TechSpot

[Closed] Installing AV after Combofix scan

By Katyjane
Jan 30, 2012
  1. Hi there,

    Broni has been helping me with removal of infection. I was away for a week and so the thread has been closed.

    In the meantime I have followed last instruction and run Combofix after uninstalling AVG free 2012 using AppRemover.

    Now that Combofix has run, can I reinstall an AV program? Any particular recommended (free ones?).

    I'm not after next steps - will wait for thread to be reopened, but I just need to work out the AV as I need to use my computer in the meantime and don't want to be unprotected.

    Please advise.

    Oh - Combofix log just in case that info is needed to answer this question:
    ComboFix 12-01-30.01 - default User 01/30/2012 19:38:15.1.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.691 [GMT 11:00]
    Running from: c:\documents and settings\default User.YOUR-X8YTBSNBLG\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\TEMP
    c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfapx.exe
    c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfarx.dll
    c:\documents and settings\All Users\Application Data\TEMP\AVG\avgntdumpx.exe
    c:\documents and settings\All Users\Application Data\TEMP\AVG\avgrunasx.exe
    c:\documents and settings\All Users\Application Data\TEMP\AVG\avi7.avg
    c:\documents and settings\All Users\Application Data\TEMP\AVG\compat.ini
    c:\documents and settings\All Users\Application Data\TEMP\AVG\htmlayout.dll
    c:\documents and settings\All Users\Application Data\TEMP\AVG\incavi.avm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_cz.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_da.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_es.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_fr.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ge.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_hu.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_id.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_in.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_it.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_jp.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ko.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ms.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_nl.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pb.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pl.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pt.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ru.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sc.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sk.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sp.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_tr.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_us.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zh.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zt.htm
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaconf.txt
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfacz.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfada.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaes.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfafr.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfage.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfahu.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaid.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfain.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfait.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfajp.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfako.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfams.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfanl.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapb.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapl.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapt.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaru.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasc.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfask.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasp.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfatr.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaus.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfavera.txt
