InterviewSolution
Saved Bookmarks
| 1. |
Solve : Who are mikrocop.d.o.o?? |
|
Answer» My security software (Agnitum Outpost Security Suite) informed me that it had BLOCKED an attempt to access one of the ports on my computer. It was a firm called microkop.d.o.o. (91.198.x.x) who I am not aware of. I know of no reason why they should access my computer. Is this something to worry about?Sure it is... Please run the following scan and we will start checking for malware...
ESET Online Scan Please run a free online scan with the ESET Online Scanner
Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.17.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 Ron :: LAPTOP [administrator] 17/11/2012 19:52:34 mbam-log-2012-11-17 (19-52-34).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 209177 Time elapsed: 8 minute(s), 59 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Going to do the next part now.C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dlla variant of Win32/Adware.Yontoo.B applicationcleaned by deleting - quarantined C:\Users\Ron\AppData\Local\Mozilla\Firefox\Profiles\nquzyw60.default\Cache\B\11\1E410d01HTML/ScrInject.B.Gen virusdeleted - quarantined C:\Users\Ron\AppData\Local\Temp\Free Desktop Clock.exea variant of Win32/Somoto.A applicationcleaned by deleting - quarantined C:\Users\Ron\AppData\Local\Temp\SetupDataMngr_Searchqu.exemultiple threatscleaned by deleting - quarantined ComboFix scan Please download ComboFix by sUBs From BleepingComputer.com Please save the file to your Desktop. Important information about ComboFix After the download:
Safe Mode: If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there. (To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode.") Re-downloading: If this doesn't work either, try the same method (above method), but try to download it again, except name ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe. Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe. NOTE: If you encounter a message "illegal operation attempted on registry key that has been MARKED for deletion" and no programs will run - please just reboot and that will resolve that error.ComboFix 12-11-16.02 - Ron 18/11/2012 11:12:52.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.3037.1958 [GMT 0:00] Running from: c:\users\Ron\Downloads\ComboFix.exe AV: Outpost Security Suite Pro *Disabled/Updated* {ECEA6BCD-A007-0BC7-D5A5-0254DCBD816E} FW: Outpost Security Suite Pro *Disabled* {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615} SP: Outpost Security Suite Pro *Disabled/Updated* {578B8A29-863D-0449-EF15-3926A73ACBD3} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point * Resident AV is active . . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Ron\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3C4B8B1C-90A4-40DD-9E78-F2A98AC739DE}.xps c:\users\Ron\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7FD0805F-B38B-49B4-B4A0-9CF9767AEA49}.xps c:\users\Ron\AppData\Roaming\Microsoft\~DFK8e366d.tmp c:\users\Ron\AppData\Roaming\Microsoft\mjcriu.dll c:\users\Ron\AppData\Roaming\Microsoft\peaadje.dll c:\users\Ron\Documents\~WRL0001.tmp c:\users\Ron\Documents\~WRL0907.tmp c:\users\Ron\Documents\~WRL1544.tmp c:\users\Ron\Documents\~WRL2723.tmp c:\users\Ron\Documents\~WRL3016.tmp c:\users\Ron\Documents\~WRL3257.tmp . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_NPF -------\Service_RelevantKnowledge . . ((((((((((((((((((((((((( Files Created from 2012-10-18 to 2012-11-18 ))))))))))))))))))))))))))))))) . . 2012-11-18 11:22 . 2012-11-18 11:26--------d-----w-c:\users\Ron\AppData\Local\temp 2012-11-18 11:22 . 2012-11-18 11:22--------d-----w-c:\users\Default\AppData\Local\temp 2012-11-17 20:11 . 2012-11-17 20:11--------d-----w-c:\program files\ESET 2012-11-16 11:45 . 2012-10-12 05:566918632----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{979EBB1F-2E5B-4EA2-BD1B-B94739DEF99B}\mpengine.dll 2012-11-13 21:48 . 2012-07-26 03:39526952----a-w-c:\windows\system32\drivers\Wdf01000.sys 2012-11-13 21:48 . 2012-07-26 03:3947720----a-w-c:\windows\system32\drivers\WdfLdr.sys 2012-11-13 21:48 . 2012-07-26 02:469728----a-w-c:\windows\system32\Wdfres.dll 2012-11-13 21:48 . 