also @ TechSpot: Windows 8 Release Preview leaked, Microsoft may raise OEM prices

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Inactive] [A] Cycbot.G & Fareit.gen!C

Discussion in 'Virus and Malware Removal' started by zkatkin, Jan 9, 2012.

Thread Status:
Not open for further replies.

  1. zkatkin Newcomer, in training

    Hi,

    I'm following the guide you provided for removing CYCBOT.G over at:

    http://www.techspot.com/vb/topic173769.html

    My computer wasn't quite as infected as the other guy's, but I do need some help.

    Was wondering if once I've completed the steps if I could post my info logs for your review/help. Thanks in advance.
    zkatkin, Jan 9, 2012
    #1

  2. Broni Malware Annihilator

    Welcome aboard [IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==============================================================

    Never follow steps from another topic.
    Every computer is unique.
    Broni, Jan 9, 2012
    #2

  3. zkatkin Newcomer, in training

    Combofix Log

    ComboFix 12-01-09.03 - Owner 01/09/2012 11:55:16.1.8 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12213.10262 [GMT -5:00]
    Running from: c:\users\Owner\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Owner\AppData\Local\assembly\tmp
    c:\windows\system32\drivers\etc\hosts.ics
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-09 15:16 . 2012-01-09 15:16 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
    2012-01-09 15:16 . 2012-01-09 15:16 -------- d-----w- c:\programdata\Malwarebytes
    2012-01-09 15:16 . 2012-01-09 15:16 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-01-09 15:16 . 2011-12-10 20:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-01-09 06:55 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC17768A-8746-406F-9639-951CC9BAFD0C}\mpengine.dll
    2012-01-09 02:52 . 2012-01-09 02:52 -------- d-----w- c:\windows\en
    2012-01-09 02:49 . 2012-01-09 02:50 -------- d-----w- c:\program files (x86)\Windows Live
    2012-01-09 02:48 . 2009-09-04 22:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll
    2012-01-09 02:48 . 2009-09-04 22:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll
    2012-01-09 02:48 . 2009-09-04 22:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
    2012-01-09 02:48 . 2009-09-04 22:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll
    2012-01-09 02:47 . 2012-01-09 02:47 -------- d-----w- c:\users\Owner\AppData\Local\Windows Live
    2012-01-09 02:47 . 2012-01-09 02:47 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
    2012-01-09 02:29 . 2012-01-09 02:30 -------- d-----w- c:\users\Owner\AppData\Roaming\WebCam Recorder
    2012-01-09 02:29 . 2012-01-09 02:29 -------- d-----w- c:\program files (x86)\Xvid
    2012-01-09 02:29 . 2009-06-07 21:25 77824 ----a-w- c:\windows\SysWow64\xvid.ax
    2012-01-09 02:29 . 2009-06-07 21:24 180224 ----a-w- c:\windows\SysWow64\xvidvfw.dll
    2012-01-09 02:29 . 2009-06-07 21:16 819200 ----a-w- c:\windows\SysWow64\xvidcore.dll
    2012-01-09 02:29 . 2012-01-09 02:29 -------- d-----w- c:\program files (x86)\Solent
    2012-01-09 02:25 . 2012-01-09 06:59 -------- d-----w- c:\users\Owner\AppData\Roaming\5CDDD
    2012-01-09 02:24 . 2012-01-09 06:59 -------- d-----w- c:\users\Owner\AppData\Roaming\8035C
    2012-01-09 02:24 . 2012-01-09 02:28 -------- d-----w- C:\CamersoftOutput
    2012-01-09 02:24 . 2012-01-09 02:24 -------- d-----w- c:\program files (x86)\Camersoft
    2012-01-09 02:21 . 2004-03-09 04:00 132880 ----a-w- c:\windows\SysWow64\MSINET.OCX
    2012-01-09 02:21 . 2012-01-09 02:21 -------- d-----w- c:\program files (x86)\Webcam Video Capture 7.0
    2012-01-09 02:20 . 2004-03-09 05:00 152848 ----a-w- c:\windows\SysWow64\COMDLG32.OCX
    2012-01-09 02:20 . 2012-01-09 02:24 -------- d-----w- c:\program files (x86)\Webcam Video Capture
    2011-12-29 18:42 . 2011-12-29 18:42 -------- d-----w- c:\programdata\ATI