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaverx.txt
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazh.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazt.lns
    c:\documents and settings\All Users\Application Data\TEMP\AVG\microavi.avg
    c:\documents and settings\All Users\Application Data\TEMP\AVG\miniavi.avg
    c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.exe
    c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.ini
    c:\documents and settings\default User.YOUR-X8YTBSNBLG\Local Settings\Application Data\assembly\tmp
    c:\program files\XviD-1.2.1-04122008.exe
    c:\windows\$NtUninstallKB29959$
    c:\windows\$NtUninstallKB29959$\282093015\@
    c:\windows\$NtUninstallKB29959$\282093015\bckfg.tmp
    c:\windows\$NtUninstallKB29959$\282093015\cfg.ini
    c:\windows\$NtUninstallKB29959$\282093015\Desktop.ini
    c:\windows\$NtUninstallKB29959$\282093015\keywords
    c:\windows\$NtUninstallKB29959$\282093015\kwrd.dll
    c:\windows\$NtUninstallKB29959$\282093015\L\ixnfowmi
    c:\windows\$NtUninstallKB29959$\282093015\U\00000001.@
    c:\windows\$NtUninstallKB29959$\282093015\U\00000002.@
    c:\windows\$NtUninstallKB29959$\282093015\U\00000004.@
    c:\windows\$NtUninstallKB29959$\282093015\U\80000000.@
    c:\windows\$NtUninstallKB29959$\282093015\U\80000004.@
    c:\windows\$NtUninstallKB29959$\282093015\U\80000032.@
    c:\windows\$NtUninstallKB29959$\3570862413
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-30 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-19 11:25 . 2012-01-19 11:25 -------- d-----w- c:\program files\Lavalys
    2012-01-19 10:35 . 2012-01-19 10:35 -------- d--h--w- c:\windows\PIF
    2012-01-18 10:57 . 2012-01-18 10:57 -------- d-----w- c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\Malwarebytes
    2012-01-18 10:57 . 2012-01-18 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2012-01-18 10:57 . 2012-01-18 10:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-01-18 10:57 . 2011-12-10 04:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-01-13 21:01 . 2012-01-18 09:01 -------- d-----w- c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\Yki
    2012-01-13 21:01 . 2012-01-18 07:50 -------- d-----w- c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\Ufhi
    2012-01-12 09:58 . 2012-01-12 10:09 -------- d-----w- c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\AVG
    2012-01-12 07:34 . 2012-01-30 08:02 -------- d-----w- c:\windows\system32\drivers\AVG
    2012-01-12 07:20 . 2012-01-30 08:02 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
    2012-01-11 14:05 . 2001-08-17 01:50 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
    2012-01-11 14:05 . 2001-08-17 03:56 235648 -c--a-w- c:\windows\system32\dllcache\mgaud.dll
    2012-01-11 14:05 . 2008-04-13 13:11 26112 -c--a-w- c:\windows\system32\dllcache\memstpci.sys
    2012-01-11 14:05 . 2001-08-17 11:36 47616 -c--a-w- c:\windows\system32\dllcache\memgrp.dll
    2012-01-11 14:05 . 2001-08-17 02:58 8320 -c--a-w- c:\windows\system32\dllcache\memcard.sys
    2012-01-11 14:04 . 2001-08-17 01:12 164586 -c--a-w- c:\windows\system32\dllcache\mdgndis5.sys
    2012-01-11 14:04 . 2001-08-17 02:52 7424 -c--a-w- c:\windows\system32\dllcache\mammoth.sys
    2012-01-11 14:04 . 2001-08-17 01:19 48768 -c--a-w- c:\windows\system32\dllcache\maestro.sys
    2012-01-11 14:04 . 2001-08-17 11:36 58880 -c--a-w- c:\windows\system32\dllcache\m3092dc.dll
    2012-01-11 14:04 . 2001-08-17 11:36 58368 -c--a-w- c:\windows\system32\dllcache\m3091dc.dll
    2012-01-11 14:04 . 2001-08-17 01:49 22848 -c--a-w- c:\windows\system32\dllcache\lwusbhid.sys
    2012-01-11 14:04 . 2008-04-13 11:09 20864 -c--a-w- c:\windows\system32\dllcache\lwadihid.sys
    2012-01-11 14:04 . 2001-08-17 02:28 797500 -c--a-w- c:\windows\system32\dllcache\ltsmt.sys
