My computer started running slow so I did a malwarebytes scan and a bunch of things came up reading PUP.mywebsearch. So I deleted them and ran another scan and it came up empty. My computer now runs slow when trying to connect to some websites. I ran combofix and all it did was scan and give me a log. Here is my log.
ComboFix 12-08-08.01 - CHRIS 08/08/2012 13:14:31.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1983.1091 [GMT -5:00]
Running from: c:\users\CHRIS\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-08 to 2012-08-08 )))))))))))))))))))))))))))))))
.
.
2012-08-08 18:20 . 2012-08-08 18:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-08 17:40 . 2012-08-08 17:40 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\MpKsl6795ffdb.sys
2012-08-08 17:40 . 2012-08-08 17:40 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\offreg.dll
2012-08-08 16:19 . 2012-08-08 16:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-08-08 16:19 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-08 15:39 . 2012-06-29 06:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\mpengine.dll
2012-08-08 15:12 . 2012-08-08 15:12 -------- d-----w- c:\users\CHRIS\AppData\Roaming\Malwarebytes
2012-08-08 15:11 . 2012-08-08 15:11 -------- d-----w- c:\programdata\Malwarebytes
2012-08-08 14:49 . 2012-08-08 14:49 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-08 14:49 . 2012-08-08 14:49 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-08-08 05:34 . 2012-08-08 05:34 -------- d-----w- c:\program files\MyScrapNook_12
2012-08-08 05:28 . 2012-08-08 05:28 -------- d-----w- c:\users\CHRIS\Adobe Photoshop Elements 10
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\users\CHRIS\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\program files\Adobe Download Assistant
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-08-07 15:34 . 2012-06-29 06:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-05 00:25 . 2012-08-05 00:25 -------- d-----w- c:\windows\Sun
2012-08-03 08:02 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-08-03 03:11 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-08-03 03:11 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-08-03 03:11 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-08-03 03:11 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-08-03 03:11 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-08-03 03:11 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-08-03 03:11 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-08-03 03:11 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-08-03 03:11 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-08-03 02:50 . 2012-03-18 14:02 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-08-03 02:50 . 2012-03-18 14:02 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{50CF74A8-1F06-4D39-8E7B-C5D5E8EB0806}\gapaengine.dll
2012-08-02 18:48 . 2012-08-02 18:48 -------- d-----w- c:\users\CHRIS\AppData\Local\Macromedia
2012-08-02 03:26 . 2012-08-08 15:27 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-08-02 03:26 . 2012-08-08 14:49 157608 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-08-02 03:26 . 2012-08-08 14:49 113120 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-02 18:39 . 2012-04-03 11:29 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-02 18:39 . 2012-04-03 11:29 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-08 14:49 . 2012-04-06 08:11 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 21:31 1514152 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-04-03 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 MpKsl6795ffdb;MpKsl6795ffdb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\MpKsl6795ffdb.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL6795FFDB
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 18:39]
.
2012-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-28 08:22]
.
2012-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-28 08:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 97.64.183.164 97.64.209.37
FF - ProfilePath - c:\users\CHRIS\AppData\Roaming\Mozilla\Firefox\Profiles\92ln5cay.default\
.
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7601 Disk: WDC_WD25 rev.10.0 -> Harddisk0\DR0 ->
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll
1 ntkrnlpa!IofCallDriver[0x82A4255A] -> \Device\Harddisk0\DR0[0x85AD8030]
3 CLASSPNP[0x8899359E] -> ntkrnlpa!IofCallDriver[0x82A4255A] -> [0x84C39F08]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
detected disk devices:
\Device\00000056 -> \??\SCSI#Disk&Ven_WDC_WD25&Prod_00JS-00NCB1#4&6727837&0&010100#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user & kernel MBR OK
sectors 488397166 (+7): user != kernel
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-08 13:25:38
ComboFix-quarantined-files.txt 2012-08-08 18:25
.
Pre-Run: 211,321,372,672 bytes free
Post-Run: 212,868,751,360 bytes free
.
