Page 3 of 3 FirstFirst 123
Results 21 to 26 of 26

Thread: IDP.Trojan Crpt.AQLW Issues

  1. #21
    Junior Member
    Join Date
    May 2012
    Posts
    17

    Default

    Their is no OS running on the F:/ drive, however it does seem to be infected with something as their is a $RECYCLE.BIN folder

    mgadiag.txt


    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-TV7MC-7MV9J-KJ3TY
    Windows Product Key Hash: lCbeR4W9iEXWpqMYUWEzLtdzIi8=
    Windows Product ID: 00371-152-2839481-85843
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {28DB8098-55C5-4C0D-833E-906BF774C36D}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.120305-1505
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: Microsoft
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 103 Blocked VLK
    Microsoft Office Access 2007 - 100 Genuine
    Microsoft Office Excel 2007 - 103 Blocked VLK
    Microsoft Office PowerPoint 2007 - 103 Blocked VLK
    Microsoft Office Publisher 2007 - 100 Genuine
    Microsoft Office Outlook 2007 - 100 Genuine
    Microsoft Office Word 2007 - 103 Blocked VLK
    OGA Version: Registered, 2.0.48.0
    Signed By: Microsoft
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{28DB8098-55C5-4C0D-833E-906BF774C36D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-KJ3TY</PKey><PID>00371-152-2839481-85843</PID><PIDType>5</PIDType><SID>S-1-5-21-541655578-1006378361-3361530724</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>EP45-UD3P</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F6</Version><SMBIOSVersion major="2" minor="4"/><Date>20081114000000.000000+000</Date></BIOS><HWID>D1CC3907018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0015-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Access 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89384-707-0356806-63147</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0016-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Excel 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89385-707-0356806-63210</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0018-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office PowerPoint 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89400-707-0356806-63925</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0019-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Publisher 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89404-707-0356806-63595</Pid><PidType>14</PidType></Product><Product GUID="{90120000-001A-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Outlook 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89399-707-0356806-63075</Pid><PidType>14</PidType></Product><Product GUID="{90120000-001B-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Word 2007</Name><Ver>12</Ver><Val>437005356259D86</Val><Hash>G5Qjl2nuHEjAmcG9TDdU8SHIOkc=</Hash><Pid>89407-707-0356806-63723</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00170-152-283948-01-1033-7600.0000-3172009
    Installation ID: 012843030550324256174432524860840414971714476816553442
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: KJ3TY
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 5/29/2012 9:35:50 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 5:27:2012 16:44
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys


    HWID Data-->
    HWID Hash Current: RAAAAAIABgABAAIAAgABAAAABQABAAEA6GGE2Wrw7+2ENAiFwo8MNUa85L+gRc5w4HmC3o3vKs9OEwbV1jCuJa8lRso=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
    ACPI Table Name OEMID Value OEMTableID Value
    APIC GBT GBTUACPI
    FACP GBT GBTUACPI
    HPET GBT GBTUACPI
    MCFG GBT GBTUACPI
    EUDS GBT
    SSDT PmRef CpuPm

  2. #22
    Junior Member
    Join Date
    May 2012
    Posts
    17

    Default

    wvcheck.txt

    Windows Validation Check
    Version: 1.9.12.5
    Log Created On: 0938_29-05-2012
    -----------------------

    Windows Information
    -----------------------
    Windows Version: Windows 7 Service Pack 1
    Windows Mode: Normal
    Systemroot Path: C:\Windows

    WVCheck's Auto Update Check
    -----------------------
    Auto-Update Option: Do not download or install updates automatically.
    -----------------------
    Last Success Time for Update Detection: 2012-05-06 17:09:50
    Last Success Time for Update Download: 2012-05-06 17:14:37
    Last Success Time for Update Installation: 2012-05-06 17:21:34


    WVCheck's Registry Check Check
    -----------------------
    Antiwpa: Not Found
    -----------------------
    Chew7Hale: Not Found
    -----------------------


