wyodlr

October 20, 2013

Got it done .So far it looks good. I'll let you know in a couple days

Thanks

David

October 20, 2013

the one you questioned was the eset log

October 20, 2013

ComboFix 13-10-19.02 - Owner 10/20/2013 12:57:50.1.2 - x86

MicrosoftÂ® Windows Vistaâ„¢ Business 6.0.6002.2.1252.1.1033.18.3061.1215 [GMT -6:00]

Running from: c:\users\Owner\Downloads\ComboFix.exe

AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\data

c:\data\default\us_sres.data

C:\END

c:\programdata\ntuser.dat

c:\users\Owner\AppData\Roaming\SearchProtect

c:\windows\desktop

c:\windows\desktop\ROAD TRIPS.lnk

c:\windows\system32\Cache

c:\windows\system32\Cache\06f72eaedf1770ec.fb

c:\windows\system32\Cache\1cf59a059cb2885c.fb

c:\windows\system32\Cache\1f46af2525172b4f.fb

c:\windows\system32\Cache\26c630d098e22dd5.fb

c:\windows\system32\Cache\272512937d9e61a4.fb

c:\windows\system32\Cache\287204568329e189.fb

c:\windows\system32\Cache\28bc8f716fd76a47.fb

c:\windows\system32\Cache\2c53092c95605355.fb

c:\windows\system32\Cache\31a0997e9a5b5eb3.fb

c:\windows\system32\Cache\32c84fe32bb74d60.fb

c:\windows\system32\Cache\3917078cb68ec657.fb

c:\windows\system32\Cache\590ba23ce359fd0c.fb

c:\windows\system32\Cache\610289e025a3ee9a.fb

c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb

c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb

c:\windows\system32\Cache\6d03dad1035885d3.fb

c:\windows\system32\Cache\7377d9d9140c90a3.fb

c:\windows\system32\Cache\74857a87930bf46d.fb

c:\windows\system32\Cache\95f567698be8a182.fb

c:\windows\system32\Cache\9623a552aa2b10dc.fb

c:\windows\system32\Cache\a42664768109be55.fb

c:\windows\system32\Cache\a8556537add6dfc5.fb

c:\windows\system32\Cache\ad10a52aff5e038d.fb

c:\windows\system32\Cache\aef0e377a73d0d0e.fb

c:\windows\system32\Cache\c1fa887b03019701.fb

c:\windows\system32\Cache\c4d28dca2e7648be.fb

c:\windows\system32\Cache\d201ef9910cd39de.fb

c:\windows\system32\Cache\d2e94710a5708128.fb

c:\windows\system32\Cache\d79b9dfe81484ec4.fb

c:\windows\system32\Cache\f998975c9cc711ee.fb

c:\windows\wininit.ini

.

((((((((((((((((((((((((( Files Created from 2013-09-20 to 2013-10-20 )))))))))))))))))))))))))))))))

.

2013-10-20 19:09 . 2013-10-20 19:09 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-10-20 17:05 . 2013-10-20 17:05 -------- d-----w- c:\program files\ESET

2013-10-20 13:19 . 2013-10-20 13:19 23830 ----a-w- c:\windows\cscmondump.bin

2013-10-19 17:10 . 2013-10-20 01:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-10-19 17:10 . 2013-04-04 20:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-10-19 16:02 . 2013-10-20 02:49 -------- d-----w- c:\programdata\Conduit

2013-10-19 16:02 . 2013-10-19 16:02 -------- d-----w- c:\users\Owner\AppData\Local\Conduit

2013-10-19 16:00 . 2013-10-19 16:01 -------- d-----w- c:\users\Owner\AppData\Local\CRE

2013-10-19 16:00 . 2013-10-19 16:02 -------- d-----w- c:\program files\Conduit

2013-10-19 16:00 . 2013-10-20 00:37 -------- d-----w- c:\program files\SearchProtect

2013-10-19 15:57 . 2013-10-20 00:27 -------- d-----w- c:\programdata\ZalmanInstaller_52331

