XI Wiki
Help me out here BG, I've tried everything and I'm at the end of my rope. I've re-installed MSE 3 times now and every time it disappears the next day. The shortcut no longer works. Obviously this points to some kind of virus, but I can't find it, I've used a full scan in MSE, Malwarebytes, and Combofix and all of them found nothing.
Here is the log from Combofix:
Spoiler: show
Running from: c:\users\Aaron\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\5907\Downloads\15fc9c67-6e4d-42b6-b215-fee7bb01b1c7.dll
c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Pro files\7x2dj2nj.default\searchplugins\bing-zugo.xml
c:\windows\system32\AutoRun.inf
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2012-04-06 to 2012-05-06 )))))))))))))))))))))))))))))))
.
.
2012-05-06 17:58 . 2012-05-06 17:58 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-05-06 17:58 . 2012-05-06 17:58 -------- d-----w- c:\users\Mcx1-AARON-PC\AppData\Local\temp
2012-05-06 17:58 . 2012-05-06 17:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-06 00:02 . 2012-04-13 05:46 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-06 00:02 . 2012-04-13 05:46 8917360 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E1EA7BB-BC1C-45BF-8830-1EAFA044CCC4}\mpengine.dll
2012-05-05 07:00 . 2012-05-05 07:00 -------- d-----w- c:\windows\Temp97B8F991-66AC-CAD0-C3E5-00B4D47D1599-Signatures
2012-05-04 23:30 . 2012-05-04 23:30 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91F9386C-4807-4E7B-AA53-732A4E544FEF}\gapaengine.dll
2012-05-04 23:28 . 2012-05-04 23:28 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-05-04 23:15 . 2012-05-04 23:16 -------- d-----w- c:\program files\iTunes
2012-05-04 23:15 . 2012-05-04 23:15 -------- d-----w- c:\program files\iPod
2012-05-04 07:52 . 2012-04-18 07:03 8917360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BE3D4674-1367-4E13-A8F6-B7F84E24152A}\mpengine.dll
2012-05-01 07:00 . 2012-05-01 07:00 -------- d-----w- c:\windows\Temp44F4CF3E-03BD-EA86-1A0E-04023F9F565B-Signatures
2012-04-28 23:40 . 2012-04-28 23:40 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-04-28 23:40 . 2012-04-28 23:40 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-28 23:40 . 2012-04-28 23:40 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-21 11:08 . 2012-04-21 11:08 -------- d-----w- c:\programdata\McAfee
2012-04-11 10:06 . 2012-05-05 01:06 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-11 09:35 . 2012-05-05 01:07 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-11 07:03 . 2012-03-06 06:53 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 07:03 . 2012-03-06 05:59 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-04-11 07:03 . 2012-03-06 05:59 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-11 07:00 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-11 07:00 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-11 07:00 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-04-11 07:00 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-04-11 07:00 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-11 07:00 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-04-11 07:00 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2012-05-05 01:07 . 2011-07-05 23:56 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-04 19:56 . 2010-06-26 10:21 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-10 14:41 . 2010-05-23 13:36 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-02-23 14:18 . 2009-10-03 05:48 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 06:12 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 06:12 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 06:12 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 06:12 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-15 15:01 . 2012-02-15 15:01 52736 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
2012-02-15 15:01 . 2012-02-15 15:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-10 06:36 . 2012-03-14 06:13 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 06:13 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2006-05-03 16:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 17:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 19:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-07 04:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn2\YTNavAssist.d ll" [2011-03-16 214840]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{A31F34A1-EBD2-45A2-BF6D-231C1B987CC8}]
[HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1dad3af3-ef2f-4f64-ac4b-11789189fcb6}]
2012-02-10 15:28 1307928 ----a-w- c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Internet Explorer\Toolbar]
"{eec0f710-38b5-4aba-99bf-ec87564a4e13}"= "c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll" [2012-02-10 1307928]
.