    2011-12-29 18:42 . 2011-12-29 18:42 -------- d-----w- c:\program files (x86)\AMD APP
    2011-12-29 18:42 . 2011-12-29 18:42 -------- d-----w- c:\program files\Common Files\ATI Technologies
    2011-12-29 18:42 . 2011-12-29 18:42 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
    2011-12-29 18:19 . 2011-12-29 18:19 -------- d-----w- C:\ATI
    2011-12-29 18:01 . 2011-12-29 18:01 -------- d-----w- C:\AMD
    2011-12-16 03:15 . 2010-05-26 16:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
    2011-12-16 03:15 . 2010-05-26 16:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
    2011-12-15 05:51 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
    2011-12-15 05:51 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
    2011-12-15 05:51 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
    2011-12-15 05:51 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
    2011-12-15 05:51 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-12-15 05:51 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2011-12-13 18:14 . 2010-04-03 18:51 47456 ----a-w- c:\windows\SysWow64\perf-MSSQL10_50.ADCENTERDESKTOP-sqlagtctr.dll
    2011-12-13 18:14 . 2010-04-03 17:57 77152 ----a-w- c:\windows\system32\perf-MSSQL10_50.ADCENTERDESKTOP-sqlagtctr.dll
    2011-12-13 18:14 . 2010-04-03 18:51 73568 ----a-w- c:\windows\SysWow64\perf-MSSQL$ADCENTERDESKTOP-sqlctr10.50.1600.1.dll
    2011-12-13 18:14 . 2010-04-03 17:57 79200 ----a-w- c:\windows\system32\perf-MSSQL$ADCENTERDESKTOP-sqlctr10.50.1600.1.dll
    2011-12-13 18:13 . 2011-12-13 18:13 -------- d-----w- c:\windows\system32\RsFx
    2011-12-13 18:13 . 2011-12-13 18:13 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
    2011-12-13 18:13 . 2011-12-13 18:13 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 9.0
    2011-12-13 18:12 . 2011-12-13 18:12 -------- d-----w- c:\program files\Microsoft.NET
    2011-12-13 18:11 . 2011-12-13 18:11 -------- d-----w- c:\windows\SysWow64\1033
    2011-12-13 18:11 . 2011-12-13 18:11 -------- d-----w- c:\windows\system32\1033
    2011-12-13 18:10 . 2011-12-13 18:12 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
    2011-12-13 18:09 . 2011-12-13 18:13 -------- d-----w- c:\program files\Microsoft SQL Server
    2011-12-13 04:42 . 2011-12-13 04:42 -------- d-----w- c:\program files (x86)\Xiph.Org
    2011-12-13 03:42 . 2011-12-13 03:42 281200 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
    2011-12-13 03:42 . 2011-12-13 03:42 -------- d-----w- c:\users\Owner\AppData\Local\PunkBuster
    2011-12-13 00:39 . 2011-12-13 03:42 281200 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
    2011-12-13 00:39 . 2011-12-13 00:39 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
    2011-12-13 00:39 . 2011-12-13 00:39 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
    2011-12-13 00:38 . 2011-12-13 00:38 -------- d-----w- c:\program files (x86)\NVIDIA Corporation
    2011-12-13 00:38 . 2011-12-13 00:38 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
    2011-12-12 23:32 . 2011-12-12 23:32 -------- d-----w- c:\users\Owner\AppData\Local\Evernote
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-01-09 02:49 . 2011-03-28 23:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-11-26 04:12 . 2011-11-26 03:23 2829 ----a-w- c:\windows\War3Unin.pif
    2011-11-26 04:12 . 2011-11-26 03:23 139264 ----a-w- c:\windows\War3Unin.exe
    2011-11-24 00:50 . 2011-05-15 14:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-11-21 11:40 . 2010-08-20 23:06 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2011-11-10 03:45 . 2011-11-10 03:45 10567680 ----a-w- c:\windows\system32\drivers\atikmdag.sys
    2011-11-10 03:39 . 2011-11-10 03:39 69632 ----a-w- c:\windows\system32\OpenVideo64.dll
    2011-11-10 03:39 . 2011-11-10 03:39 59904 ----a-w- c:\windows\SysWow64\OpenVideo.dll
