Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all,
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.
Stubborn Garda virus
Options
Comments
-
-
-
-
Hi folks I used the posts on here to get rid of it a month ago- thanks a mil- the guy in the local computer shop wanted to charge me €170 to do it BUT its back and very nasty this time. I can't do the safe mode option but was able to do the safe mode with the command prompt hit after the system rescue ran the loch screen appeared again before I could run malware/hitman.
I think because there's two users on the machine it won't let me in on the user that's locked- is there anyway to bypass this? Or am I as well off just doing the USB thing? I presume you won't be able to download to the USB on a lot of pcs but should be allowed in an Internet cafe?
Thanks again boardsies
0 -
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
-
-
-
-
-
Advertisement
-
-
-
-
-
I think the folders are of photos that he would have saved. I'm almost positive that the coach one is.
the log is
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-04-2013
Ran by SYSTEM at 2013-04-25 23:11:52 Run:1
Running from
\
Boot Mode: Recovery
==============================================
HKEY_USERS\martin\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe CSx Manager value not found.
HKEY_USERS\martin\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell value deleted successfully.
C:\Users\martin\AppData\Roaming\skype.ini moved successfully.
C:\Users\martin\AppData\Roaming\skype.dat moved successfully.
==== End of Fixlog ====0 -
-
-
-
ComboFix 13-04-25.01 - martin 25/04/2013 23:42:06.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2934.1316 [GMT 1:00]
Running from: c:\users\martin\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
.
.
((((((((((((((((((((((((( Files Created from 2013-03-25 to 2013-04-25 )))))))))))))))))))))))))))))))
.
.
2013-04-26 06:14 . 2013-04-26 06:14
d
w- C:\FRST
2013-04-25 22:47 . 2013-04-25 22:47
d
w- c:\users\Default\AppData\Local\temp
2013-04-25 22:36 . 2013-04-25 22:35 905296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C45C5020-51D3-47D4-A653-92D4C4DDBA7B}\gapaengine.dll
2013-04-25 22:36 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3373225D-7E72-47B1-AE54-0F222B88070F}\mpengine.dll
2013-04-25 22:35 . 2013-04-25 22:35
d
w- c:\program files (x86)\Common Files\Java
2013-04-25 22:35 . 2013-04-25 22:34 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-25 22:34 . 2013-04-25 22:34
d
w- c:\program files (x86)\Java
2013-04-22 09:00 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-04-10 19:40 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 19:40 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 19:39 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 19:39 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 19:39 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 19:39 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 19:35 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 19:35 . 2013-03-02 06:04 1655656 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 19:29 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-04-10 19:29 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 19:29 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 19:29 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 19:29 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 19:29 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-10 19:29 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-29 09:28 . 2013-03-29 09:28
d
w- c:\users\martin\AppData\Roaming\873997d3-3f3a-4807-a625-a0032ed6e158ad
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-25 22:34 . 2012-10-16 19:57 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-04-25 22:34 . 2011-04-24 22:43 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-02 10:34 . 2010-11-21 03:27 282744
w- c:\windows\system32\MpSigStub.exe
2013-03-10 22:33 . 2012-11-26 20:37 691568 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-10 22:33 . 2012-11-26 20:37 71024 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-05 17:14 . 2013-03-05 17:15 317440 ----a-w- c:\windows\system32\drivers\IntcDAud.sys
2013-03-05 17:14 . 2013-03-05 17:15 14848 ----a-w- c:\windows\system32\IntcDAuC.dll
2013-03-05 17:14 . 2013-03-05 17:15 98304 ----a-w- c:\windows\SysWow64\iglhcp32.dll
2013-03-05 17:14 . 2013-03-05 17:15 98304 ----a-w- c:\windows\system32\iglhcp64.dll