[HKEY_CLASSES_ROOT\clsid\{eec0f710-38b5-4aba-99bf-ec87564a4e13}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"ISUSPM"="c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"Messenger (Yahoo!)"="c:\progra~2\Yahoo!\MESSEN~1\YahooMessen ger.exe" [2010-06-01 5252408]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-02 1242448]
"Xmarks"="c:\program files (x86)\Xmarks\IE Extension\xmarkssync.exe" [2011-08-19 1121832]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-03-02 119152]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"AgentMonitor"="c:\program files (x86)\VTech\DownloadManager\System\AgentMonitor.ex e" [2011-12-13 357800]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
c:\users\Aaron\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-6 1312096]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
UltraMon.lnk - c:\windows\Installer\{537056B7-32A4-4408-9B54-0341963C7C9C}\IcoUltraMon.ico [2011-4-19 29310]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-6 1312096]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-14 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPl ayerUpdateService.exe [2012-05-05 257696]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-04-07 1030600]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-14 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-28 129976]
R3 PCD5SRVC{048DBD20-445E8C82-05040104};PCD5SRVC{048DBD20-445E8C82-05040104} - PCDR Kernel Mode Service Helper Driver;c:\program files (x86)\Dell Support Center\HWDiag\bin\pcd5srvc_x64.pkms [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsus bflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHl pa64.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSr64.exe [x]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 SftService;SoftThinks Agent Service;c:\windows\sminst\sftservice.EXE [2009-02-23 632048]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-15 381248]
S2 UltraMonUtility;UltraMon Utility Driver;c:\program files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys [2008-11-14 20512]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpda teService.exe [2012-04-11 01:07]
.
2012-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-10 00:53]
.
2012-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-10 00:53]
.
2012-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1690989738-4252003389-1463084348-1000Core.job
- c:\users\Aaron\AppData\Local\Google\Update\GoogleU pdate.exe [2010-04-22 21:43]
.
2012-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1690989738-4252003389-1463084348-1000UA.job
- c:\users\Aaron\AppData\Local\Google\Update\GoogleU pdate.exe [2010-04-22 21:43]
.
2012-05-03 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]
.
2012-05-06 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files (x86)\Realtek\RTNICDiag\RTNICDiag.exe [2009-05-13 11:18]
.
2012-05-06 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-04-13 06:11]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"RtHDVCpl"="RAVCpl64.exe" [2008-07-18 6431232]
"VX3000"="c:\windows\vVX3000.exe" [2010-03-02 762736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.startnow.com/?src=startpage&provider=Bing&provider_code=Z065&pa rtner_id=287&product_id=463&affiliate_id=&channel= 9007&toolbar_id=200&toolbar_version=2.0&install_co untry=US&install_date=20110704&user_guid=04B1E6122 0134F14A3A0882CF7995E47&machine_id=56bba416bb52c96 406506ee815b236aa&browser=IE&os=win&os_version=6.1-x64-SP1
mStart Page = hxxp://www.yahoo.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Aaron\AppData\Roaming\Mozilla\Firefox\Pro files\7x2dj2nj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
FF - prefs.js: keyword.URL - hxxp://www.startnow.com/s/?src=addrbar&provider=Bing&provider_code=Z065&part ner_id=287&product_id=463&affiliate_id=&channel=90 07&toolbar_id=200&toolbar_version=2.0&install_coun try=US&install_date=20110704&user_guid=04B1E612201 34F14A3A0882CF7995E47&machine_id=56bba416bb52c9640 6506ee815b236aa&browser=FF&os=win&os_version=6.1-x64-SP1&q=
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer , true
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\P CD5SRVC{048DBD20-445E8C82-05040104}]