2012-07-26 02:3366560----a-w-c:\windows\system32\drivers\WUDFPf.sys 2012-11-13 21:48 . 2012-07-26 02:32155136----a-w-c:\windows\system32\drivers\WUDFRd.sys 2012-11-13 21:48 . 2012-07-26 03:21196608----a-w-c:\windows\system32\WUDFHost.exe 2012-11-13 21:48 . 2012-07-26 03:2073216----a-w-c:\windows\system32\WUDFSvc.dll 2012-11-13 21:48 . 2012-07-26 03:20613888----a-w-c:\windows\system32\WUDFx.dll 2012-11-13 21:48 . 2012-07-26 03:2038912----a-w-c:\windows\system32\WUDFCoinstaller.dll 2012-11-13 21:48 . 2012-07-26 03:20172032----a-w-c:\windows\system32\WUDFPlatform.dll 2012-11-13 21:45 . 2012-09-25 22:4778336----a-w-c:\windows\system32\synceng.dll 2012-11-13 21:45 . 2012-10-03 16:581293680----a-w-c:\windows\system32\drivers\tcpip.sys 2012-11-13 21:45 . 2012-10-03 16:42156672----a-w-c:\windows\system32\ncsi.dll 2012-11-13 21:45 . 2012-10-03 16:4252224----a-w-c:\windows\system32\nlaapi.dll 2012-11-13 21:45 . 2012-10-03 16:42242176----a-w-c:\windows\system32\nlasvc.dll 2012-11-13 21:45 . 2012-10-03 16:4218944----a-w-c:\windows\system32\netevent.dll 2012-11-13 21:45 . 2012-10-03 16:42175104----a-w-c:\windows\system32\netcorehc.dll 2012-11-13 21:45 . 2012-10-03 16:40499712----a-w-c:\windows\system32\iphlpsvc.dll 2012-11-13 21:45 . 2012-10-03 15:2135328----a-w-c:\windows\system32\drivers\tcpipreg.sys 2012-11-13 21:45 . 2012-10-18 17:592345984----a-w-c:\windows\system32\win32k.sys 2012-11-13 21:45 . 2012-10-09 17:4044032----a-w-c:\windows\system32\dhcpcsvc6.dll 2012-11-13 21:45 . 2012-10-09 17:40193536----a-w-c:\windows\system32\dhcpcore6.dll 2012-11-13 21:37 . 2012-08-24 17:05136560----a-w-c:\windows\system32\drivers\ksecpkg.sys 2012-11-13 21:37 . 2012-08-24 17:02369856----a-w-c:\windows\system32\drivers\cng.sys 2012-11-13 21:37 . 2012-08-24 16:57247808----a-w-c:\windows\system32\schannel.dll 2012-11-13 21:37 . 2012-08-24 16:57220160----a-w-c:\windows\system32\ncrypt.dll 2012-11-13 21:37 . 2012-08-24 16:561039360----a-w-c:\windows\system32\lsasrv.dll 2012-11-10 12:02 . 2012-11-10 12:02159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin7.dll 2012-11-10 12:02 . 2012-11-10 12:02159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin6.dll 2012-11-10 12:02 . 2012-11-10 12:02159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin5.dll 2012-11-10 12:02 . 2012-11-10 12:02159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin4.dll 2012-11-10 12:02 . 2012-11-10 12:02159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin3.dll 2012-11-10 12:02 . 2012-11-10 12:01159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin2.dll 2012-11-10 12:02 . 2012-11-10 12:01159744----a-w-c:\program files\Internet Explorer\Plugins\npqtplugin.dll 2012-11-10 12:01 . 2012-11-10 12:01--------d-----w-c:\program files\QUICKTIME 2012-11-07 16:29 . 2012-11-07 16:2965848----a-w-c:\windows\system32\drivers\RapportKELL.sys 2012-10-29 12:26 . 2012-10-29 12:27--------d-----w-c:\users\Ron\AppData\Roaming\GoforFiles 2012-10-28 18:49 . 2012-10-28 18:49--------d-----w-c:\users\Ron\AppData\Roaming\Photobucket 2012-10-28 18:48 . 2012-10-28 18:48--------d-----w-c:\program files\Photobucket Desktop 2012-10-28 07:09 . 2012-10-28 07:09--------d-----w-c:\program files\Mozilla Maintenance Service 2012-10-25 15:19 . 2012-10-25 15:19--------d-----w-c:\program files\Common Files\Nikon 2012-10-25 15:17 . 2012-10-25 15:29--------d-----w-c:\program files\Microsoft Digital Image 2006 2012-10-25 03:12 . 2012-10-25 03:1294208----a-w-c:\windows\system32\QuickTimeVR.qtx 2012-10-25 03:12 . 2012-10-25 03:1269632----a-w-c:\windows\system32\QuickTime.qts 2012-10-21 11:49 . 2012-10-21 12:00--------d-----w-c:\users\Super Ted . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-11 17:44 . 2012-05-17 23:22895088----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2012-11-11 17:43 . 2012-05-17 23:2242776----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2012-11-11 17:43 . 2012-05-17 23:21710992----a-w-c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-11-09 10:45 . 2012-05-27 11:48895088----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll 2012-11-09 10:45 . 2012-05-27 11:4842776----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll 2012-11-09 10:45 . 