please find leg below:

 

ComboFix 13-09-10.01 - C D Larcombe 11/09/2013   2:41.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.61.1033.18.3070.1792 [GMT 10:00]
Running from: c:\users\C D Larcombe\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Kaspersky PURE 3.0 *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky PURE 3.0 *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: avast! Antivirus *Disabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Kaspersky PURE 3.0 *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Setup.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_RKHIT
-------\Service_RkHit
.
.
(((((((((((((((((((((((((   Files Created from 2013-08-11 to 2013-09-11  )))))))))))))))))))))))))))))))
.
.
2013-09-10 23:39 . 2013-09-10 23:39    60872    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{B477EE33-CC6A-4EF6-BE28-CF4E0C88FD41}\offreg.dll
2013-09-10 23:13 . 2013-08-06 07:28    7166848    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{B477EE33-CC6A-4EF6-BE28-CF4E0C88FD41}\mpengine.dll
2013-09-10 23:05 . 2013-09-10 23:13    --------    d-----w-    C:\19896072c2fd9024f1f2
2013-09-10 17:22 . 2013-09-11 02:00    --------    d-----w-    c:\users\C D Larcombe\AppData\Local\temp
2013-09-10 17:22 . 2013-09-10 17:22    --------    d-----w-    c:\users\Default\AppData\Local\temp
2013-09-09 04:21 . 2013-09-09 04:21    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2013-09-09 04:21 . 2013-04-04 04:50    22856    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-09-09 03:05 . 2011-06-02 04:39    39736    ----a-w-    c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2013-09-09 03:04 . 2011-06-02 04:39    88632    ----a-w-    c:\windows\system32\drivers\CSCrySec.sys
2013-09-09 03:03 . 2013-09-09 03:03    --------    d-----w-    c:\program files\Common Files\InfoWatch
2013-09-09 02:55 . 2013-09-09 03:31    74848    ----a-w-    c:\windows\system32\drivers\klflt.sys
2013-09-09 00:17 . 2013-09-11 02:00    --------    d-----w-    c:\programdata\Kaspersky Lab
2013-09-09 00:17 . 2013-09-09 03:03    --------    d-----w-    c:\program files\Kaspersky Lab
2013-09-08 23:35 . 2013-09-08 23:50    --------    d-----w-    C:\TDSSKiller_Quarantine
2013-08-28 10:25 . 2013-08-02 04:09    1548288    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2013-08-14 15:58 . 2013-08-14 16:00    --------    d-----w-    c:\windows\system32\MRT
2013-08-14 10:52 . 2013-06-15 11:23    24064    ----a-w-    c:\windows\system32\drivers\tssecsrv.sys
2013-08-14 10:52 . 2013-06-15 13:22    15872    ----a-w-    c:\windows\system32\icaapi.dll
2013-08-14 10:52 . 2013-07-05 04:53    905664    ----a-w-    c:\windows\system32\drivers\tcpip.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-09 03:31 . 2012-08-13 06:49    145040    ----a-w-    c:\windows\system32\drivers\kneps.sys
2013-09-09 03:31 . 2012-10-18 04:50    44000    ----a-w-    c:\windows\system32\drivers\kltdi.sys
2013-06-28 00:15 . 2013-05-22 11:49    175176    ----a-w-    c:\windows\system32\drivers\aswVmm.sys
2013-06-28 00:15 . 2011-06-05 08:39    770344    ----a-w-    c:\windows\system32\drivers\aswSnx.sys
2013-06-28 00:15 . 2009-06-12 14:48    369584    ----a-w-    c:\windows\system32\drivers\aswSP.sys
2007-12-07 11:13 . 2007-12-07 11:13    4192768    ----a-r-    c:\program files\ABBYY FineReader 9.0 Professional Edition.msi
2003-04-21 04:09 . 2003-04-21 04:09    245408    ----a-r-    c:\program files\unicows.dll
2002-03-11 01:06 . 2002-03-11 01:06    1822520    ----a-r-    c:\program files\instmsiw.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58    121968    ----a-w-    c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2012-12-20 08:20    459784    ----a-w-    c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\shellex.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-12-05 270336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Spotify Web Helper"="c:\users\C D Larcombe\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-22 1104384]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"KSS"="c:\program files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2012-12-07 202328]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6281760]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-30 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-30 92704]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-02-20 344064]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe" [2012-12-20 356968]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Audio Filter.lnk - c:\program files\Sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe [2009-1-3 4243232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 02:32    98304    ----a-w-    c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2013-05-08 21:20    41056    ----a-w-    c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
S2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2008-10-27 759072]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    REG_MULTI_SZ       BthServ
LocalServiceAndNoImpersonation    REG_MULTI_SZ       FontCache
HPZ12    REG_MULTI_SZ       Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-01 13:05]
.
2013-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-01 13:05]
.
.
------- Supplementary Scan -------
.