    WVCheck's File Dump
    -----------------------
    C:\Windows\System32\slwga.dll
    Size: 14336 bytes
    Creation; 10/10/2011 21:57:4
    Modification; 20/11/2010 7:21:24
    MD5; 19f75d71e4256f5113d64ce2bb66b838
    Matched: slwga.dll
    -----------------------
    C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.16385_none_ff27e02604a90885\slwga.dll
    Size: 13824 bytes
    Creation; 13/7/2009 19:36:22
    Modification; 13/7/2009 21:16:15
    MD5; 01fe4bdd0b47a7d8bf34d78d2bc23ddb
    Matched: slwga.dll
    -----------------------
    C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.16723_none_ff66c6b2047a22cd\slwga.dll
    Size: 14336 bytes
    Creation; 26/5/2011 15:20:40
    Modification; 21/12/2010 0:38:16
    MD5; 2008845b41d561fb77b77bbe0045099e
    Matched: slwga.dll
    -----------------------
    C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7600.20862_none_ffc423831db91904\slwga.dll
    Size: 14336 bytes
    Creation; 26/5/2011 15:20:40
    Modification; 21/12/2010 0:29:6
    MD5; 2332de32759ebcc691850e092b2564a6
    Matched: slwga.dll
    -----------------------
    C:\Windows\winsxs\x86_microsoft-windows-security-spp-wga_31bf3856ad364e35_6.1.7601.17514_none_0158f3ee01978c1f\slwga.dll
    Size: 14336 bytes
    Creation; 10/10/2011 21:57:4
    Modification; 20/11/2010 7:21:24
    MD5; 19f75d71e4256f5113d64ce2bb66b838
    Matched: slwga.dll
    -----------------------


    WVCheck's Dir Dump
    -----------------------
    WVCheck found no known bad directories.


    WVCheck's Missing File Check
    -----------------------
    WVCheck found no missing Windows files.


    WVCheck's MBAM Quarantine Check
    -----------------------
    There were no bad files quarantined by MBAM.


    WVCheck's HOSTS File Check
    -----------------------
    WVCheck found no bad lines in the hosts file.


    WVCheck's MD5 Check
    EXPERIMENTAL!!
    -----------------------
    user32.dll - f1dd3acaee5e6b4bbc69bc6df75cef66