    2012-01-11 14:04 . 2001-08-17 02:28 802683 -c--a-w- c:\windows\system32\dllcache\ltsm.sys
    2012-01-11 14:04 . 2008-04-13 13:10 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
    2012-01-11 14:04 . 2008-04-13 12:53 420992 -c--a-w- c:\windows\system32\dllcache\ltmdmntt.sys
    2012-01-11 14:04 . 2001-08-17 02:28 576746 -c--a-w- c:\windows\system32\dllcache\ltmdmntl.sys
    2012-01-11 14:03 . 2008-04-13 12:53 606684 -c--a-w- c:\windows\system32\dllcache\ltmdmnt.sys
    2012-01-11 14:03 . 2001-08-17 02:28 727786 -c--a-w- c:\windows\system32\dllcache\ltck000c.sys
    2012-01-11 14:03 . 2001-08-17 02:53 4992 -c--a-w- c:\windows\system32\dllcache\loop.sys
    2012-01-11 14:03 . 2001-08-17 01:12 70730 -c--a-w- c:\windows\system32\dllcache\lne100tx.sys
    2012-01-11 14:03 . 2001-08-17 01:12 20573 -c--a-w- c:\windows\system32\dllcache\lne100.sys
    2012-01-11 14:03 . 2001-08-17 01:11 25065 -c--a-w- c:\windows\system32\dllcache\lmndis3.sys
    2012-01-11 14:03 . 2001-08-17 02:51 15744 -c--a-w- c:\windows\system32\dllcache\lit220p.sys
    2012-01-11 14:03 . 2008-04-13 13:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
    2012-01-11 14:03 . 2001-08-17 01:12 26442 -c--a-w- c:\windows\system32\dllcache\lanepic5.sys
    2012-01-11 14:03 . 2001-08-17 01:12 19016 -c--a-w- c:\windows\system32\dllcache\ktc111.sys
    2012-01-11 14:02 . 2001-08-17 11:36 37376 -c--a-w- c:\windows\system32\dllcache\kousd.dll
    2012-01-11 14:02 . 2008-04-13 18:41 253952 -c--a-w- c:\windows\system32\dllcache\kdsusd.dll
    2012-01-11 14:02 . 2008-04-13 18:41 48640 -c--a-w- c:\windows\system32\dllcache\kdsui.dll
    2012-01-11 14:02 . 2008-04-13 13:09 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
    2012-01-11 14:02 . 2001-08-17 02:49 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys
    2012-01-11 14:02 . 2001-08-17 02:51 18688 -c--a-w- c:\windows\system32\dllcache\irsir.sys
    2012-01-11 14:01 . 2008-04-13 18:41 28160 -c--a-w- c:\windows\system32\dllcache\irmon.dll
    2012-01-11 14:01 . 2001-08-17 02:49 23552 -c--a-w- c:\windows\system32\dllcache\irmk7.sys
    2012-01-11 14:01 . 2008-04-13 18:42 151552 -c--a-w- c:\windows\system32\dllcache\irftp.exe
    2012-01-11 14:01 . 2008-04-13 13:24 88192 -c--a-w- c:\windows\system32\dllcache\irda.sys
    2012-01-11 14:01 . 2001-08-17 01:12 45632 -c--a-w- c:\windows\system32\dllcache\ip5515.sys
    2012-01-11 14:01 . 2001-08-17 11:36 90200 -c--a-w- c:\windows\system32\dllcache\io8ports.dll
    2012-01-11 14:01 . 2001-08-17 02:50 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
    2012-01-11 14:01 . 2008-04-13 13:10 5504 -c--a-w- c:\windows\system32\dllcache\intelide.sys
    2012-01-11 14:01 . 2001-08-17 02:47 13056 -c--a-w- c:\windows\system32\dllcache\inport.sys
    2012-01-11 14:01 . 2001-08-17 02:52 16000 -c--a-w- c:\windows\system32\dllcache\ini910u.sys
    2012-01-11 14:01 . 2008-04-14 12:00 81920 -c--a-w- c:\windows\system32\dllcache\ieencode.dll
    2012-01-11 14:00 . 2001-08-17 11:36 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
    2012-01-11 14:00 . 2001-08-17 03:06 100992 -c--a-w- c:\windows\system32\dllcache\icam5usb.sys
    2012-01-11 14:00 . 2001-08-17 11:36 20480 -c--a-w- c:\windows\system32\dllcache\icam5ext.dll
    2012-01-11 14:00 . 2001-08-17 11:36 45056 -c--a-w- c:\windows\system32\dllcache\icam5com.dll
    2012-01-11 14:00 . 2001-08-17 03:06 154496 -c--a-w- c:\windows\system32\dllcache\icam4usb.sys
    2012-01-11 14:00 . 2001-08-17 11:36 61952 -c--a-w- c:\windows\system32\dllcache\icam4ext.dll
    2012-01-11 14:00 . 2001-08-17 11:36 91136 -c--a-w- c:\windows\system32\dllcache\icam4com.dll
    2012-01-11 14:00 . 2001-08-17 11:36 26624 -c--a-w- c:\windows\system32\dllcache\icam3ext.dll
    2012-01-11 14:00 . 2001-08-17 03:05 141056 -c--a-w- c:\windows\system32\dllcache\icam3.sys
    2012-01-11 14:00 . 2001-08-17 03:06 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
    2012-01-11 13:58 . 2001-08-17 02:28 488383 -c--a-w- c:\windows\system32\dllcache\hsf_v124.sys
    2012-01-11 13:58 . 2001-08-17 02:28 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys
    2012-01-11 13:58 . 2001-08-17 02:28 73279 -c--a-w- c:\windows\system32\dllcache\hsf_spkp.sys
    2012-01-11 13:58 . 2001-08-17 02:28 44863 -c--a-w- c:\windows\system32\dllcache\hsf_soar.sys
    2012-01-11 13:58 . 2001-08-17 02:28 57471 -c--a-w- c:\windows\system32\dllcache\hsf_samp.sys
    2012-01-11 13:58 . 2001-08-17 02:28 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
    2012-01-11 13:58 . 2001-08-17 02:28 391199 -c--a-w- c:\windows\system32\dllcache\hsf_k56k.sys
    2012-01-11 13:58 . 2001-08-17 11:36 9759 -c--a-w- c:\windows\system32\dllcache\hsf_inst.dll
    2012-01-11 13:58 . 2001-08-17 02:28 115807 -c--a-w- c:\windows\system32\dllcache\hsf_fsks.sys
    2012-01-11 13:58 . 2001-08-17 02:28 199711 -c--a-w- c:\windows\system32\dllcache\hsf_faxx.sys
    2012-01-11 13:58 . 2001-08-17 02:28 289887 -c--a-w- c:\windows\system32\dllcache\hsf_fall.sys
    2012-01-11 13:58 . 2001-08-17 02:28 67167 -c--a-w- c:\windows\system32\dllcache\hsf_bsc2.sys
    2012-01-11 13:57 . 2001-08-17 02:28 150239 -c--a-w- c:\windows\system32\dllcache\hsf_amos.sys
    2012-01-11 13:57 . 2001-08-17 11:36 19456 -c--a-w- c:\windows\system32\dllcache\hr1w.dll
    2012-01-11 13:57 . 2001-08-17 02:52 5760 -c--a-w- c:\windows\system32\dllcache\hpt4qic.sys
    2012-01-11 13:57 . 2001-08-17 11:36 13312 -c--a-w- c:\windows\system32\dllcache\hpsjmcro.dll
    2012-01-11 13:57 . 2001-08-17 11:36 324608 -c--a-w- c:\windows\system32\dllcache\hpojwia.dll
    2012-01-11 13:57 . 2001-08-17 03:07 25952 -c--a-w- c:\windows\system32\dllcache\hpn.sys
    2012-01-11 13:57 . 2001-08-17 11:36 32768 -c--a-w- c:\windows\system32\dllcache\hpgtmcro.dll
    2012-01-11 13:57 . 2001-08-17 11:36 68608 -c--a-w- c:\windows\system32\dllcache\hpgt53tk.dll
    2012-01-11 13:57 . 2001-08-17 11:36 165888 -c--a-w- c:\windows\system32\dllcache\hpgt53.dll
    2012-01-11 13:57 . 2001-08-17 11:36 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
    2012-01-11 13:57 . 2001-08-17 11:36 93696 -c--a-w- c:\windows\system32\dllcache\hpgt42.dll
    2012-01-11 13:55 . 2001-08-17 02:51 82304 -c--a-w- c:\windows\system32\dllcache\grclass.sys
    2012-01-11 13:55 . 2001-08-17 02:51 17408 -c--a-w- c:\windows\system32\dllcache\gpr400.sys
    2012-01-11 13:55 . 2008-04-13 13:15 59136 -c--a-w- c:\windows\system32\dllcache\gckernel.sys
    2012-01-11 13:55 . 2008-04-13 13:15 10624 -c--a-w- c:\windows\system32\dllcache\gameenum.sys
    2012-01-11 13:55 . 2008-04-13 13:06 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
    2012-01-11 13:55 . 2001-08-17 01:49 322432 -c--a-w- c:\windows\system32\dllcache\g400m.sys
    2012-01-11 13:55 . 2001-08-17 03:56 1733120 -c--a-w- c:\windows\system32\dllcache\g400d.dll
    2012-01-11 13:55 . 2001-08-17 01:49 320384 -c--a-w- c:\windows\system32\dllcache\g200m.sys
    2012-01-11 13:55 . 2001-08-17 03:56 470144 -c--a-w- c:\windows\system32\dllcache\g200d.dll
    2012-01-11 13:55 . 2001-08-17 01:15 454912 -c--a-w- c:\windows\system32\dllcache\fxusbase.sys
    2012-01-11 13:55 . 2001-08-17 11:36 92160 -c--a-w- c:\windows\system32\dllcache\fuusd.dll
    2012-01-11 13:55 . 2001-08-17 01:15 455296 -c--a-w- c:\windows\system32\dllcache\fusbbase.sys
    2012-01-11 13:54 . 2001-08-17 01:15 455680 -c--a-w- c:\windows\system32\dllcache\fus2base.sys
    2012-01-11 13:54 . 2001-08-17 01:15 442240 -c--a-w- c:\windows\system32\dllcache\fpnpbase.sys
    2012-01-11 13:54 . 2001-08-17 01:14 441728 -c--a-w- c:\windows\system32\dllcache\fpcmbase.sys
    2012-01-11 13:54 . 2001-08-17 01:14 444416 -c--a-w- c:\windows\system32\dllcache\fpcibase.sys
    2012-01-11 13:54 . 2008-04-13 11:05 34173 -c--a-w- c:\windows\system32\dllcache\forehe.sys
    2012-01-11 13:54 . 2001-08-17 11:36 71680 -c--a-w- c:\windows\system32\dllcache\fnfilter.dll
    2012-01-11 13:54 . 2001-08-17 01:13 27165 -c--a-w- c:\windows\system32\dllcache\fetnd5.sys
    2012-01-11 13:54 . 2001-08-17 01:10 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
    2012-01-11 13:54 . 2001-08-17 01:12 24618 -c--a-w- c:\windows\system32\dllcache\fa410nd5.sys
    2012-01-11 13:54 . 2001-08-17 01:12 16074 -c--a-w- c:\windows\system32\dllcache\fa312nd5.sys
    2012-01-11 13:52 . 2001-08-17 01:19 72192 -c--a-w- c:\windows\system32\dllcache\es1969.sys
    2012-01-11 13:51 . 2001-08-17 01:11 171520 -c--a-w- c:\windows\system32\dllcache\el99xn51.sys
    2012-01-11 13:50 . 2001-08-17 03:07 20192 -c--a-w- c:\windows\system32\dllcache\dpti2o.sys
    2012-01-11 13:49 . 2001-08-17 11:36 614429 -c--a-w- c:\windows\system32\dllcache\digiview.exe
    2012-01-11 13:48 . 2001-08-17 01:12 63208 -c--a-w- c:\windows\system32\dllcache\dc21x4.sys
    2012-01-11 13:47 . 2001-08-17 01:19 6912 -c--a-w- c:\windows\system32\dllcache\ctlfacem.sys
    2012-01-11 13:46 . 2001-08-17 01:13 27164 -c--a-w- c:\windows\system32\dllcache\ce3n5.sys
    2012-01-11 13:45 . 2001-08-17 02:51 13824 -c--a-w- c:\windows\system32\dllcache\bulltlp3.sys
    2012-01-11 13:44 . 2008-04-13 18:41 17279 -c--a-w- c:\windows\system32\dllcache\atv10nt5.dll
    2012-01-11 13:43 . 2001-08-17 03:56 137216 -c--a-w- c:\windows\system32\dllcache\atidrae.dll
    2012-01-11 13:42 . 2008-04-13 18:41 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
    2012-01-10 12:31 . 2012-01-10 12:31 -------- d-----w- c:\documents and settings\default User.YOUR-X8YTBSNBLG\Local Settings\Application Data\SanctionedMedia
    2012-01-03 13:10 . 2012-01-03 13:10 182672 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
    2012-01-03 13:10 . 2012-01-03 13:10 182672 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-23 13:25 . 2008-06-27 05:13 1859584 ----a-w- c:\windows\system32\win32k.sys
    2011-11-04 19:20 . 2008-06-27 05:13 916992 ----a-w- c:\windows\system32\wininet.dll
    2011-11-04 19:20 . 2008-06-27 05:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-11-04 19:20 . 2008-06-27 05:13 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-11-04 11:23 . 2008-06-27 05:13 385024 ----a-w- c:\windows\system32\html.iec
    2011-11-01 16:07 . 2008-06-27 05:13 1288704 ----a-w- c:\windows\system32\ole32.dll
    2010-08-13 02:24 . 2010-08-13 02:24 567624 ----a-w- c:\program files\GoogleEarthSetup.exe
    2010-03-21 11:14 . 2010-03-21 11:14 1098920 ----a-w- c:\program files\yahoomailuploader_0.5.exe
    2010-03-10 03:52 . 2010-03-10 03:52 607584 ----a-w- c:\program files\RMITAU-SecureW2.exe
    2009-06-17 17:30 . 2010-07-27 12:12 2525169 ----a-w- c:\program files\JPG-to-PDF-Converter-Setup.exe
    2008-10-06 18:29 . 2008-12-23 04:57 1851544 ----a-w- c:\program files\install_flash_player.exe
    2008-05-07 23:34 . 2008-06-27 06:48 15523560 ----a-w- c:\program files\U1 Setup.exe
    2010-02-13 12:30 . 2009-08-05 00:37 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
    "AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-06-03 98304]
    "AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-06-03 479232]
    "AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-21 94208]
    "RTHDCPL"="RTHDCPL.EXE" [2008-07-16 16806400]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    SuperHybridEngine.lnk - c:\program files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2008-7-23 303104]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-15 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
    backup=c:\windows\pss\Bluetooth.lnkCommon Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2011-06-07 07:51 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    2009-07-26 05:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2012-01-10 12:37 4616064 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    "DisableNotifications"= 1 (0x1)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Mozilla Thunderbird\\thunderbird.exe"=
    "c:\\Program Files\\IEPro\\MiniDM.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
    "c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "%windir%\explorer.exe"= %windir%\explorer.exe
    .
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2/18/2010 5:25 AM 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/11/2010 5:41 AM 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [5/5/2011 4:54 AM 116608]
    R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [6/27/2008 4:36 PM 625024]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2010 3:06 PM 136176]
    S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
    S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/5/2009 11:36 AM 30192]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [8/13/2010 3:06 PM 136176]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
    .
    2012-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-13 04:05]
    .
    2012-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-13 04:05]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://eeepc.asus.com/global
    uInternet Settings,ProxyServer = proxy.tpg.com.au:3128
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    TCP: DhcpNameServer = 192.168.1.1
    DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} - hxxp://kitchenplanner.ikea.com/AU/Core/Player/2020PlayerAX_IKEA_Win32.cab
    FF - ProfilePath - c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\Mozilla\Firefox\Profiles\km1zlqrx.default\
    FF - prefs.js: browser.startup.homepage - hxxp://mail.yahoo.com.au/
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b3d2cf0&i=23&tp=ab&ychte=us&q=
    FF - prefs.js: network.proxy.ftp - 10.12.0.1
    FF - prefs.js: network.proxy.ftp_port - 8080
    FF - prefs.js: network.proxy.gopher - 10.12.0.1
    FF - prefs.js: network.proxy.gopher_port - 8080
    FF - prefs.js: network.proxy.http - 10.12.0.1
    FF - prefs.js: network.proxy.http_port - 8080
    FF - prefs.js: network.proxy.socks - 10.12.0.1
    FF - prefs.js: network.proxy.socks_port - 8080
    FF - prefs.js: network.proxy.ssl - 10.12.0.1
    FF - prefs.js: network.proxy.ssl_port - 8080
    FF - prefs.js: network.proxy.type - 4
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
    FF - Ext: English (Australian) Dictionary: en-AU@dictionaries.addons.mozilla.org - %profile%\extensions\en-AU@dictionaries.addons.mozilla.org
    FF - Ext: 20-20 3D Viewer: 2020Player@2020Technologies.com - %profile%\extensions\2020Player@2020Technologies.com
    FF - Ext: 20-20 3D Viewer - IKEA: 2020Player_IKEA@2020Technologies.com - %profile%\extensions\2020Player_IKEA@2020Technologies.com
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-{301496E7-380D-83E4-99E3-A828578AB168} - c:\documents and settings\default User.YOUR-X8YTBSNBLG\Application Data\Yki\wavipao.exe
    Notify-TPSvc - TPSvc.dll
    MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    AddRemove-{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1 - c:\program files\AVG\AVG PC Tuneup\unins000.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-01-30 19:55
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,14,69,30,ed,5b,eb,80,4f,92,63,ec,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,14,69,30,ed,5b,eb,80,4f,92,63,ec,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(588)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    .
    - - - - - - - > 'explorer.exe'(1656)
    c:\windows\system32\WININET.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
    c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
    c:\windows\system32\mshtml.dll
    c:\windows\system32\msls31.dll
    c:\windows\IME\SPGRMR.DLL
    c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\btncopy.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\RTHDCPL.EXE
    c:\windows\system32\igfxsrvc.exe
    c:\windows\system32\igfxext.exe
    .
    **************************************************************************
    .
    Completion time: 2012-01-30 20:00:25 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-01-30 09:00
    .
    Pre-Run: 22,959,644,672 bytes free
    Post-Run: 24,144,855,040 bytes free
    .
    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
    .
    - - End Of File - - 2ED1B25B040356FF819A67D8A70B199A
     
  2. Broni

    Broni Malware Annihilator Posts: 52,677   +342

    I copied your reply to your original topic.

    This topic is closed now.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...