uInternet Settings,ProxyOverride = *.local
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\


FF - ExtSQL: 2013-08-02 22:27; kitsune@kitsune.sourceforge.net; c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\extensions\kitsune@kitsune.sourceforge.net
FF - ExtSQL: 2013-09-09 13:03; anti_banner@kaspersky.com; c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com
FF - ExtSQL: 2013-09-09 13:03; content_blocker@kaspersky.com; c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; online_banking@kaspersky.com; c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; url_advisor@kaspersky.com; c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com
FF - ExtSQL: 2013-09-09 13:04; virtual_keyboard@kaspersky.com; c:\program files\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com
FF - ExtSQL: 2013-09-11 01:22; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110808&tt=3412_4
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar.id - 5414ff5600000000000000234ddfeecf
FF - user.js: extensions.BabylonToolbar.instlDay - 15577
FF - user.js: extensions.BabylonToolbar.vrsn - 1.6.4.6
FF - user.js: extensions.BabylonToolbar.vrsni - 1.6.4.6
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.6.4.60:16
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.searchya.hmpg - true

FF - user.js: extensions.searchya.dfltSrch - true
FF - user.js: extensions.searchya.srchPrvdr - SearchYa!
FF - user.js: extensions.searchya.dnsErr - true
FF - user.js: extensions.searchya_i.newTab - false


FF - user.js: extensions.searchya.id - 00234DDFEECFFF56
FF - user.js: extensions.searchya.instlDay - 15763
FF - user.js: extensions.searchya.vrsn - 1.8.8.0
FF - user.js: extensions.searchya.vrsni - 1.8.8.0
FF - user.js: extensions.searchya_i.vrsnTs - 1.8.8.02:18
FF - user.js: extensions.searchya.prtnrId - searchya
FF - user.js: extensions.searchya.prdct - searchya
FF - user.js: extensions.searchya.aflt - dnldyho
FF - user.js: extensions.searchya_i.smplGrp - none
FF - user.js: extensions.searchya.tlbrId - base
FF - user.js: extensions.searchya.instlRef -
FF - user.js: extensions.searchya.dfltLng -
FF - user.js: extensions.searchya.appId - {1973277F-87B0-4EA3-9ED2-470A91D284CF}
FF - user.js: extensions.searchya.excTlbr - false
FF - user.js: extensions.searchya_i.hmpg - true
FF - user.js: extensions.irspeeddial.aflt - dnldyho
FF - user.js: extensions.irspeeddial.instlRef -
FF - user.js: extensions.irspeeddial.cr - 1170014487
FF - user.js: extensions.irspeeddial.cd - 2XzuyEtN2Y1L1QzutDtDtBtAyE0D0D0F0E0E0C0F0F0FyDyCtN0D0Tzu0CyEtBtAtN1L2XzutBtFtBtFtCtFyDtDtAtN1L1Czu1Q1G1I1Q2U1M1F
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
SafeBoot-10997470.sys
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-11 12:00
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ...
.
scanning hidden files ...  
.
.
c:\windows\TEMP\TMP0000001937940858D293BBFA 524288 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(8388)
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvservice.exe
c:\windows\system32\nvvsvc.exe
c:\windows\RtkAudioService.exe
c:\windows\system32\rundll32.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Sony\Network Utility\NSUService.exe
c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe
c:\windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe
c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
c:\windows\system32\DllHost.exe
c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Common Files\Sony Shared\SOHLib\SOHDms.exe
c:\program files\Common Files\Sony Shared\SOHLib\SOHDs.exe
c:\program files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe
c:\program files\Common Files\Sony Shared\SOHLib\SOHCImp.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Sony\VAIO Power Management\SPMService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\conime.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Sony\VAIO Update\VAIOUpdt.exe
c:\program files\Sony\VAIO Update\VUAgent.exe
.
**************************************************************************
.
Completion time: 2013-09-11  12:05:45 - machine was rebooted
ComboFix-quarantined-files.txt  2013-09-11 02:05
.
Pre-Run: 292,946,747,392 bytes free
Post-Run: 302,647,074,816 bytes free
.
- - End Of File - - DD231F34A57495BA60BE9E5A690D6304
5C616939100B85E558DA92B899A0FC36