    -------- End of File, program close at 1046_29-05-2012 --------

  3. #23
    Junior Member
    Join Date
    May 2012
    Posts
    17

    Default

    ckflies.txt


    CKScanner - Additional Security Risks - These are not necessarily bad
    c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler1.dll
    c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler2.dll
    c:\program files\adobe\adobe premiere pro cs3\plug-ins\en_us\vstplugins\decrackler6.dll
    c:\program files\n3v games\ts12\userdata\backups\11-12-13\crackedmud\config.chump
    c:\program files\n3v games\ts12\userdata\backups\11-12-13\crackedmud\crackedmud.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\11-12-14\cb_crackedrock\cb_crackedrock.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\11-12-14\cb_crackedrock\config.chump
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\ballest dark.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\ballest dark.tga
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\bricks old daek.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\bricks old daek.tga
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\config.chump
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\tunnel bore cover 2t.im
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\tunnel cover red.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\11-12-27\tunnel prr 2 track stone concrete crack cover\tunnel cover red.tga
    c:\program files\n3v games\ts12\userdata\backups\12-01-23\coal_bagging_hopper\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-01-26\crackers boxed on pallet\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-01-26\crackers boxed on pallet\icon.tga
    c:\program files\n3v games\ts12\userdata\backups\12-01-27\m6ns_a\m6-a_body\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\ballest dark.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\ballest dark.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\bricks old daek.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\bricks old daek.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\bricks old.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\tunnel bore cover 1t.im
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\tunnel cover red.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-13\tunnel prr 1t crack cover\tunnel cover red.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\cracked-cement-a1-normal.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\cracked-cement-a1-normal.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\cracked-cement-a1.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\cracked-cement-a1.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\preview.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-25\cracked_cement_a1\user_license.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 1\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 1\normal.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 1\normal.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 1\soil cracked 1.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 1\soil cracked 1.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 2\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 2\normal.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 2\normal.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 2\soil cracked 2.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 2\soil cracked 2.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 3\config.chump
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 3\normal.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 3\normal.tga
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 3\soil cracked 3.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-02-29\soil cracked 3\soil cracked 3.tga
    c:\program files\n3v games\ts12\userdata\backups\12-03-06\kuid2 130544 28011 2\wooden_cracked_plank_7040207.texture
    c:\program files\n3v games\ts12\userdata\backups\12-03-06\kuid2 130544 28011 2\wooden_cracked_plank_7040207.texture.txt
    c:\program files\n3v games\ts12\userdata\backups\12-03-06\kuid2 130544 28011 2\wooden_cracked_plank_7040207.tga
    c:\program files\n3v games\ts12\userdata\backups\12-03-06\kuid2 38793 270001 1\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\backups\12-03-06\kuid2 38793 270001 1\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\local\hash-23\kuid 5204 21041\cb_crackedrock_brown.texture
    c:\program files\n3v games\ts12\userdata\local\hash-32\kuid 5204 21024\cb_crackedrock.texture
    c:\program files\n3v games\ts12\userdata\local\hash-32\kuid 5204 21024\cb_crackedrock.texture.txt
    c:\program files\n3v games\ts12\userdata\local\hash-93\kuid2 130544 15013 3\m6-a_body\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\local\hash-93\kuid2 130544 15013 3\m6-a_body\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.texture
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.texture.txt
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.tga
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.texture
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.texture.txt
    c:\program files\n3v games\ts12\userdata\local\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.tga
    c:\program files\n3v games\ts12\userdata\original\hash-21\kuid 5204 21043\cb_crackedrock_ltbrown.texture
    c:\program files\n3v games\ts12\userdata\original\hash-21\kuid 5204 21043\cb_crackedrock_ltbrown.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-32\kuid 5204 21024\cb_crackedrock.texture
    c:\program files\n3v games\ts12\userdata\original\hash-32\kuid 5204 21024\cb_crackedrock.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-40\kuid2 334896 1133 1\soil cracked 2.texture
    c:\program files\n3v games\ts12\userdata\original\hash-40\kuid2 334896 1133 1\soil cracked 2.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-40\kuid2 334896 1133 1\soil cracked 2.tga
    c:\program files\n3v games\ts12\userdata\original\hash-41\kuid2 334896 1132 1\soil cracked 1.texture
    c:\program files\n3v games\ts12\userdata\original\hash-41\kuid2 334896 1132 1\soil cracked 1.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-41\kuid2 334896 1132 1\soil cracked 1.tga
    c:\program files\n3v games\ts12\userdata\original\hash-43\kuid2 334896 1134 1\soil cracked 3.texture
    c:\program files\n3v games\ts12\userdata\original\hash-43\kuid2 334896 1134 1\soil cracked 3.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-43\kuid2 334896 1134 1\soil cracked 3.tga
    c:\program files\n3v games\ts12\userdata\original\hash-64\kuid2 93677 10700 2\cracked.texture
    c:\program files\n3v games\ts12\userdata\original\hash-64\kuid2 93677 10700 2\cracked.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-64\kuid2 93677 10700 2\cracked.tga
    c:\program files\n3v games\ts12\userdata\original\hash-70\kuid2 65769 22222 1\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\original\hash-70\kuid2 65769 22222 1\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-70\kuid2 65769 22222 1\cookiesheet_crackle_ofsq.tga
    c:\program files\n3v games\ts12\userdata\original\hash-93\kuid2 130544 15013 3\m6-a_body\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\original\hash-93\kuid2 130544 15013 3\m6-a_body\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.texture
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1-normal.tga
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.texture
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-9b\kuid2 453099 1179 1\cracked-cement-a1.tga
    c:\program files\n3v games\ts12\userdata\original\hash-a9\kuid 2300 21007\crackedmud.texture
    c:\program files\n3v games\ts12\userdata\original\hash-a9\kuid 2300 21007\crackedmud.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-ac\kuid2 130544 15002 6\m6-b_body\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\original\hash-ac\kuid2 130544 15002 6\m6-b_body\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-ad\kuid2 130544 15003 6\m6-a_body\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\original\hash-ad\kuid2 130544 15003 6\m6-a_body\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\n3v games\ts12\userdata\original\hash-fe\kuid2 117948 1163 2\cookiesheet_crackle_ofsq.texture
    c:\program files\n3v games\ts12\userdata\original\hash-fe\kuid2 117948 1163 2\cookiesheet_crackle_ofsq.texture.txt
    c:\program files\steam\steamapps\common\empire total war\data\ui\campaign ui\pips\military-crackdown-repression.tga
    c:\programdata\adobe\photoshop elements\6.0\locale\en_us\photo creations metadata\backgrounds\cracked paint.xml
    c:\users\nathan\downloads\google_sketchup_pro_8___keygen_[misterpale].6337876.tpb.torrent
    c:\users\nathan\downloads\[kat.ph]google.sketchup.pro.8.0.4811.incl.crack.serials.torrent
    c:\users\nathan\downloads\[kat.ph]google.sketchup.pro.8.eng.crack.torrent
    c:\users\nathan\downloads\conv3ds\photoshop extended 12.0 keygen + howto\howto generate a serial for photoshop extended 12.0 (cs5.x).pdf
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer.rar
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\googlesketchupprowen 8.0.4811.exe
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\readme.nfo
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\serials.nfo
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\crack\sketchup.exe
    c:\users\nathan\music\itunes\itunes media\music\compilations\itunes holiday sampler\17 the nutcracker, op. 71, act 2_ ch.m4a
    c:\windows.old\users\nathan\music\itunes\itunes music\mastodon\crack the skye\01 oblivion.m4a
    scanner sequence 3.ZZ.11.TVAPVJ
    ----- EOF -----