2013-10-19 15:56 . 2013-10-20 00:27 -------- d-----w- c:\program files\Browsersafeguard

2013-10-19 15:49 . 2013-10-20 13:28 -------- d-----w- c:\users\Owner\AppData\Local\FileTypeAssistant

2013-10-19 14:26 . 2013-10-19 14:26 -------- d-----w- c:\windows\ERUNT

2013-10-19 13:40 . 2013-10-19 14:17 -------- d-----w- C:\AdwCleaner

2013-10-17 17:40 . 2013-10-17 17:40 -------- d-----w- C:\N360_BACKUP

2013-10-09 06:24 . 2013-08-27 01:28 1069056 ----a-w- c:\windows\system32\DWrite.dll

2013-10-09 06:24 . 2013-08-27 01:28 798208 ----a-w- c:\windows\system32\FntCache.dll

2013-10-09 06:24 . 2013-08-27 02:47 219648 ----a-w- c:\windows\system32\d3d10_1core.dll

2013-10-09 06:24 . 2013-08-27 02:47 189952 ----a-w- c:\windows\system32\d3d10core.dll

2013-10-09 06:24 . 2013-08-27 02:47 1029120 ----a-w- c:\windows\system32\d3d10.dll

2013-10-09 06:24 . 2013-08-27 01:52 1172480 ----a-w- c:\windows\system32\d3d10warp.dll

2013-10-09 06:24 . 2013-08-27 01:50 486400 ----a-w- c:\windows\system32\d3d10level9.dll

2013-10-09 06:24 . 2013-08-27 01:32 683008 ----a-w- c:\windows\system32\d2d1.dll

2013-10-09 06:24 . 2013-08-27 02:47 160768 ----a-w- c:\windows\system32\d3d10_1.dll

2013-09-29 05:57 . 2013-10-19 02:46 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\FileTypeAssistant

2013-09-29 00:34 . 2013-10-19 02:46 -------- d-----w- c:\program files\File Type Assistant

2013-09-26 18:00 . 2013-09-26 18:00 208760 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-10-09 04:56 . 2012-04-04 14:39 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-10-09 04:56 . 2011-06-29 12:10 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-09-11 05:18 . 2013-09-11 05:18 97008 ----a-w- c:\windows\system32\drivers\RapportKELL.sys

2013-09-09 15:24 . 2013-09-09 15:24 1700352 ----a-w- c:\windows\system32\gdiplus.dll

2013-08-02 04:09 . 2013-08-27 20:18 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL

2013-01-20 02:50 . 2013-01-20 02:50 262552 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-13 98304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-13 106496]

"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-13 81920]

"MFPMonitor"="c:\windows\twain_32\DELL\MFP1125\Monitor\Stsmon.exe" [2007-08-08 2002944]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE -b -l [2000-1-21 65588]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

bthsvcs REG_MULTI_SZ BthServ

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-10-19 13:26 1185744 ----a-w- c:\program files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-10-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 04:56]

.

2013-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-22 01:52]

.

2013-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-22 01:52]

.

------- Supplementary Scan -------

.

TCP: DhcpNameServer = 192.168.0.1

FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\rdndk0q9.default\

FF - prefs.js: browser.search.selectedEngine - KeyBar 1.12 Customized Web Search

FF - ExtSQL: !HIDDEN! 2011-01-05 10:50; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - ExtSQL: !HIDDEN! 2012-05-04 20:31; [email protected]; c:\users\Owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[email protected]

FF - user.js: extensions.autoDisableScopes - 0

FF - user.js: extensions.shownSelectionUI - true

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{0134af61-7a0c-4649-aeca-90d776060cb3} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

SafeBoot-WudfPf

SafeBoot-WudfRd

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-10-20 13:10

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2013-10-20 13:15:05

ComboFix-quarantined-files.txt 2013-10-20 19:14

.

Pre-Run: 26,655,383,552 bytes free

Post-Run: 26,515,025,920 bytes free

.