#13 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 10 September 2013 - 11:59 PM

Multiple Antivirus Programs installed!

I do not recommend that you have more than one anti-virus product installed and running on your computer at a time.

The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti-virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please go to add/remove in the control panel and remove either avast! or Kaspersky PURE.


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#14 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 11 September 2013 - 06:15 AM

Marius, thanks for your advice. I only downloaded Kaspersky after I was notified of the infection, with the intent that I would run a scan to see if Kaspersky could identify what Avast (my original anti-virus) could not. I have disabled avast since then. I also disabled Kaspersky when running Combofix.

 

I have now removed Kaspersky.



#15 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 11 September 2013 - 06:29 AM

Combofix scripting

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Download the attached CFScript.txt and save it to the location where Combofix is.


CFScriptB-4.gif


Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Attached Files


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#16 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 11 September 2013 - 08:49 AM

Thank you: log below as instructed.

 

ComboFix 13-09-10.03 - C D Larcombe 11/09/2013  23:12:09.3.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.61.1033.18.3070.1607 [GMT 10:00]

Running from: c:\users\C D Larcombe\Desktop\ComboFix.exe

Command switches used :: c:\users\C D Larcombe\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\ntuser.dat

.

Infected copy of c:\windows\system32\Services.exe was found and disinfected

Restored copy from - c:\combofix\HarddiskVolumeShadowCopy9_!Windows!System32!services.exe

.

.

(((((((((((((((((((((((((   Files Created from 2013-08-11 to 2013-09-11  )))))))))))))))))))))))))))))))

.

.

2013-09-11 13:27 . 2013-09-11 13:33 --------    d-----w-    c:\users\C D Larcombe\AppData\Local\temp

2013-09-11 13:27 . 2013-09-11 13:27 --------    d-----w-      c:\users\Default\AppData\Local\temp

2013-09-09 04:21 . 2013-09-09 04:21 --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware

2013-09-09 04:21 . 2013-04-04 04:50 22856 ----a-w-    c:\windows\system32\drivers\mbam.sys

2013-09-09 00:17 . 2013-09-11 11:27 --------    d-----w-    c:\programdata\Kaspersky Lab

2013-09-09 00:17 . 2013-09-11 11:27 --------    d-----w-    c:\program files\Kaspersky Lab

2013-09-08 23:35 . 2013-09-08 23:50 --------    d-----w-    C:\TDSSKiller_Quarantine

2013-08-28 10:25 . 2013-08-02 04:09 1548288     ----a-w-    c:\windows\system32\WMVDECOD.DLL

2013-08-14 15:58 . 2013-08-14 16:00 --------    d-----w-    c:\windows\system32\MRT

2013-08-14 10:52 . 2013-06-15 11:23 24064 ----a-w-      c:\windows\system32\drivers\tssecsrv.sys

2013-08-14 10:52 . 2013-06-15 13:22 15872 ----a-w-    c:\windows\system32\icaapi.dll

2013-08-14 10:52 . 2013-07-05 04:53 905664      ----a-w-      c:\windows\system32\drivers\tcpip.sys

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-09-10 23:39 . 2013-09-10 23:39 60872 ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{B477EE33-CC6A-4EF6-BE28-CF4E0C88FD41}\offreg.dll

2013-08-30 07:48 . 2013-05-22 11:49 177864      ----a-w-      c:\windows\system32\drivers\aswVmm.sys

2013-08-30 07:48 . 2009-06-12 14:48 56080 ----a-w-    c:\windows\system32\drivers\aswTdi.sys

2013-08-30 07:48 . 2009-06-12 14:48 369584      ----a-w-      c:\windows\system32\drivers\aswSP.sys

2013-08-30 07:48 . 2013-05-22 11:49 49376 ----a-w-    c:\windows\system32\drivers\aswRvrt.sys

2013-08-30 07:48 . 2011-06-05 08:39 770344      ----a-w-      c:\windows\system32\drivers\aswSnx.sys

2013-08-30 07:48 . 2009-06-12 14:48 49760 ----a-w-    c:\windows\system32\drivers\aswRdr.sys

2013-08-30 07:48 . 2009-06-12 14:48 29816 ----a-w-      c:\windows\system32\drivers\aswFsBlk.sys

2013-08-30 07:48 . 2009-06-12 14:47 66336 ----a-w-      c:\windows\system32\drivers\aswMonFlt.sys

2013-08-30 07:47 . 2010-10-02 05:07 41664 ----a-w-    c:\windows\avastSS.scr

2013-08-30 07:47 . 2009-06-12 14:47 229648      ----a-w-    c:\windows\system32\aswBoot.exe

2013-08-06 07:28 . 2013-09-10 23:13 7166848     ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{B477EE33-CC6A-4EF6-BE28-CF4E0C88FD41}\mpengine.dll

2007-12-07 11:13 . 2007-12-07 11:13 4192768     ----a-r-    c:\program files\ABBYY FineReader 9.0 Professional Edition.msi

2003-04-21 04:09 . 2003-04-21 04:09 245408      ----a-r-    c:\program files\unicows.dll

2002-03-11 01:06 . 2002-03-11 01:06 1822520     ----a-r-    c:\program files\instmsiw.exe

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-08-30 07:47  121968      ----a-w-    c:\program files\Alwil Software\Avast5\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-12-05 270336]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Spotify Web Helper"="c:\users\C D Larcombe\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-22 1104384]

"KSS"="c:\program files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2012-12-07 202328]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6281760]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-30 13556256]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-30 92704]

"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-02-20 344064]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Audio Filter.lnk - c:\program files\Sony\SonicStage Mastering Studio\Audio Filter\SSMSFilter.exe [2009-1-3 4243232]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2008-11-06 02:32  98304 ----a-w-    c:\windows\System32\VESWinlogon.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2013-05-08 21:20  41056 ----a-w-    c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

.

S2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2008-10-27 759072]

S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs     REG_MULTI_SZ      BthServ

LocalServiceAndNoImpersonation      REG_MULTI_SZ      FontCache

HPZ12 REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

.

2013-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-01 13:05]

.

2013-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-01 13:05]

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 10.0.0.138

FF - ProfilePath - c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\

FF - ExtSQL: 2013-08-02 22:27; kitsune@kitsune.sourceforge.net; c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\extensions\kitsune@kitsune.sourceforge.net

FF - ExtSQL: 2013-09-11 01:22; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\C D Larcombe\AppData\Roaming\Mozilla\Firefox\Profiles\5waw5psb.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

.

.

**************************************************************************

scanning hidden processes ... 

.

scanning hidden autostart entries ...

.

scanning hidden files ... 

.

scan completed successfully

hidden files:

.

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvservice.exe

c:\windows\system32\nvvsvc.exe

c:\windows\RtkAudioService.exe

c:\windows\system32\rundll32.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\windows\System32\lpksetup.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Sony\Network Utility\NSUService.exe

c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe

c:\windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe

c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

c:\program files\Sony\VAIO Event Service\VESMgr.exe

c:\windows\system32\DllHost.exe

c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

c:\program files\Sony\VAIO Event Service\VESMgrSub.exe

c:\windows\system32\DllHost.exe

c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\System32\WUDFHost.exe

c:\program files\Common Files\Sony Shared\SOHLib\SOHDms.exe

c:\program files\Common Files\Sony Shared\SOHLib\SOHDs.exe

c:\program files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe

c:\program files\Common Files\Sony Shared\SOHLib\SOHCImp.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

c:\windows\system32\conime.exe

c:\program files\Sony\VAIO Update\VAIOUpdt.exe

c:\windows\System32\rundll32.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Sony\VAIO Power Management\SPMService.exe

c:\program files\Sony\VAIO Update\VUAgent.exe

.

**************************************************************************

.

Completion time: 2013-09-11  23:41:16 - machine was rebooted

ComboFix-quarantined-files.txt  2013-09-11 13:40

ComboFix2.txt  2013-09-11 02:05

.

Pre-Run: 303,333,326,848 bytes free

Post-Run: 303,126,499,328 bytes free

.

- - End Of File - - C8EE882890235830950E0C32B054B0FA

5C616939100B85E558DA92B899A0FC36



#17 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 11 September 2013 - 11:47 PM

Full System Scan with Malwarebytes Antimalware

  • If not existing, please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.


If the program is already installed:
  • Run Malwarebytes Antimalware
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform fullscan, place a checkmark on all hard drives, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Post that log back here.

 

 

 

 

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#18 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 12 September 2013 - 09:37 AM

Hi Marius,

 

I fear I may have caused some problems for the sequence of logs you need.

 

I ran the Malwarebytes scan, which ran for just over 2 hours. It highlighted about 15 infected files. I then proceeded to select each file and remove them.

 

At that point, the programme froze and remained frozen for about 30-40 minutes. I then used task manager to close the programme, with the intent I would run the scan again.

 

The problem is that, whie I can run the scan again, the infected filed detected in the first scan have been placed in quarantine; therefore, the subsequent scan does not detect them.

 

I fear this has consequences for the log which any subsequent scan will generate. I have searched for any log generated by the first scan, but cannot find it.

 

Apologies for this complication. May I ask what you advise me to do from here?



#19 Psychotic

Psychotic

    Trusted Advisor

  • Trusted Advisors
  • PipPipPipPipPipPip
  • 2,533 posts
  • Gender:Male
  • Location:Germany

Posted 12 September 2013 - 11:33 PM

No problem :)

 

 

You told us that you removed several items with Malwarebytes´ Antimalware. This tool creates a log on every run and we need to see them.


  • The logs can be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Zip any and all of these logs and attach the file to your next reply.

 

 

 

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.


My help is free, however, if you want to support my fight against malware, click here --> Posted Image <--(no worries, every little bit helps)

#20 CDL_1976

CDL_1976

    New Member

  • Members
  • Pip
  • 22 posts

Posted 13 September 2013 - 12:29 AM

Sorry Marius - there is no log recording the scan which detected all the infected files which were then marked for removal. In the process of removal the programme froze. The only logs that are saved at the locations you cite record (1) updating of the programme and (2) my subsequent scan.

 

1. Before running first scan which detected the infected files and marked them for removal:

- - - -

 

2013/09/12 21:01:47 +1000    CDLARCOMBE-PC    C D Larcombe    MESSAGE    Starting database refresh
2013/09/12 21:02:07 +1000    CDLARCOMBE-PC    C D Larcombe    MESSAGE    Database refreshed successfully

 

- - - -

 

2. Log from subsequent scan, performed after the programme froze in the process of removing the detected threats discovered as a result of first scan (2 hours or so):

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.12.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19458
C D Larcombe :: CDLARCOMBE-PC [administrator]

12/09/2013 11:31:08 PM
mbam-log-2013-09-12 (23-31-08).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 139006
Time elapsed: 54 minute(s), 9 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

- - - -

 

I CANNOT IDENTIFY ANY LOG OF THE FIRST AND CRUCIAL SCAN WHICH DETECTED THE THREATS. : (

 

I will await your instructions. Sorry!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users