2012-05-27 11:48710992----a-w-c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-11-08 23:26 . 2012-04-02 20:43697272----a-w-c:\windows\system32\FlashPlayerApp.exe 2012-11-08 23:26 . 2012-03-26 10:3873656----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-29 19:54 . 2012-06-27 11:1422856----a-w-c:\windows\system32\drivers\mbam.sys 2012-09-24 22:16 . 2012-10-18 16:1893672----a-w-c:\windows\system32\WindowsAccessBridge.dll 2012-09-14 18:28 . 2012-10-10 15:042048----a-w-c:\windows\system32\tzres.dll 2012-09-13 10:23 . 2012-06-29 12:36821736----a-w-c:\windows\system32\npdeployJava1.dll 2012-09-13 10:23 . 2012-04-17 22:04746984----a-w-c:\windows\system32\deployJava1.dll 2012-08-31 17:18 . 2012-10-10 15:031211760----a-w-c:\windows\system32\drivers\ntfs.sys 2012-08-30 17:12 . 2012-10-10 15:033968880----a-w-c:\windows\system32\ntkrnlpa.exe 2012-08-30 17:12 . 2012-10-10 15:033914096----a-w-c:\windows\system32\ntoskrnl.exe 2012-08-24 16:57 . 2012-10-10 15:04172544----a-w-c:\windows\system32\wintrust.dll 2012-08-23 15:52 . 2012-11-13 21:383072----a-w-c:\windows\system32\drivers\en-US\tsusbflt.sys.mui 2012-08-22 17:16 . 2012-09-12 09:59712048----a-w-c:\windows\system32\drivers\ndis.sys 2012-08-22 17:16 . 2012-09-12 09:59240496----a-w-c:\windows\system32\drivers\netio.sys 2012-08-22 17:16 . 2012-09-12 09:59187760----a-w-c:\windows\system32\drivers\FWPKCLNT.SYS 2012-08-21 20:12 . 2012-09-26 10:13245760----a-w-c:\windows\system32\OxpsConverter.exe 2012-08-21 12:01 . 2012-09-14 11:4526840----a-w-c:\windows\system32\drivers\GEARAspiWDM.sys 2012-08-21 12:01 . 2012-04-03 09:46106928----a-w-c:\windows\system32\GEARAspi.dll 2012-08-20 17:40 . 2012-10-10 15:04169984----a-w-c:\windows\system32\winsrv.dll 2012-08-20 17:40 . 2012-10-10 15:04293376----a-w-c:\windows\system32\KernelBase.dll 2012-08-20 17:37 . 2012-10-10 15:04271360----a-w-c:\windows\system32\conhost.exe 2012-08-20 17:32 . 2012-10-10 15:035120---ha-w-c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034608---ha-w-c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034096---ha-w-c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034096---ha-w-c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034096---ha-w-c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034096---ha-w-c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:034096---ha-w-c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2012-08-20 17:32 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2012-08-20 15:33 . 2012-10-10 15:033584---ha-w-c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2012-08-20 15:33 . 2012-10-10 15:036144---ha-w-c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2012-08-20 15:33 . 2012-10-10 15:034608---ha-w-c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2012-08-20 15:33 . 2012-10-10 15:033072---ha-w-c:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2012-10-24 17:50 . 2012-10-28 07:09261600----a-w-c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Outpost] @="{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}" [HKEY_CLASSES_ROOT\CLSID\{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}] 2012-02-17 10:57246696----a-w-c:\program files\Agnitum\Outpost Security Suite Pro\op_shell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-06 4763008] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "Trend Micro RUBotted V2.0 Beta"="c:\program files\Trend Micro\RUBotted\RUBottedGUI.exe" [2010-12-17 1103184] "OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2012-02-17 3266864] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] . c:\users\Ron\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2012-6-27 572000] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Agnitum\OUTPOS~1\wl_hook.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe R2 RUBotSrv;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\RUBotSrv.exe R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys R3 RapportKELL;RapportKELL;c:\windows\system32\Drivers\RapportKELL.sys R3 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe S0 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys S1 afw;Agnitum Firewall Driver;c:\windows\system32\DRIVERS\afw.sys S1 RapportCerberus_43926;RapportCerberus_43926;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus32_43926.sys S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys S3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\39624\rapportiaso.sys S3 VBEngNT;VBEngNT;c:\windows\system32\drivers\VBEngNT.sys S3 VBFilt;VBFilt;c:\windows\system32\Filt\VBFilt.dll . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL *Deregistered* - VBCoreNT.0 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroupREG_MULTI_SZ GPSvc . Contents of the 'Scheduled Tasks' folder . 2012-11-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 23:26] . . ------- Supplementary Scan ------- . uStart Page = hxxp://uk.search.yahoo.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Ron\AppData\Roaming\Mozilla\Firefox\Profiles\nquzyw60.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/|http://my.ebay.co.uk/ws/eBayISAPI.dll?MyEbay&gbh=1&CurrentPage=MyeBayAllSelling&ssPageName=STRK:ME:LNLK:MESX|http://www.natwest.com/personal.ashx|https://www.paypal.com/uk/webapps/mpp/home|https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1351630588&rver=6.1.6206.0℘=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&lc=2057&id=64855&mkt=en-gb&cbcxt=mai&snsc=1#n=1812048153&fid=5|http://s756.beta.photobucket.com/|http://www.metoffice.gov.uk/public/weather/forecast/?tab=fiveDay|http://uk.search.yahoo.com/ FF - ExtSQL: 2012-10-28 07:15; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Ron\AppData\Roaming\Mozilla\Firefox\Profiles\nquzyw60.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) ShellIconOverlayIdentifiers-{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d} - (no file) HKCU-Run-SkinClock - (no file) . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(2204) c:\program files\Trusteer\Rapport\bin\rooksbas.DLL c:\program files\Agnitum\Outpost Security Suite Pro\op_shell.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\atieclxx.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\programdata\EPSON\EPW!3 SSRP\E_S40RP7.EXE c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\windows\servicing\TrustedInstaller.exe c:\program files\Trusteer\Rapport\bin\RapportService.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Completion time: 2012-11-18 11:30:00 - machine was rebooted ComboFix-quarantined-files.txt 2012-11-18 11:29 . Pre-Run: 195,105,316,864 bytes free Post-Run: 195,572,260,864 bytes free . - - End Of File - - FFC5D76D32EAF74ADFAC6504DF921B7B Any more issues? We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here. Many of the things to note for us would be:
Clean up System Restore Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back." To manually create a new Restore Point
To remove all of the tools we used and the files and folders they created, please do the following: Please download OTC.exe by OldTimer:
Purge old temporary files NOTE: If you already have this installed, you don't have to reinstall it. Please download CCleaner Slim and save it to your Desktop - Alternate download link When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe Follow the prompts to install the program.
Always back up your registry before making any CHANGES. Exit CCleaner after it has completed it's process. Security Check Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
Windows 7 Service Pack 1 x86 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:``````````````[/u] Windows Firewall Disabled! Outpost Security Suite Pro Antivirus up to date! `````````Anti-malware/Other Utilities Check:`````````[/u] SUPERAntiSpyware Secunia PSI (3.0.0.2004) Malwarebytes Anti-Malware version 1.65.1.1000 CCleaner Java 7 Update 9 Adobe Flash Player 11.5.502.110 Adobe Reader X (10.1.4) Mozilla Firefox (16.0.2) ````````Process Check: objlist.exe by Laurent````````[/u] Trend Micro RUBotted RUBottedGUI.exe `````````````````System Health check`````````````````[/u] Total Fragmentation on Drive C: 5% ````````````````````End of Log``````````````````````[/u]Personal Tips on Preventing Malware See this page for more info about malware and prevention. Any other questions before I mark this topic solved?Nothing else, thanks, DMJ. I appreciate your efforts. Thanks again. Ron You're welcome. Topic marked solved. |
|