[Resolved K] Welcome to NGINX

[kevinf80]

Yes drag to Gotcha, it is still Combofix, just renamed. I guess it is better to check if there are any doubts..

MSE is definitely adequate, I use it it myself. There is no need to uninstall it when we run tools such as CF, just turn of realtime protection.

Open MSE > select > settings > realtime protection > remove the tick and save changes. To re-enable just reverse...

Kevin

[TomG]

Here is step one

ComboFix 12-05-22.01 - Tom 05/22/2012   8:53.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3839.2610 [GMT -4:00]
Running from: c:\users\Tom\Desktop\Gotcha.exe.exe
Command switches used :: c:\users\Tom\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll . . . . Failed to delete
.
.
(((((((((((((((((((((((((   Files Created from 2012-04-22 to 2012-05-22  )))))))))))))))))))))))))))))))
.
.
2012-05-22 12:58 . 2012-05-22 12:58   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-05-22 12:47 . 2012-05-22 12:47   927800   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2AC7CA2F-3CEB-4F42-AA3F-9E200940CDF2}\gapaengine.dll
2012-05-22 12:47 . 2012-05-08 14:02   8955792   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9D82740-C8E2-4A5D-9CA2-B5BCEC3868DB}\mpengine.dll
2012-05-22 12:45 . 2012-05-22 12:45   --------   d-----w-   c:\program files (x86)\Microsoft Security Client
2012-05-22 12:45 . 2012-05-22 12:45   --------   d-----w-   c:\program files\Microsoft Security Client
2012-05-22 03:49 . 2012-05-22 03:49   163048   ----a-w-   c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-21 02:32 . 2012-05-22 01:49   --------   d--h--w-   c:\windows\msdownld.tmp
2012-05-21 02:01 . 2012-05-21 02:01   --------   d-----w-   c:\programdata\Evonsoft
2012-05-21 01:55 . 2012-05-21 01:54   955848   ----a-w-   c:\windows\system32\npDeployJava1.dll
2012-05-21 01:55 . 2012-05-21 01:54   839112   ----a-w-   c:\windows\system32\deployJava1.dll
2012-05-21 01:33 . 2012-05-21 01:33   --------   d-----w-   c:\program files (x86)\Common Files\Java
2012-05-21 01:33 . 2012-05-08 17:02   8955792   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{EDEF8EEB-B5DC-4678-A4A3-09B74E72495F}\mpengine.dll
2012-05-21 01:30 . 2012-05-21 01:30   772552   ----a-w-   c:\windows\SysWow64\npDeployJava1.dll
2012-05-16 19:19 . 2012-05-16 19:35   --------   d-----w-   c:\program files (x86)\Bucksbee Loyalty Plugin - 100815
2012-05-16 19:19 . 2012-05-16 19:36   --------   d-----w-   c:\programdata\Tarma Installer
2012-05-16 00:41 . 2012-05-16 00:41   --------   d-----w-   C:\_OTL
2012-05-11 23:51 . 2012-05-20 20:10   --------   d-----w-   c:\program files (x86)\Trend Micro
2012-05-11 21:37 . 2012-05-22 01:13   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-05-09 18:19 . 2012-05-09 18:19   --------   d-sh--w-   c:\windows\SysWow64\%APPDATA%
2012-05-09 11:52 . 2012-03-03 06:35   1544704   ----a-w-   c:\windows\system32\DWrite.dll
2012-05-09 11:52 . 2012-03-03 05:31   1077248   ----a-w-   c:\windows\SysWow64\DWrite.dll
2012-05-09 11:52 . 2012-03-31 06:05   5559664   ----a-w-   c:\windows\system32\ntoskrnl.exe
2012-05-09 11:52 . 2012-03-31 03:10   3146240   ----a-w-   c:\windows\system32\win32k.sys
2012-05-09 11:52 . 2012-03-31 04:39   3968368   ----a-w-   c:\windows\SysWow64\ntkrnlpa.exe
2012-05-09 11:52 . 2012-03-31 04:39   3913072   ----a-w-   c:\windows\SysWow64\ntoskrnl.exe
2012-05-09 11:46 . 2012-03-17 07:58   75120   ----a-w-   c:\windows\system32\drivers\partmgr.sys
2012-05-09 11:45 . 2012-03-30 11:35   1918320   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2012-05-09 11:45 . 2012-03-31 05:42   1732096   ----a-w-   c:\program files\Windows Journal\NBDoc.DLL
2012-05-09 11:45 . 2012-03-31 05:40   1367552   ----a-w-   c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 11:45 . 2012-03-31 04:29   936960   ----a-w-   c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 11:45 . 2012-03-31 05:40   1402880   ----a-w-   c:\program files\Windows Journal\JNWDRV.dll
2012-05-09 11:45 . 2012-03-31 05:40   1393664   ----a-w-   c:\program files\Windows Journal\JNTFiltr.dll
2012-05-06 20:47 . 2012-05-16 12:20   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2012-05-06 20:47 . 2012-05-16 12:20   --------   d-----w-   c:\program files (x86)\Spybot - Search & Destroy
2012-05-06 20:32 . 2011-04-05 21:35   94296   ----a-w-   c:\windows\system32\drivers\sbtis.sys
2012-05-06 20:32 . 2011-04-05 21:35   60504   ----a-w-   c:\windows\system32\drivers\sbhips.sys
2012-05-06 20:32 . 2011-04-05 21:35   253528   ----a-w-   c:\windows\system32\drivers\SbFw.sys
2012-05-06 20:32 . 2011-02-08 13:14   84568   ----a-w-   c:\windows\system32\drivers\SbFwIm.sys
2012-05-06 20:31 . 2012-05-06 20:31   --------   d-----w-   c:\users\Tom\AppData\Local\adawarebp
2012-05-02 19:53 . 2012-05-20 18:45   --------   d-----w-   c:\users\Tom\AppData\Local\ElevatedDiagnostics
2012-04-28 18:36 . 2012-04-28 18:36   --------   d-----w-   c:\users\Tom\AppData\Roaming\SumatraPDF
2012-04-28 18:36 . 2012-04-28 18:36   237   ----a-w-   C:\user.js
2012-04-28 18:36 . 2012-04-28 18:36   --------   d-----w-   c:\program files (x86)\PDFReader
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-21 01:30 . 2010-04-16 11:06   687560   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2012-03-21 00:44 . 2012-03-21 00:44   98688   ----a-w-   c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-21 00:44 . 2012-03-21 00:44   203888   ----a-w-   c:\windows\system32\drivers\MpFilter.sys