  4. #24
    Emeritus- Malware Team
    Join Date
    Aug 2011
    Posts
    148

    Default

    Hi boatnerd06,

    Thank you for the logs.

    A number of issues will need to be addressed in order that I continue to assist you the malware issues on your computer.

    Did you install the following software? If so, how did you come by this software?
    Adobe Creative Suite 3 Master Collection

    Again, please remember to read the instructions below carefully before executing and perform the steps, in the order given.
    If you have any questions about or problems executing these instructions, <STOP> do not proceed, post back with the question or problem before going any further.

    Before we proceed please make sure any open programs are closed.

    Step 1:
    Non-Genuine Office Product(s)

    The following Microsoft software installations on your computer are non-genuine:

    Microsoft Office Excel 2007
    Microsoft Office PowerPoint 2007
    Microsoft Office Word 2007

    All have been installed with a now blocked Volume Licensing Key (VLK) that was valid and only available to corporations, education entities and government agencies. VLKs are blocked by Microsoft at the request and consent of the original keyholder for such reasons as the key was lost, stolen, compromised, misused, or expired. Also, Microsoft may have blocked the key if it notices a pattern of misuse, i.e. more installations of Windows using that key than is authorized.

    Please refer to Safer-Networking's policy regarding the use of illegal Pirated/Warez/Cracked software below.
    If you still want to receive assistance, please remove the illegal items from your computer. If you still need the software, you will need to get a legal version from a legitimate source.
    If you advise that the illegal software has been removed and I find otherwise (- the tools we use can and will detect them), then I will be left no choice but to have this topic closed.
    If further such findings occur afterwards, the topic will also be closed.

    You may return to the seller to demand for a replacement with a genuine copy or get a full refund. Read this article to see if you qualify for the Genuine Office Offer.

    The following freeware office suites are available as alternative options:

    Step 2:
    Cracked/Pirated Software Detected!

    Checking through your logs I can detect that you have downloaded and installed cracked software on the computer.

    c:\users\nathan\downloads\google_sketchup_pro_8___keygen_[misterpale].6337876.tpb.torrent
    c:\users\nathan\downloads\[kat.ph]google.sketchup.pro.8.0.4811.incl.crack.serials.torrent
    c:\users\nathan\downloads\[kat.ph]google.sketchup.pro.8.eng.crack.torrent
    c:\users\nathan\downloads\conv3ds\photoshop extended 12.0 keygen + howto\howto generate a serial for photoshop extended 12.0 (cs5.x).pdf
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer.rar
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\googlesketchupprowen 8.0.4811.exe
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\readme.nfo
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\serials.nfo
    c:\users\nathan\downloads\google sketchup pro 8.0.4811 incl crack-serials\google sketchup pro 8.0.4811 incl crack-serials-slicer\crack\sketchup.exe

    This may or may not be related to your computer issues, however, if you wish me to continue helping you, then you must remove both the keygen and crack files as well as the related programs.