- - End Of File - - 8E8DC837ACBD3EA4F84CD1A69FC347D7
ComboFix 12-08-08.01 - CHRIS 08/08/2012 13:14:31.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1983.1091 [GMT -5:00]
Running from: c:\users\CHRIS\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-08 to 2012-08-08 )))))))))))))))))))))))))))))))
.
.
2012-08-08 18:20 . 2012-08-08 18:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-08 17:40 . 2012-08-08 17:40 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\MpKsl6795ffdb.sys
2012-08-08 17:40 . 2012-08-08 17:40 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\offreg.dll
2012-08-08 16:19 . 2012-08-08 16:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-08-08 16:19 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-08 15:39 . 2012-06-29 06:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\mpengine.dll
2012-08-08 15:12 . 2012-08-08 15:12 -------- d-----w- c:\users\CHRIS\AppData\Roaming\Malwarebytes
2012-08-08 15:11 . 2012-08-08 15:11 -------- d-----w- c:\programdata\Malwarebytes
2012-08-08 14:49 . 2012-08-08 14:49 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-08 14:49 . 2012-08-08 14:49 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-08-08 05:34 . 2012-08-08 05:34 -------- d-----w- c:\program files\MyScrapNook_12
2012-08-08 05:28 . 2012-08-08 05:28 -------- d-----w- c:\users\CHRIS\Adobe Photoshop Elements 10
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\users\CHRIS\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\program files\Adobe Download Assistant
2012-08-08 05:27 . 2012-08-08 05:27 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-08-07 15:34 . 2012-06-29 06:44 6891424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-08-05 00:25 . 2012-08-05 00:25 -------- d-----w- c:\windows\Sun
2012-08-03 08:02 . 2012-06-12 02:40 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-08-03 03:11 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-08-03 03:11 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-08-03 03:11 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-08-03 03:11 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-08-03 03:11 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-08-03 03:11 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-08-03 03:11 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-08-03 03:11 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-08-03 03:11 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-08-03 02:50 . 2012-03-18 14:02 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-08-03 02:50 . 2012-03-18 14:02 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{50CF74A8-1F06-4D39-8E7B-C5D5E8EB0806}\gapaengine.dll
2012-08-02 18:48 . 2012-08-02 18:48 -------- d-----w- c:\users\CHRIS\AppData\Local\Macromedia
2012-08-02 03:26 . 2012-08-08 15:27 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-08-02 03:26 . 2012-08-08 14:49 157608 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-08-02 03:26 . 2012-08-08 14:49 113120 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-02 18:39 . 2012-04-03 11:29 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-02 18:39 . 2012-04-03 11:29 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-08 14:49 . 2012-04-06 08:11 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 21:31 1514152 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-04-03 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 MpKsl6795ffdb;MpKsl6795ffdb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FB9FDB07-A3E7-4C66-9689-62C6433C5885}\MpKsl6795ffdb.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL6795FFDB
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ HPSLPSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 18:39]
.
2012-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-28 08:22]
.
2012-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-28 08:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 97.64.183.164 97.64.209.37
FF - ProfilePath - c:\users\CHRIS\AppData\Roaming\Mozilla\Firefox\Profiles\92ln5cay.default\
.
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7601 Disk: WDC_WD25 rev.10.0 -> Harddisk0\DR0 ->
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll
1 ntkrnlpa!IofCallDriver[0x82A4255A] -> \Device\Harddisk0\DR0[0x85AD8030]
3 CLASSPNP[0x8899359E] -> ntkrnlpa!IofCallDriver[0x82A4255A] -> [0x84C39F08]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0; }
detected disk devices:
\Device\00000056 -> \??\SCSI#Disk&Ven_WDC_WD25&Prod_00JS-00NCB1#4&6727837&0&010100#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user & kernel MBR OK
sectors 488397166 (+7): user != kernel
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-08 13:25:38
ComboFix-quarantined-files.txt 2012-08-08 18:25
.
Pre-Run: 211,321,372,672 bytes free
Post-Run: 212,868,751,360 bytes free
.
- - End Of File - - 8E8DC837ACBD3EA4F84CD1A69FC347D7