2012-03-01 06:46 . 2012-04-13 02:57   23408   ----a-w-   c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-13 02:57   220672   ----a-w-   c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-13 02:57   81408   ----a-w-   c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-13 02:57   5120   ----a-w-   c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-13 02:57   172544   ----a-w-   c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-13 02:57   159232   ----a-w-   c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-13 02:57   5120   ----a-w-   c:\windows\SysWow64\wmi.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2012-05-22_01.32.22   )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-22 01:49 . 2012-05-22 01:49   76800              c:\windows\SysWOW64\SetIEInstalledDate.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   74752              c:\windows\SysWOW64\RegisterIEPKEYs.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   54272              c:\windows\SysWOW64\pngfilt.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   48640              c:\windows\SysWOW64\mshtmler.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   72704              c:\windows\SysWOW64\mshtmled.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   11776              c:\windows\SysWOW64\mshta.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   10752              c:\windows\SysWOW64\msfeedssync.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   41472              c:\windows\SysWOW64\msfeedsbs.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   66048              c:\windows\SysWOW64\migration\WininetPlugin.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   23552              c:\windows\SysWOW64\licmgr10.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   65024              c:\windows\SysWOW64\jsproxy.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   78848              c:\windows\SysWOW64\inseng.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   35840              c:\windows\SysWOW64\imgutil.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   86528              c:\windows\SysWOW64\iesysprep.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   74752              c:\windows\SysWOW64\iesetup.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   31744              c:\windows\SysWOW64\iernonce.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   74240              c:\windows\SysWOW64\ie4uinit.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   66048              c:\windows\SysWOW64\icardie.dll
+ 2009-07-14 04:54 . 2012-05-22 11:14   32768              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-05-21 10:36   32768              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-05-22 11:14   49152              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-05-21 10:36   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-05-22 11:14   16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-20 03:18 . 2012-05-22 01:53   55528              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-05-22 11:14   44146              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-07 12:32 . 2012-05-22 11:14   18460              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3592377932-3001643496-2930144275-1001_UserData.bin
+ 2012-05-22 01:49 . 2012-05-22 01:49   91648              c:\windows\system32\SetIEInstalledDate.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   89088              c:\windows\system32\RegisterIEPKEYs.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   65024              c:\windows\system32\pngfilt.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   48640              c:\windows\system32\mshtmler.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   96256              c:\windows\system32\mshtmled.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   12288              c:\windows\system32\mshta.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   10752              c:\windows\system32\msfeedssync.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   55296              c:\windows\system32\msfeedsbs.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   86528              c:\windows\system32\migration\WininetPlugin.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   30720              c:\windows\system32\licmgr10.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   85504              c:\windows\system32\jsproxy.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   49664              c:\windows\system32\imgutil.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   85504              c:\windows\system32\iesetup.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   39936              c:\windows\system32\iernonce.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   89088              c:\windows\system32\ie4uinit.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   82432              c:\windows\system32\icardie.dll