2013-03-05 17:14 . 2013-03-05 17:15 90112 ----a-w- c:\windows\system32\igfxCoIn_v2430.dll
2013-03-05 17:14 . 2013-03-05 17:15 867020 ----a-w- c:\windows\system32\igkrng575.bin
2013-03-05 17:14 . 2013-03-05 17:15 510232 ----a-w- c:\windows\system32\igfxsrvc.exe
2013-03-05 17:14 . 2013-03-05 17:15 378368 ----a-w- c:\windows\system32\igfxTMM.dll
2013-03-05 17:14 . 2013-03-05 17:15 376832 ----a-w- c:\windows\SysWow64\iglhsip32.dll
2013-03-05 17:14 . 2013-03-05 17:15 376832 ----a-w- c:\windows\system32\iglhsip64.dll
2013-03-05 17:14 . 2013-03-05 17:15 167704 ----a-w- c:\windows\system32\igfxtray.exe
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrtrk.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrsve.lrc
2013-03-05 17:14 . 2013-03-05 17:15 285696 ----a-w- c:\windows\system32\igfxrtha.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrsky.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrrus.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrrom.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrptg.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrplk.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrslv.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrptb.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrnor.lrc
2013-03-05 17:14 . 2010-08-25 20:04 62464 ----a-w- c:\windows\system32\igfxsrvc.dll
2013-03-05 17:14 . 2013-03-05 17:15 287232 ----a-w- c:\windows\system32\igfxrfra.lrc
2013-03-05 17:14 . 2013-03-05 17:15 287232 ----a-w- c:\windows\system32\igfxresn.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrnld.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrita.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrhrv.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrhun.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286208 ----a-w- c:\windows\system32\igfxrfin.lrc
2013-03-05 17:14 . 2013-03-05 17:15 285184 ----a-w- c:\windows\system32\igfxrheb.lrc
2013-03-05 17:14 . 2013-03-05 17:15 283648 ----a-w- c:\windows\system32\igfxrjpn.lrc
2013-03-05 17:14 . 2013-03-05 17:15 283136 ----a-w- c:\windows\system32\igfxrkor.lrc
2013-03-05 17:14 . 2013-03-05 17:15 285696 ----a-w- c:\windows\system32\igfxrenu.lrc
2013-03-05 17:14 . 2013-03-05 17:15 287232 ----a-w- c:\windows\system32\igfxrell.lrc
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrdeu.lrc
2013-03-05 17:14 . 2013-03-05 17:15 416024 ----a-w- c:\windows\system32\igfxpers.exe
2013-03-05 17:14 . 2013-03-05 17:15 375296 ----a-w- c:\windows\system32\igfxpph.dll
2013-03-05 17:14 . 2013-03-05 17:15 286720 ----a-w- c:\windows\system32\igfxrcsy.lrc
2013-03-05 17:14 . 2013-03-05 17:15 285696 ----a-w- c:\windows\system32\igfxrdan.lrc
2013-03-05 17:14 . 2013-03-05 17:15 285184 ----a-w- c:\windows\system32\igfxrara.lrc
2013-03-05 17:14 . 2013-03-05 17:15 282624 ----a-w- c:\windows\system32\igfxrcht.lrc
2013-03-05 17:14 . 2013-03-05 17:15 282624 ----a-w- c:\windows\system32\igfxrchs.lrc
2013-03-05 17:14 . 2013-03-05 17:15 239896 ----a-w- c:\windows\system32\igfxext.exe
2013-03-05 17:14 . 2010-08-25 20:03 9014784 ----a-w- c:\windows\system32\igfxress.dll
2013-03-05 17:14 . 2013-03-05 17:15 4096 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2013-03-05 17:14 . 2013-03-05 17:15 293888 ----a-w- c:\windows\SysWow64\igfxdv32.dll
2013-03-05 17:14 . 2013-03-05 17:15 28672 ----a-w- c:\windows\system32\igfxexps.dll
2013-03-05 17:14 . 2013-03-05 17:15 24576 ----a-w- c:\windows\SysWow64\igfxexps32.dll
2013-03-05 17:14 . 2013-03-05 17:15 142336 ----a-w- c:\windows\system32\igfxdo.dll
2013-03-05 17:14 . 2013-03-05 17:15 389632 ----a-w- c:\windows\system32\igfxdev.dll
2013-03-05 17:14 . 2013-03-05 17:15 126976 ----a-w- c:\windows\system32\igfxcpl.cpl
2013-03-05 17:14 . 2013-03-05 17:15 162816 ----a-w- c:\windows\SysWow64\igfxcmrt32.dll
2013-03-05 17:14 . 2013-03-05 17:15 140288 ----a-w- c:\windows\system32\igfxcmrt64.dll
2013-03-05 17:14 . 2013-03-05 17:15 105608 ----a-w- c:\windows\system32\igfcg575m.bin
2013-03-05 17:14 . 2013-03-05 17:15 6310912 ----a-w- c:\windows\SysWow64\igdumd32.dll
2013-03-05 17:14 . 2013-03-05 17:15 577024 ----a-w- c:\windows\SysWow64\igdumdx32.dll
2013-03-05 17:14 . 2013-03-05 17:15 12231584 ----a-w- c:\windows\system32\drivers\igdkmd64.sys
2013-03-05 17:14 . 2010-08-25 20:36 8296960 ----a-w- c:\windows\system32\igdumd64.dll
2013-03-05 17:14 . 2010-08-25 20:26 14591488 ----a-w- c:\windows\system32\igd10umd64.dll
2013-03-05 17:14 . 2010-08-25 20:23 12333056 ----a-w- c:\windows\SysWow64\igd10umd32.dll
2013-03-05 17:14 . 2013-03-05 17:15 18635776 ----a-w- c:\windows\system32\ig4icd64.dll
2013-03-05 17:14 . 2013-03-05 17:15 13899776 ----a-w- c:\windows\SysWow64\ig4icd32.dll
2013-03-05 17:14 . 2013-03-05 17:15 128204 ----a-w- c:\windows\system32\igcompkrng575.bin
2013-03-05 17:14 . 2013-03-05 17:15 94208 ----a-w- c:\windows\system32\IccLibDll_x64.dll
2013-03-05 17:14 . 2013-03-05 17:15 392472 ----a-w- c:\windows\system32\hkcmd.exe
2013-03-05 17:14 . 2010-08-25 20:03 110080 ----a-w- c:\windows\system32\hccutils.dll
2013-03-05 17:14 . 2013-03-05 17:15 4378392 ----a-w- c:\windows\system32\GfxUI.exe
2013-03-05 17:14 . 2013-03-05 17:15 179992 ----a-w- c:\windows\system32\difx64.exe
2013-03-05 17:14 . 2013-03-05 17:15 146432 ----a-w- c:\windows\system32\gfxSrvc.dll
2013-02-12 05:45 . 2013-03-13 09:27 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45 . 2013-03-13 09:27 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45 . 2013-03-13 09:27 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45 . 2013-03-13 09:27 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48 . 2013-03-13 09:27 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48 . 2013-03-13 09:27 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-02-12 04:12 . 2013-03-26 16:04 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2012-06-21 247768]
"Adobe CSx Manager"="c:\users\martin\AppData\Roaming\873997d3-3f3a-4807-a625-a0032ed6e158ad\dfaaaedead.exe" [2013-03-29 3072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe [2011-02-25 62184]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-02-15 52736]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-26 1255736]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-03-01 138400]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-03-01 76448]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-03-05 35200]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2010-12-28 1817088]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-02-01 1127448]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-06-21 92632]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-07-23 2320920]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-03-01 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-03-01 298656]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-03-01 28832]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-03-01 201376]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-03-01 55456]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-03-01 154272]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-03-01 280224]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-02-10 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2013-03-05 317440]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-02-15 335464]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-03-05 436840]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-30 23:45]
.
2013-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-30 23:45]
.
2013-04-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-963050305-668444556-3006111060-1000Core.job
- c:\users\martin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-25 14:00]
.
2013-04-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-963050305-668444556-3006111060-1000UA.job
- c:\users\martin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-25 14:00]
.
2013-04-25 c:\windows\Tasks\HPCeeScheduleFormartin.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
X64 Entries
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-11 6602856]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-01 615584]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-01 379552]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-03-05 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-03-05 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-03-05 416024]
.
Supplementary Scan
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-BsScanner
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
LOCKED REGISTRY KEYS
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c![:\](https://www.boards.ie/resources/emoji/confused.png ":\")
\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-04-25 23:51:07
ComboFix-quarantined-files.txt 2013-04-25 22:51
.
Pre-Run: 247,296,651,264 bytes free
Post-Run: 246,885,359,616 bytes free
.
- - End Of File - - C255E7B751F01D145551663B665BCCE30 -
Advertisement
-
Advertisement