- - End Of File - - 49044F13D18CF1C141EF2A821D20FA13

5C616939100B85E558DA92B899A0FC36

October 20, 2013

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\genfix.exe.vir Win32/Toolbar.Zugo.D application

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\Reactivate.exe.vir a variant of Win32/Toolbar.Zugo application

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\search_protect.exe.vir Win32/Toolbar.Zugo.D application

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\Toolbar32.dll.vir a variant of Win32/Toolbar.Zugo application

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\ToolbarBroker.exe.vir a variant of Win32/Toolbar.Zugo application

C:\AdwCleaner\Quarantine\C\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe.vir a variant of Win32/Toolbar.Zugo application

C:\AdwCleaner\Quarantine\C\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\rdndk0q9.default\Extensions\[email protected]\content\overlay.js.vir Win32/Adware.Yontoo application

C:\Program Files\Mozilla Firefox\nsprotector.js Win32/Conduit.SearchProtect.A application

C:\Program Files\Uninstall Information\ib_uninst_342\uninstall.exe a variant of Win32/InstallBrain.H application

C:\Program Files\Uninstall Information\ib_uninst_343\uninstall.exe a variant of Win32/InstallBrain.H application

C:\Program Files\Uninstall Information\ib_uninst_383\uninstall.exe a variant of Win32/InstallBrain.H application

C:\Program Files\Uninstall Information\ib_uninst_514\uninstall.exe a variant of Win32/InstallBrain.H application

C:\Program Files\Uninstall Information\ib_uninst_569\uninstall.exe a variant of Win32/InstallBrain.H application

C:\Users\Owner\AppData\Local\Temp\YontooLayers\background.html JS/Adware.Yontoo.B application

C:\Users\Owner\Downloads\ARO2013_tbt.exe a variant of Win32/Bundled.Toolbar.Ask.D application

C:\Users\Owner\Downloads\cbsidlm-tr1_6-Photo_Story_3_for_Windows-10339154.exe Win32/DownloadAdmin.G application

C:\Users\Owner\Downloads\h2testw_1_4_mediaget.exe a variant of Win32/MediaGet application

C:\Users\Owner\Downloads\setup.exe a variant of Win32/AirAdInstaller.A application

C:\Users\Owner\Downloads\vlcmediaplayer-setup.exe multiple threats

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2F5ORKB1\genfix-e[1] Win32/Toolbar.Zugo.D application

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2F5ORKB1\genfix2-a[1] Win32/Toolbar.Zugo.D application

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2F5ORKB1\updater-startnow-200-2.5-g[1].exe a variant of Win32/Toolbar.Zugo application

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G7ZBYCJ\search-update-d[1] Win32/Toolbar.Zugo.D application

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RRJYAK5X\search-update-d[1] Win32/Toolbar.Zugo.D application

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UHIBYNU1\genfix-e[1] Win32/Toolbar.Zugo.D application

October 20, 2013

I run Norton 360. I'll finish this up in a couple hours when I get home

October 20, 2013

All processes killed

========== OTL ==========

No active process named OptProCrash.exe was found!

Service SYMNDISV stopped successfully!

Service SYMNDISV deleted successfully!

File C:\Windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS not found.

Service SYMFW stopped successfully!

Service SYMFW deleted successfully!

File C:\Windows\System32\Drivers\N360\0308000.029\SYMFW.SYS not found.

Service NwlnkFwd stopped successfully!

Service NwlnkFwd deleted successfully!

File system32\DRIVERS\nwlnkfwd.sys not found.

Service NwlnkFlt stopped successfully!

Service NwlnkFlt deleted successfully!

File system32\DRIVERS\nwlnkflt.sys not found.

Error: No service named mbr was found to stop!

Service\Driver key mbr not found.

File C:\Users\Owner\AppData\Local\Temp\mbr.sys not found.

Service IpInIp stopped successfully!

Service IpInIp deleted successfully!

File system32\DRIVERS\ipinip.sys not found.

Service blbdrive stopped successfully!

Service blbdrive deleted successfully!

File C:\Windows\system32\drivers\blbdrive.sys not found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2381E4B7-5C04-459E-9D46-2F9AC1608B66}\ deleted successfully.