+ 2010-03-07 01:19 . 2012-05-22 01:54   16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-07 01:19 . 2012-05-21 11:08   16384              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2012-05-21 11:08 . 2012-05-21 11:08   32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2012-05-21 11:08 . 2012-05-22 01:54   32768              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-05-21 11:08   16384              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-05-22 01:54   16384              c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-07 12:33 . 2012-05-21 10:35   16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-07 12:33 . 2012-05-22 01:33   16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:46 . 2012-05-22 11:19   91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2009-07-14 04:46 . 2012-05-21 01:14   91888              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-03-07 12:33 . 2012-05-22 01:33   32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-07 12:33 . 2012-05-21 10:35   32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-07 12:33 . 2012-05-22 01:33   16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-07 12:33 . 2012-05-21 10:35   16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-07 12:33 . 2012-05-22 01:01   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-07 12:33 . 2012-05-22 12:59   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-07 12:33 . 2012-05-22 01:33   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-07 12:33 . 2012-05-22 01:01   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2012-05-22 12:59 . 2012-05-22 12:59   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-05-22 01:32 . 2012-05-22 01:32   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-05-22 01:32 . 2012-05-22 01:32   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-05-22 12:59 . 2012-05-22 12:59   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-05-22 01:32 . 2009-10-07 05:46   131608              c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2012-05-22 12:59 . 2009-10-07 05:46   131608              c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2012-05-22 12:59 . 2009-10-07 05:47   109080              c:\windows\Temp\logishrd\LVPrcInj01.dll
- 2012-05-22 01:32 . 2009-10-07 05:47   109080              c:\windows\Temp\logishrd\LVPrcInj01.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   152064              c:\windows\SysWOW64\wextract.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   203776              c:\windows\SysWOW64\webcheck.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   420864              c:\windows\SysWOW64\vbscript.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   231936              c:\windows\SysWOW64\url.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   123392              c:\windows\SysWOW64\occache.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   162304              c:\windows\SysWOW64\msrating.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   161792              c:\windows\SysWOW64\msls31.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   580608              c:\windows\SysWOW64\msfeeds.dll
- 2012-01-11 11:40 . 2011-10-14 04:24   716800              c:\windows\SysWOW64\jscript.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   716800              c:\windows\SysWOW64\jscript.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   150528              c:\windows\SysWOW64\iexpress.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   142848              c:\windows\SysWOW64\ieUnatt.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   176640              c:\windows\SysWOW64\ieui.dll
- 2012-04-11 21:03 . 2012-02-28 05:34   176640              c:\windows\SysWOW64\ieui.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   118784              c:\windows\SysWOW64\iepeers.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   353584              c:\windows\SysWOW64\iedkcs32.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   434176              c:\windows\SysWOW64\ieapfltr.dll
- 2009-07-13 23:42 . 2009-07-14 01:05   163840              c:\windows\SysWOW64\ieakui.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   163840              c:\windows\SysWOW64\ieakui.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   227840              c:\windows\SysWOW64\ieaksie.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   130560              c:\windows\SysWOW64\ieakeng.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   110592              c:\windows\SysWOW64\IEAdvpack.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   223232              c:\windows\SysWOW64\dxtrans.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   353792              c:\windows\SysWOW64\dxtmsft.dll
- 2010-03-07 15:18 . 2012-05-21 10:36   262144              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-03-07 15:18 . 2012-05-22 11:14   262144              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-05-22 01:49 . 2012-05-22 01:49   101888              c:\windows\SysWOW64\admparse.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   160256              c:\windows\system32\wextract.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   249344              c:\windows\system32\webcheck.dll
+ 2010-03-08 01:32 . 2012-05-22 10:51   292362              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2012-05-22 01:49 . 2012-05-22 01:49   603648              c:\windows\system32\vbscript.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   237056              c:\windows\system32\url.dll
+ 2009-07-14 02:36 . 2012-05-22 12:45   626290              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-05-22 12:45   107566              c:\windows\system32\perfc009.dat
+ 2012-05-22 01:49 . 2012-05-22 01:49   149504              c:\windows\system32\occache.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   197120              c:\windows\system32\msrating.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   222208              c:\windows\system32\msls31.dll
- 2009-07-13 23:39 . 2009-07-14 01:41   222208              c:\windows\system32\msls31.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   697344              c:\windows\system32\msfeeds.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   818688              c:\windows\system32\jscript.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   103936              c:\windows\system32\inseng.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   165888              c:\windows\system32\iexpress.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   173056              c:\windows\system32\ieUnatt.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   248320              c:\windows\system32\ieui.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   111616              c:\windows\system32\iesysprep.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   145920              c:\windows\system32\iepeers.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   403248              c:\windows\system32\iedkcs32.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   534528              c:\windows\system32\ieapfltr.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   163840              c:\windows\system32\ieakui.dll
- 2009-07-13 23:58 . 2009-07-14 01:27   163840              c:\windows\system32\ieakui.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   267776              c:\windows\system32\ieaksie.dll
- 2009-07-13 23:58 . 2009-07-14 01:41   267776              c:\windows\system32\ieaksie.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   160256              c:\windows\system32\ieakeng.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   135168              c:\windows\system32\IEAdvpack.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   282112              c:\windows\system32\dxtrans.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   452608              c:\windows\system32\dxtmsft.dll
+ 2009-07-14 05:12 . 2012-05-22 01:54   245760              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:12 . 2012-05-16 18:32   245760              c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2012-05-22 01:49 . 2012-05-22 01:49   114176              c:\windows\system32\admparse.dll
+ 2009-07-14 05:01 . 2012-05-22 12:58   423204              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-05-22 01:31   423204              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-05-21 02:10 . 2012-05-22 12:45   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\SCEP.exe
- 2012-05-21 02:10 . 2012-05-21 02:10   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\SCEP.exe
+ 2012-05-22 12:45 . 2012-05-22 12:45   123352              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\MSE.exe
- 2012-05-21 02:10 . 2012-05-21 02:10   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\INTUNE.exe
+ 2012-05-21 02:10 . 2012-05-22 12:45   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\INTUNE.exe
- 2012-05-21 02:10 . 2012-05-21 02:10   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\FEP.exe
+ 2012-05-21 02:10 . 2012-05-22 12:45   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\FEP.exe
- 2012-05-21 02:10 . 2012-05-21 02:10   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\EPP.exe
+ 2012-05-21 02:10 . 2012-05-22 12:45   109563              c:\windows\Installer\{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}\EPP.exe
+ 2012-05-22 01:49 . 2012-05-22 01:49   1127424              c:\windows\SysWOW64\wininet.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   1103360              c:\windows\SysWOW64\urlmon.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   1798656              c:\windows\SysWOW64\jscript9.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   1792000              c:\windows\SysWOW64\iertutil.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   9705472              c:\windows\SysWOW64\ieframe.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   3695416              c:\windows\SysWOW64\ieapfltr.dat
+ 2012-05-22 01:49 . 2012-05-22 01:49   1390080              c:\windows\system32\wininet.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   1345536              c:\windows\system32\urlmon.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   2308096              c:\windows\system32\jscript9.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   2144256              c:\windows\system32\iertutil.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   3695416              c:\windows\system32\ieapfltr.dat
+ 2009-07-14 04:45 . 2012-05-22 01:53   7114451              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:45 . 2012-05-21 01:00   7114451              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2012-05-02 19:53 . 2012-05-22 01:31   3619284              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3592377932-3001643496-2930144275-1001-12288.dat
+ 2012-05-02 19:53 . 2012-05-22 12:58   3619284              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3592377932-3001643496-2930144275-1001-12288.dat
+ 2012-03-26 23:21 . 2012-03-26 23:21   7622656              c:\windows\Installer\55c0a5.msi
+ 2012-05-22 01:49 . 2012-05-22 01:49   12282368              c:\windows\SysWOW64\mshtml.dll
+ 2009-07-14 02:34 . 2012-05-22 01:50   10747904              c:\windows\system32\SMI\Store\Machine\schema.dat
- 2009-07-14 02:34 . 2012-05-09 23:17   10747904              c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2012-05-22 01:49 . 2012-05-22 01:49   17790464              c:\windows\system32\mshtml.dll
+ 2012-05-22 01:49 . 2012-05-22 01:49   10887168              c:\windows\system32\ieframe.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-04-20 26192680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-11-11 273528]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SessionLauncher;SessionLauncher;c:\users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys

R3 LVUVC64;Logitech Webcam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys

R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys

S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys

S1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys

S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys

S3 SBFWIMCLMP;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys

.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: aol.com\free
Trusted Zone: freewebs.com\link.members
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Tom\AppData\Roaming\Mozilla\Firefox\Profiles\spjqucz8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files (x86)\Skype\Plugin Manager\skypePM.exe
c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Completion time: 2012-05-22  09:02:37 - machine was rebooted
ComboFix-quarantined-files.txt  2012-05-22 13:02
ComboFix2.txt  2012-05-22 01:35
ComboFix3.txt  2010-01-06 21:01
.
Pre-Run: 172,404,256,768 bytes free
Post-Run: 172,340,690,944 bytes free
.
- - End Of File - - 2B0569A840D01277D4C0964ADB616C6C

[kevinf80]

Thanks, complete the rest when you`re ready...

[TomG]

ESET Scan found nothing

The APPRemover found nothing

MSE successful  No scan issues

I do not know what UAC is..... Do you want me to turn it on?  How?

Thanks

[kevinf80]

UAC is a safety feature of Windows, if you try to make changes that need Admin rights you will get an alert.

Read here:

http://windows.microsoft.com/en-us/windows-vista/Turn-User-Account-Control-on-or-off


Good to see the logs are clean, I`m still concerned about those drivers that appear to be from Sunbelt. As you have no recollection of that software being installed update one of of them for analysis....

Do the following :-

Upload a File to Virustotal
Please visit
Virustotal

• Click the Browse... button
  
• Navigate to the file c:\windows\system32\drivers\SBREdrv.sys or just copy/paste it in.
  
• Click the Scan it tab
  
• If you get a message saying File has already been analyzed: click Reanalyze file now
• Copy and paste the results back here please.
• Repeat the above steps for the following file

c:\windows\TEMP\logishrd\LVPrcInj01.dll

Let me see the results on those two files, also give an update on current issues/concerns....

thanks...

[TomG]

The first one was no longer on my computer.

VirusTotal
SHA256:    136f1e4e8d8845e3242800c166b6e708ae0d62e2b18822b0e5adabf628571960
File name:    LVPrcInj01.dll
Detection ratio:    0 / 42
Analysis date:    2012-05-24 22:54:34 UTC ( 0 minutes ago )
0
0
More details
Antivirus    Result    Update
AhnLab-V3    -    20120524
AntiVir    -    20120524
Antiy-AVL    -    20120524
Avast    -    20120525
AVG    -    20120524
BitDefender    -    20120524
ByteHero    -    20120522
CAT-QuickHeal    -    20120524
ClamAV    -    20120524
Commtouch    -    20120525
Comodo    -    20120524
DrWeb    -    20120525
Emsisoft    -    20120525
eSafe    -    20120524
F-Prot    -    20120524
F-Secure    -    20120524
Fortinet    -    20120524
GData    -    20120525
Ikarus    -    20120524
Jiangmin    -    20120524
K7AntiVirus    -    20120524
Kaspersky    -    20120525
McAfee    -    20120525
McAfee-GW-Edition    -    20120524
Microsoft    -    20120524
NOD32    -    20120524
Norman    -    20120523
nProtect    -    20120524
Panda    -    20120524
PCTools    -    20120522
Rising    -    20120524
Sophos    -    20120524
SUPERAntiSpyware    -    20120524
Symantec    -    20120525
TheHacker    -    20120524
TotalDefense    -    20120524
TrendMicro    -    20120525
TrendMicro-HouseCall    -    20120524
VBA32    -    20120524
VIPRE    -    20120524
ViRobot    -    20120524
VirusBuster    -    20120524

    Comments
    Votes
    Additional information

No comments





SHA256:    136f1e4e8d8845e3242800c166b6e708ae0d62e2b18822b0e5adabf628571960
SHA1:    94fafcf7721d930dbdd8ba9acf54a6c6fc6497ed
MD5:    a25a46e0813b36797d7f31234764e17a
File size:    106.5 KB ( 109080 bytes )
File name:    LVPrcInj01.dll
File type:    Win32 DLL
Detection ratio:    0 / 42
Analysis date:    2012-05-24 22:54:34 UTC ( 0 minutes ago

[kevinf80]

You give no update on current issues/concerns as requested so I assum you have none? Continue as follows:-

Step 1

Remove Combofix now that we're done with it

• Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
• Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
  
  
  
• Please follow the prompts to uninstall Combofix.
• You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

The above procedure will delete the following:

• ComboFix and its associated files and folders.
• VundoFix backups, if present
• The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

It is very important that you get a successful uninstall because of the extra functions done at the same time, let me know if this does not happen.

Step 2

Remove ESET online scanner:

• Click Start, type Uninstall a Program into the Search programs and files box, and then press ENTER.
  
• Click to select ESET Online Scanner from the listing of installed products, and then click Uninstall/Change from the bar that displays the available tasks. Uninstall ESETonline Scanner, only re-boot if prompted.
  

Step 3

• Download OTC by OldTimer and save it to your desktop. Alternative mirror
  
• Double click icon to start the program.
  If you are using Vista or Windows 7, please right-click and choose run as administrator
  
• Then Click the big button.
  
• You will get a prompt saying "Begining Cleanup Process". Please select Yes.
  
• Restart your computer when prompted.
• This will remove tools we have used and itself.

Any tools/logs remaining on the Desktop can be deleted. Such as:

aswMBR plus logs and associate files
RogueKiller plus logs and associate files

Step 4

Go here http://www.filehippo.com/updatechecker/ and run FileHippo Update Checker, update all applications as suggested by the Checker. Ignore any suggested Beta updates..

Step 5

Download TFC  to your desktop, from either of the following links
 Link 1
 Link 2

• Save any open work. TFC will close all open application windows.
• Double-click TFC.exe to run the program. Vista or Windows 7 users right click and select “Run as Administartor”
• If prompted, click "Yes" to reboot.

TFC will automatically close any open programs, including your Desktop. Let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds.  TFC may re-boot your system, if not Re-boot it yourself to  complete cleaning process <---- Very Important

Keep TFC it is an excellent utility to keep your system optimized, it empties all user temp folders, Java cache etc etc.  Always remember to re-boot after a run, even if not prompted

Let me know if those steps complete OK, also if any remaining issues or concerns....

Thanks,

Kevin

[TomG]

Kevin,

Actually, I got so involved in the process, I have not used the computer much.  It is still painfully slow at times.  Not seeing the NGINX message any more.  But many times I will select something and it will take 5 seconds or longer to even see anything change on the screen.  The other computers in the house all are significantly faster.  Do you want me to proceed with the current steps or would you like to go in another direction first?

Thanks for all of your help!

Tom

[kevinf80]

Scans are not showing any malware, clean up then I want to do a clean boot. Let me know when all of the tools are removed...

[TomG]

I will do this tonight.  My DSL modem went down on Friday

[kevinf80]

Hiya Tom,

OK, clean up tools when you`re ready... When you`ve completed that go here http://support.microsoft.com/kb/331796 and follow the instructions to do a clean boot of your system. Let me know if that makes any difference...

Kevin

[kevinf80]

Due to the lack of feedback this topic is closed. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[TomG]

Hi Kevin,

I am sorry for the lack of feedback.  I have had some personal issues pop up.  It looks like everything is working better.  But to be truthful, I have barely used the PC over the last couple of weeks.

Thank you for your help.

Tom

[kevinf80]

Hiya Tom,

I`ll re-open thread if you want, use your system freely and see how it responds. If all is OK we can close out, if not we`ll have another look.

Did you try a clean boot?

Thread re-opened, it will auto close after 11 days. If you need more time just let me know..

Thanks,

Kevin..

[TomG]

I did the clean boot.  I should have some time soon.

Thanks

Tom