    2011-11-10 03:39 . 2011-11-10 03:39 61952 ----a-w- c:\windows\system32\OVDecode64.dll
    2011-11-10 03:39 . 2011-11-10 03:39 54784 ----a-w- c:\windows\SysWow64\OVDecode.dll
    2011-11-10 03:39 . 2011-11-10 03:39 17442304 ----a-w- c:\windows\system32\amdocl64.dll
    2011-11-10 03:38 . 2011-11-10 03:38 14375936 ----a-w- c:\windows\SysWow64\amdocl.dll
    2011-11-10 03:37 . 2011-11-10 03:37 51200 ----a-w- c:\windows\system32\OpenCL.dll
    2011-11-10 03:37 . 2011-11-10 03:37 44032 ----a-w- c:\windows\SysWow64\OpenCL.dll
    2011-11-10 03:20 . 2011-11-10 03:20 25218048 ----a-w- c:\windows\system32\atio6axx.dll
    2011-11-10 03:17 . 2011-11-10 03:17 159744 ----a-w- c:\windows\system32\atiapfxx.exe
    2011-11-10 03:16 . 2011-10-26 02:05 774656 ----a-w- c:\windows\SysWow64\aticfx32.dll
    2011-11-10 03:15 . 2010-10-27 02:54 927232 ----a-w- c:\windows\system32\aticfx64.dll
    2011-11-10 03:12 . 2011-10-26 02:01 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
    2011-11-10 03:12 . 2011-11-10 03:12 516608 ----a-w- c:\windows\system32\atieclxx.exe
    2011-11-10 03:11 . 2011-11-10 03:11 204288 ----a-w- c:\windows\system32\atiesrxx.exe
    2011-11-10 03:10 . 2011-11-10 03:10 120320 ----a-w- c:\windows\system32\atitmm64.dll
    2011-11-10 03:09 . 2011-11-10 03:09 423424 ----a-w- c:\windows\system32\atipdl64.dll
    2011-11-10 03:09 . 2011-11-10 03:09 360448 ----a-w- c:\windows\SysWow64\atipdlxx.dll
    2011-11-10 03:09 . 2011-11-10 03:09 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
    2011-11-10 03:09 . 2011-11-10 03:09 21504 ----a-w- c:\windows\system32\atimuixx.dll
    2011-11-10 03:09 . 2011-11-10 03:09 59392 ----a-w- c:\windows\system32\atiedu64.dll
    2011-11-10 03:09 . 2011-11-10 03:09 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
    2011-11-10 03:06 . 2011-10-26 01:55 6077952 ----a-w- c:\windows\SysWow64\atidxx32.dll
    2011-11-10 02:58 . 2011-11-10 02:58 18996224 ----a-w- c:\windows\SysWow64\atioglxx.dll
    2011-11-10 02:51 . 2010-10-27 02:38 7405056 ----a-w- c:\windows\system32\atidxx64.dll
    2011-11-10 02:40 . 2011-11-10 02:40 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
    2011-11-10 02:40 . 2011-11-10 02:40 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
    2011-11-10 02:40 . 2011-10-26 01:43 4061696 ----a-w- c:\windows\system32\atiumd6a.dll
    2011-11-10 02:34 . 2011-11-10 02:34 51200 ----a-w- c:\windows\system32\aticalrt64.dll
    2011-11-10 02:34 . 2011-11-10 02:34 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
    2011-11-10 02:34 . 2011-11-10 02:34 44544 ----a-w- c:\windows\system32\aticalcl64.dll
    2011-11-10 02:34 . 2011-11-10 02:34 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
    2011-11-10 02:34 . 2011-11-10 02:34 13552640 ----a-w- c:\windows\system32\aticaldd64.dll
    2011-11-10 02:33 . 2011-11-10 02:33 5852672 ----a-w- c:\windows\SysWow64\atiumdag.dll
    2011-11-10 02:29 . 2011-11-10 02:29 11300864 ----a-w- c:\windows\SysWow64\aticaldd.dll
    2011-11-10 02:29 . 2011-11-10 02:29 4200960 ----a-w- c:\windows\SysWow64\atiumdva.dll
    2011-11-10 02:24 . 2011-10-26 01:29 7439360 ----a-w- c:\windows\system32\atiumd64.dll
    2011-11-10 02:18 . 2010-07-07 01:24 58880 ----a-w- c:\windows\system32\coinst.dll
    2011-11-10 02:13 . 2011-10-26 01:22 494592 ----a-w- c:\windows\system32\atiadlxx.dll
    2011-11-10 02:13 . 2011-11-10 02:13 348160 ----a-w- c:\windows\SysWow64\atiadlxy.dll
    2011-11-10 02:13 . 2011-11-10 02:13 17408 ----a-w- c:\windows\system32\atig6pxx.dll
    2011-11-10 02:13 . 2011-11-10 02:13 14336 ----a-w- c:\windows\SysWow64\atiglpxx.dll
    2011-11-10 02:13 . 2011-11-10 02:13 14336 ----a-w- c:\windows\system32\atiglpxx.dll
    2011-11-10 02:13 . 2011-11-10 02:13 39936 ----a-w- c:\windows\system32\atig6txx.dll
    2011-11-10 02:12 . 2011-11-10 02:12 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
    2011-11-10 02:12 . 2011-11-10 02:12 325632 ----a-w- c:\windows\system32\drivers\atikmpag.sys
    2011-11-10 02:11 . 2010-07-07 01:15 41984 ----a-w- c:\windows\system32\atiuxp64.dll
    2011-11-10 02:11 . 2011-10-26 01:21 32256 ----a-w- c:\windows\SysWow64\atiuxpag.dll
    2011-11-10 02:11 . 2010-08-04 01:14 39424 ----a-w- c:\windows\system32\atiu9p64.dll
    2011-11-10 02:11 . 2011-11-10 02:11 54784 ----a-w- c:\windows\system32\atimpc64.dll
    2011-11-10 02:11 . 2011-11-10 02:11 54784 ----a-w- c:\windows\system32\amdpcom64.dll
    2011-11-10 02:11 . 2010-10-27 02:13 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
    2011-11-10 02:11 . 2011-11-10 02:11 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll
    2011-11-10 02:11 . 2011-11-10 02:11 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll
    2011-11-10 02:10 . 2011-11-10 02:10 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
    2011-10-26 02:21 . 2011-10-26 02:21 66560 ----a-w- c:\windows\system32\OVDecoder64.dll
    2011-10-26 02:21 . 2011-10-26 02:21 56832 ----a-w- c:\windows\SysWow64\OVDecoder.dll
    2011-10-22 01:16 . 2011-10-22 01:16 1843200 ----a-w- c:\windows\SysWow64\SlotMaximizerBe.dll
    2011-10-22 01:15 . 2011-10-22 01:15 104448 ----a-w- c:\windows\SysWow64\SlotMaximizerAg.dll
    2011-10-22 01:12 . 2011-10-22 01:12 2763264 ----a-w- c:\windows\system32\SlotMaximizerBe.dll
    2011-10-22 01:07 . 2011-10-22 01:07 125440 ----a-w- c:\windows\system32\SlotMaximizerAg.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2011-07-22 718720]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-10 343168]
    "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux8"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-06-22 79360]
    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
    R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744]
    R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [x]
    R4 SQLAgent$ADCENTERDESKTOP;SQL Server Agent (ADCENTERDESKTOP);c:\program files\Microsoft SQL Server\MSSQL10_50.ADCENTERDESKTOP\MSSQL\Binn\SQLAGENT.EXE [2010-04-03 428384]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
    S2 MSSQL$ADCENTERDESKTOP;SQL Server (ADCENTERDESKTOP);c:\program files\Microsoft SQL Server\MSSQL10_50.ADCENTERDESKTOP\MSSQL\Binn\sqlservr.exe [2010-04-03 61913952]
    S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
    S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3409194014-2772524004-1542285492-1000Core.job
    - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-19 22:30]
    .
    2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3409194014-2772524004-1542285492-1000UA.job
    - c:\users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-19 22:30]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = https://qbo.intuit.com/c1/v35.116/0/login?redirect=true
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyServer = http=127.0.0.1:64364
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.2.1 75.75.75.75 75.75.76.76 208.67.222.222
    FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ew4li7rr.default\
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{66bd2442-241b-44cd-8c7a-b51037053cdb} - (no file)
    Toolbar-Locked - (no file)
    Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil10q_Plugin.exe
    Toolbar-Locked - (no file)
    WebBrowser-{66BD2442-241B-44CD-8C7A-B51037053CDB} - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    c:\windows\SysWOW64\PnkBstrA.exe
    c:\programdata\TVersity\Media Server\MediaServer.exe
    c:\programdata\TVersity\Media Server\berkelium.exe
    .
    **************************************************************************
    .
    Completion time: 2012-01-09 12:09:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-01-09 17:09
    .
    Pre-Run: 360,746,721,280 bytes free
    Post-Run: 369,414,533,120 bytes free
    .
    - - End Of File - - 815876954F465B9616DE973A319AF0AD
    zkatkin, Jan 9, 2012
    #3

  4. zkatkin Newcomer, in training

    MBR Log

    Not sure if you need this one, as it didn't seem to be posted in the other thread. Also, I have the .dat, but not sure if you need it or how to open it (tried using notepad, but I can't read anything in it.
    -------------------------------------------

    aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
    Run date: 2012-01-09 11:25:30
    -----------------------------
    11:25:30.796 OS Version: Windows x64 6.1.7601 Service Pack 1
    11:25:30.796 Number of processors: 8 586 0x1E05
    11:25:30.796 ComputerName: ASUS UserName:
    11:25:35.757 Initialize success
    11:25:41.186 AVAST engine defs: 12010900
    11:25:45.492 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
    11:25:45.492 Disk 0 Vendor: ST950042 0002 Size: 476940MB BusType: 3
    11:25:45.507 Disk 0 MBR read successfully
    11:25:45.507 Disk 0 MBR scan
    11:25:45.554 Disk 0 Windows 7 default MBR code
    11:25:45.570 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 476938 MB offset 2048
    11:25:45.601 Service scanning
    11:25:46.053 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
    11:25:46.662 Modules scanning
    11:25:46.662 Disk 0 trace - called modules:
    11:25:46.662 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
    11:25:46.677 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800ae67790]
    11:25:46.677 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa800ac1f950]
    11:25:46.677 5 ACPI.sys[fffff88000ef67a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800ac29050]
    11:25:48.284 AVAST engine scan C:\Windows
    11:25:52.402 AVAST engine scan C:\Windows\system32
    11:28:37.153 AVAST engine scan C:\Windows\system32\drivers
    11:28:51.196 AVAST engine scan C:\Users\Owner
    11:37:11.957 AVAST engine scan C:\ProgramData
    11:41:06.207 Scan finished successfully
    11:41:30.606 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat"
    11:41:30.698 The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt"
    zkatkin, Jan 9, 2012
    #4

  5. Broni Malware Annihilator

    This is NOT what I asked for.
    I never asked you to run Combofix or aswMBR.
    Please re-read my previous reply.
    Broni, Jan 9, 2012
    #5
Thread Status:
Not open for further replies.