"ImagePath"="\??\c:\program files (x86)\Dell Support Center\HWDiag\bin\pcd5srvc_x64.pkms"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\P*e*r*s*o*n*a*l*
\Final Fantasy XI]
"Order"=hex:08,00,00,00,02,00,00,00,ba,03,00,00,01 ,00,00,00,06,00,00,00,84,00,
00,00,00,00,00,00,76,00,32,00,cd,00,00,00,00,70,ae ,e1,20,00,43,4f,42,52,41,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\P*e*r*s*o*n*a*l*
\WoW]
"Order"=hex:08,00,00,00,02,00,00,00,f2,04,00,00,01 ,00,00,00,08,00,00,00,9e,00,
00,00,00,00,00,00,90,00,32,00,cd,00,00,00,00,08,d9 ,c2,20,00,41,4c,4c,41,4b,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Communication]
"Order"=hex:08,00,00,00,02,00,00,00,8e,02,00,00,01 ,00,00,00,06,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,32,00,84,00,00,00,00,2a,91 ,ae,20,00,41,6c,65,72,74,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Community]
"Order"=hex:08,00,00,00,02,00,00,00,d4,04,00,00,01 ,00,00,00,0b,00,00,00,60,00,
00,00,00,00,00,00,52,00,32,00,84,00,00,00,00,1f,2e ,f5,20,00,33,36,30,2e,75,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\DesignCenter.lnk]
"Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01 ,00,00,00,00,00,00,00
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Entertainment]
"Order"=hex:08,00,00,00,02,00,00,00,f2,03,00,00,01 ,00,00,00,09,00,00,00,72,00,
00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,d7,50 ,2c,20,00,41,53,54,52,4f,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Home & Living]
"Order"=hex:08,00,00,00,02,00,00,00,b8,04,00,00,01 ,00,00,00,0b,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,9d,1a ,77,20,00,41,75,74,6f,73,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Information Management]
"Order"=hex:08,00,00,00,02,00,00,00,0a,07,00,00,01 ,00,00,00,10,00,00,00,60,00,
00,00,00,00,00,00,52,00,32,00,84,00,00,00,00,56,73 ,8e,20,00,33,36,30,2e,75,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\News]
"Order"=hex:08,00,00,00,02,00,00,00,d6,02,00,00,01 ,00,00,00,06,00,00,00,6a,00,
00,00,00,00,00,00,5c,00,32,00,84,00,00,00,00,2e,a0 ,59,20,00,41,6c,65,72,74,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Personal Finance]
"Order"=hex:08,00,00,00,02,00,00,00,da,01,00,00,01 ,00,00,00,04,00,00,00,70,00,
00,00,00,00,00,00,62,00,32,00,84,00,00,00,00,a0,26 ,3a,20,00,42,49,4c,4c,50,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Personal Publishing]
"Order"=hex:08,00,00,00,02,00,00,00,d2,01,00,00,01 ,00,00,00,04,00,00,00,6c,00,
00,00,00,00,00,00,5e,00,32,00,84,00,00,00,00,e1,dd ,0a,20,00,44,6f,6d,61,69,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Shopping]
"Order"=hex:08,00,00,00,02,00,00,00,cc,04,00,00,01 ,00,00,00,0b,00,00,00,66,00,
00,00,00,00,00,00,58,00,32,00,84,00,00,00,00,76,65 ,4d,20,00,41,75,74,6f,73,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Sports & Outdoors]
"Order"=hex:08,00,00,00,02,00,00,00,66,01,00,00,01 ,00,00,00,03,00,00,00,7c,00,
00,00,00,00,00,00,6e,00,32,00,84,00,00,00,00,36,1d ,e0,20,00,46,41,4e,54,41,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Tools for Business]
"Order"=hex:08,00,00,00,02,00,00,00,ba,05,00,00,01 ,00,00,00,0c,00,00,00,80,00,
00,00,00,00,00,00,72,00,32,00,84,00,00,00,00,e3,21 ,5a,20,00,42,55,53,49,4e,\
.
[HKEY_USERS\S-1-5-21-1690989738-4252003389-1463084348-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MenuOrder\Favorites\Y*a*h*o*o*!*
\Travel & Transportation]
"Order"=hex:08,00,00,00,02,00,00,00,08,01,00,00,01 ,00,00,00,02,00,00,00,92,00,
00,00,00,00,00,00,84,00,32,00,84,00,00,00,00,c3,e1 ,25,20,00,4d,41,50,53,26,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macrome d\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUt il32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32 _11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32 _11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32 _11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32 _11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ DbgagD\1*]
"value"="?\0c\06\11\0f#\1aG"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PC W\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
.
************************************************** ************************
.
Completion time: 2012-05-06 14:16:03 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-06 18:15
.
Pre-Run: 274,697,003,008 bytes free
Post-Run: 274,373,005,312 bytes free
.
- - End Of File - - 3FFC65E4610A51893524DB8A33C464BC
- Navigation
Results 1 to 12 of 12
-
2012-05-07 17:11 #1Old Merits
- Join Date
- Jun 2005
- Posts
- 1,223
- BG Level
- 6
Microsoft Security Essentials keeps disappearing
Help me out here BG, I've tried everything and I'm at the end of my rope. I've re-installed MSE 3 times now and every time it disappears the next day. The shortcut no longer works. Obviously this points to some kind of virus, but I can't find it, I've used a full scan in MSE, Malwarebytes, and Combofix and all of them found nothing.
Here is the log from Combofix:
Spoiler: show
-
2012-05-07 22:48 #2Micronesian Thunder
Sweaty Dick Punching Enthusiast
- Join Date
- Jan 2011
- Posts
- 1,362
- BG Level
- 6
- WoW Realm
- Blackrock
Went down 4 lines to find the problem. Disable Windows Defender.
-
2012-05-07 22:57 #3I Am, Who I Am.
- Join Date
- Nov 2005
- Posts
- 15,656
- BG Level
- 9
- FFXIV Character
- Trixi Sephyuyx
- FFXIV Server
- Excalibur
- FFXI Server
- Ragnarok
Im fairly sure windows defender is built in to W7, though I cant tell if your using Vista or W7.
Though im also fairly sure in W7 defender is used more as a service when MSE is installed..
I dont think there is an issue with having both enabled.. but disabling defender is a start to see if that is the issue.
PS. Do search providers redirect you when you search online?
-
2012-05-07 23:02 #4Banned.
- Join Date
- Oct 2006
- Posts
- 10,115
- BG Level
- 9
c:\programdata\PCDr\5907\Downloads\15fc9c67-6e4d-42b6-b215-fee7bb01b1c7.dll <--- malware, zugo is bad too IIRC
edit: startnow.com seems like poop too.
-
2012-05-08 04:33 #5Old Merits
- Join Date
- Jun 2005
- Posts
- 1,223
- BG Level
- 6
I don't get any redirects at all. The only evidence of anything is the fact that MSE keeps disappearing. Completely disappearing, I have to re-download and re-install the whole thing every time. It's the weirdest thing.
-
2012-05-08 09:08 #6Old Merits
- Join Date
- Jun 2005
- Posts
- 1,223
- BG Level
- 6
Also I'm on Windows 7.
It appears that Windows Defender is strictly acting as an anti-spyware program alongside MSE, but I've disabled it anyway and re-installed MSE. We'll see what happens, this is really frustrating.
-
2012-05-08 10:55 #7Relic Shield
- Join Date
- Oct 2006
- Posts
- 1,599
- BG Level
- 6
- FFXI Server
- Odin
I'd recommend running this:
Originally Posted by Arnwulf
http://www.malwarebytes.org/products/malwarebytes_free
Then post a HiJackThisLog after that has cleaned everything up.
-
2012-05-08 11:47 #82600klub
I donated 5 bucks and all I got was this shitty title from Zet
- Join Date
- Jun 2007
- Posts
- 2,688
- BG Level
- 7
- FFXI Server
- Ragnarok
Go to www.eset.com and run their online virus scanner.
-
2012-05-09 17:56 #9Pandemonium
- Join Date
- Feb 2010
- Posts
- 7,640
- BG Level
- 8
- FFXI Server
- Sylph
Startnow is absolutely a trojan/virus ware.
-
2012-05-09 18:43 #10Old Merits
- Join Date
- Jun 2005
- Posts
- 1,223
- BG Level
- 6
Aaaaaand it's gone again......I already did Malwarebytes scan a couple days ago it found nothing, will do a Hijackthis log in a few.
-
2012-05-10 04:42 #11Old Merits
- Join Date
- Jun 2005
- Posts
- 1,223
- BG Level
- 6
HijackThis Log:
Spoiler: show
-
2012-05-10 08:19 #12Banned.
- Join Date
- Oct 2006
- Posts
- 10,115
- BG Level
- 9
The only really suspicious things are the startnow entries.