    May I draw your attention to THIS TOPIC.
    We do not support the use of illegal Pirated/Warez/Cracked software.

    If seeking help in our Malware removal forum please know that users who have programs obtained by such methods will be asked to remove them, since our help could otherwise be seen as aiding copyright violations. Aside from the legalities be aware malware authors prey on users looking to circumvent a software's protection mechanisms. There is a high risk of infection involved in downloading and running crack codes.
    Step 3:
    Uninstall Programs

    P2P Software Present!

    IMPORTANT There are signs of a P2P (Peer-to-Peer) Related File Sharing Program installed on your computer.

    vShare.tv plugin 1.3
    P2P File Sharing Programs are used as a major conduit for spreading malware infection to computer systems these days.

    P2P programs open up access to the computer on which the program is installed. The computer's settings are more often than not changed in a manner that renders the computer insecure and access to the computer remains open even when the program is not in use. Consequently, the system's security is completely compromised.

    So be aware that it is not just what is downloaded that causes problems, just having a P2P program installed is like leaving all the doors to your house unlocked.

    I advise you take the time to read the following articles that explain the risk of installing these programs:

    In order to continue assisting you with your malware issues I will require you to uninstall the P2P software.

    Registry Cleaners - Advisory

    I notice that the Uniblue SpeedUpMyPC 2009 is installed on this computer. This product incorporates a Registry Cleaner function.

    I don't personally recommend the use of ANY registry cleaners.
    Here is an excerpt from a discussion on regcleaners
    Most reg cleaners aren't "bad" as such, but they aren't perfect and even the best have been known to cause problems.
    The point we are trying to make is that the risk of using one far outweighs any benefit.
    If it does work perfectly you will not see any difference.
    If it doesn't work properly you may end up with an expensive doorstop.
    http://miekiemoes.blogspot.com/2008/...eaking_13.html
    http://forums.whatthetech.com/Regcleaner_t42862.html

    The decision whether or not to remove this program is yours.

    Steering clear of such products in future will reduce your exposure to potential malware threats.

    Please follow the instructions below to remove these programs:

    1. Select Start > Control Panel > Programs > Programs and Features.
    2. Under the Programs heading, click on Uninstall a program.
    3. Scroll down the list of installed programs and locate the following program:

      Uniblue SpeedUpMyPC 2009 <-- Opional Removal - see reasons provided above
      vShare.tv plugin 1.3

    4. Right-click on Uninstall to uninstall it.
    5. Repeat steps 3 - 4 for each program in the list.
    6. When finished Close the Control Panel window.
    7. Restart the computer to complete removal of the program.


    Step 4:
    Re-Run CKScanner

    Please re-run CKScanner. Then Copy and Paste the contents of the ckfiles.txt log into your next reply.

    Step 5:
    Re-Run DDS

    Please re-run DDS. Then Copy and Paste the contents of the DDS.txt and Attach.txt files into your next post.

    Step 6:
    Include in Next Post

    1. Did you have any problems carrying out the instructions?
    2. Did you install the following software? If so, how did you come by this software?
      Adobe Creative Suite 3 Master Collection
    3. ckfiles.txt.
    4. DDS.txt.
    5. Attach.txt.


    Scolabar
    --------------------------------------------------------------------------
    No Reply Within 3 Days Will Result In Your Topic Being Closed
    Malware Removal University - You too could train to help others

  5. #25
    Junior Member
    Join Date
    May 2012
    Posts
    17

    Default

    Well, I guess the option is going to have to be to close this topic as the programs which you have requested to be deleted are vital to my computing needs, and to purchase the versions directly from Microsoft and adobe would be prohibitively expensive. On the same note these programs in there present form have not caused the issue at hand. It is unfortunate that this assistance has come down to becoming a pseudo police force for Microsoft and Adobe but, I guess it is what it is.

    Thank you

    boatnerd06

  6. #26
    Emeritus- Malware Team
    Join Date
    Aug 2011
    Posts
    148

    Default

    Hi boatnerd06,

    FYI, read the section of my last post regarding P2P Software. It will give you a clear indication of the root cause of why your system became infected.
    Downloading and installing cracked software has definitely contributed to, if not directly caused, the infection of your computer.

    This topic will now be closed.

    Scolabar
    Malware Removal University - You too could train to help others

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •