ComboFix 12-08-09.01 - Shaun 08/10/2012 10:48:06.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1023.466 [GMT -5:00]
Running from: c:\users\Shaun\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Shaun\AppData\Local\Temp\30689.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-07-10 to 2012-08-10 )))))))))))))))))))))))))))))))
.
.
2012-08-10 16:13 . 2012-08-10 16:19 -------- d-----w- c:\users\Shaun\AppData\Local\temp
2012-08-10 16:13 . 2012-08-10 16:13 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-08-10 16:13 . 2012-08-10 16:13 -------- d-----w- c:\users\TEMP.Shaun-PC.014\AppData\Local\temp
2012-08-10 16:13 . 2012-08-10 16:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-10 12:44 . 2012-08-10 12:44 -------- d-----w- c:\users\Shaun\AppData\Local\AVG Secure Search
2012-08-09 16:14 . 2012-08-09 16:14 -------- d-----w- c:\users\Shaun\AppData\Roaming\Malwarebytes
2012-08-09 16:14 . 2012-08-09 16:14 -------- d-----w- c:\programdata\Malwarebytes
2012-08-09 16:14 . 2012-08-09 16:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-08-09 16:14 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-08-09 15:02 . 2012-08-09 15:02 -------- d-----w- c:\program files\Trend Micro
2012-08-09 05:57 . 2012-08-09 06:29 -------- d-----w- c:\program files\Advanced Fix 2012
2012-08-09 03:35 . 2012-08-09 03:35 -------- d-----w- C:\$AVG
2012-08-09 03:06 . 2012-08-09 03:06 -------- d-----w- c:\users\Shaun\AppData\Roaming\AVG2012
2012-08-09 03:04 . 2012-08-10 04:04 -------- d-----w- c:\programdata\AVG Secure Search
2012-08-09 03:04 . 2012-08-10 04:03 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-08-09 03:04 . 2012-08-10 04:03 -------- d-----w- c:\program files\AVG Secure Search
2012-08-09 03:02 . 2012-08-10 12:48 -------- d-----w- c:\windows\system32\drivers\AVG
2012-08-09 03:02 . 2012-08-09 05:02 -------- d-----w- c:\programdata\AVG2012
2012-08-09 03:01 . 2012-08-09 03:01 -------- d-----w- c:\program files\AVG
2012-08-09 02:47 . 2012-08-09 02:47 -------- d--h--w- c:\programdata\Common Files
2012-08-09 02:46 . 2012-08-10 12:48 -------- d-----w- c:\programdata\MFAData
2012-08-08 19:30 . 2012-08-09 16:40 -------- d-----w- c:\programdata\CB120AE114611C
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 04:20 . 2012-04-30 15:21 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-03 04:20 . 2011-07-08 15:19 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 16:00 . 2012-06-02 16:00 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-06-02 16:00 . 2011-03-31 01:05 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-19 05:06 . 2012-05-19 05:06 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-05-19 05:06 . 2012-05-19 05:06 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-05-19 05:06 . 2012-05-19 05:06 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-05-19 05:06 . 2012-05-19 05:06 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-05-19 05:06 . 2012-05-19 05:06 161792 ----a-w- c:\windows\system32\msls31.dll
2012-05-19 05:06 . 2012-05-19 05:06 1126912 ----a-w- c:\windows\system32\wininet.dll
2012-05-19 05:06 . 2012-05-19 05:06 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-05-19 05:06 . 2012-05-19 05:06 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-05-19 05:06 . 2012-05-19 05:06 367104 ----a-w- c:\windows\system32\html.iec
2012-05-19 05:06 . 2012-05-19 05:06 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-05-19 05:06 . 2012-05-19 05:06 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-05-19 05:06 . 2012-05-19 05:06 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-05-19 05:06 . 2012-05-19 05:06 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-05-19 05:06 . 2012-05-19 05:06 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-19 05:06 . 2012-05-19 05:06 1797632 ----a-w- c:\windows\system32\jscript9.dll
2012-05-19 05:06 . 2012-05-19 05:06 152064 ----a-w- c:\windows\system32\wextract.exe
2012-05-19 05:06 . 2012-05-19 05:06 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-05-19 05:06 . 2012-05-19 05:06 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-05-19 05:06 . 2012-05-19 05:06 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-19 05:06 . 2012-05-19 05:06 11776 ----a-w- c:\windows\system32\mshta.exe
2012-05-19 05:06 . 2012-05-19 05:06 101888 ----a-w- c:\windows\system32\admparse.dll
2012-05-19 05:00 . 2012-05-19 05:00 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2012-05-19 05:00 . 2012-05-19 05:00 801792 ----a-w- c:\windows\system32\FntCache.dll
2012-05-19 05:00 . 2012-05-19 05:00 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-05-19 05:00 . 2012-05-19 05:00 283648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-05-19 05:00 . 2012-05-19 05:00 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-05-19 05:00 . 2012-05-19 05:00 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-05-19 05:00 . 2012-05-19 05:00 135168 ----a-w- c:\windows\system32\XpsRasterService.dll
2012-05-19 05:00 . 2012-05-19 05:00 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-05-19 05:00 . 2012-05-19 05:00 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-05-19 05:00 . 2012-05-19 05:00 1495040 ----a-w- c:\windows\system32\ExplorerFrame.dll
2012-05-19 05:00 . 2012-05-19 05:00 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-05-19 05:00 . 2012-05-19 05:00 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-05-19 05:00 . 2012-05-19 05:00 3181568 ----a-w- c:\windows\system32\mf.dll
2012-05-19 05:00 . 2012-05-19 05:00 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-05-19 05:00 . 2012-05-19 05:00 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2012-05-19 05:00 . 2012-05-19 05:00 107520 ----a-w- c:\windows\system32\cdd.dll
2012-05-15 10:26 . 2012-06-01 15:05 19607872 ----a-w- c:\windows\system32\nvoglv32.dll
2012-05-15 10:26 . 2012-06-01 15:05 5982528 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:26 . 2012-06-01 15:05 2524992 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:26 . 2012-06-01 15:05 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:26 . 2012-06-01 15:05 15322432 ----a-w- c:\windows\system32\nvd3dum.dll
2012-05-15 10:26 . 2012-06-01 15:05 11354944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-05-15 10:26 . 2012-06-01 15:05 17551680 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:26 . 2011-12-15 00:25 61248 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:26 . 2011-08-27 05:23 883008 ----a-w- c:\windows\system32\nvgenco32.dll
2012-05-15 10:26 . 2011-08-27 05:23 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
2012-05-15 10:26 . 2011-04-03 05:58 2368832 ----a-w- c:\windows\system32\nvapi.dll
2012-05-15 09:28 . 2011-04-08 05:45 645440 ----a-w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:28 . 2011-04-08 05:45 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:28 . 2011-01-08 04:06 62272 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:28 . 2011-04-08 05:44 3931456 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:27 . 2011-04-08 05:44 2759488 ----a-w- c:\windows\system32\nvsvc.dll
2012-07-20 00:22 . 2011-05-13 18:55 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-08-10 04:03 2074208 ----a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-08-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="c:\program files\Ares\Ares.exe" [2010-02-08 1015808]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-06-24 1021840]
"Facebook Update"="c:\users\Shaun\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-06-27 1996200]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-08-10 1107552]
.
c:\users\Shaun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Explorer.lnk - c:\programdata\CB120AE114611C\CB120AE114611C.exe [N/A]
Facebook Messenger.lnk - c:\users\Shaun\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe [2012-7-26 244656]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [x]
S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 04:20]
.
2012-08-06 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1113442019-4064716055-2817604627-1000Core.job
- c:\users\Shaun\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-08 22:48]
.
2012-08-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1113442019-4064716055-2817604627-1000UA.job
- c:\users\Shaun\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-08 22:48]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
FF - ProfilePath - c:\users\Shaun\AppData\Roaming\Mozilla\Firefox\Profiles\ujayen5e.default\
FF - prefs.js: browser.startup.homepage - hxxp://
www.google.com.jm/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B8576a7c9-5727-4ec0-8b5e-32459a2e1fb2%7D&mid=c40c6ffbd7d747d0881ed15020dc5c8d-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=10.0.0.7&lang=en&pr=pr&d=2012-08-08%2022%3A04%3A07&sap=ku&q=
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-AdobeBridge - (no file)
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe
AddRemove-FIFA 12 LOD AND CROWD ANIMATION TWEAKER TOOL 1.0 - c:\program files\EA Sports\FIFA 12\Uninstal.exe
AddRemove-FIFA 12 REAL PERFORMANCE OPTIMIZER V. 1.0 BY DOCTOR+ PRODUCTIONS - c:\program files\EA Sports\FIFA 12\Uninstal_RPO.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1113442019-4064716055-2817604627-1000\Software\G*e*n*I*e*"!\FM Genie Scout 12]
"GameDir"="c:\\Users\\Shaun\\Documents\\Sports Interactive\\Football Manager 2012\\games"
"ShortlistDir"="c:\\Users\\Shaun\\Documents\\Sports Interactive\\Football Manager 2012\\shortlists"
"FMPath"="c:\\Program Files\\SEGA\\Football Manager 2012"
"ScreenshotsDir"="c:\\Users\\Shaun\\Documents\\Sports Interactive\\Football Manager 2012"
"SaveDir"="c:\\Users\\Shaun\\Documents\\Sports Interactive\\Football Manager 2012\\"
"HistoryDir"="c:\\FM Genie Scout 12\\History Points"
"LangDB"="c:\\FM Genie Scout 12\\lang_db.dat"
"LastSaveGame"=""
"Language"="English"
"LoadLangDB"=dword:00000001
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"GraphStep"=dword:00000000
"SkinName"="Steklo Black"
"LastUpdateCheck"=dword:0000a0a8
"VersionOf"=dword:00000000
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"ShowGuidNotification"=dword:00000000
"ShowDonateNotification"=dword:00000000
"Version"=dword:000000cc
"UniqueID"="95-0370-E1ED"
"Currency"=dword:00000056
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""
"PlayerSearchFeatureNum"=dword:00000020
"StaffSearchFeatureNum"=dword:00000001
"ClubSearchFeatureNum"=dword:00000002
"FilterByClubFeatureNum"=dword:00000000
"CompareFeatureNum"=dword:00000000
"ShortlistFeatureNum"=dword:00000000
"ExportFeatureNum"=dword:00000001
"HistoryFeatureNum"=dword:00000000
"LanguageDBFeatureNum"=dword:00000021
"HintsFeatureNum"=dword:00000003
"GenieReportFeatureNum"=dword:0000001b
"TopFormationFeatureNum"=dword:00000000
"ScreenshotFeatureNum"=dword:00000000
"AdClicksNum"=dword:00000022
"AdImpressionsNum"=dword:0000023b
"GameLoadedCounter"=dword:00000022
"VersionOf201"=dword:0000007b
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-10 11:25:22
ComboFix-quarantined-files.txt 2012-08-10 16:25
.
Pre-Run: 10,099,929,088 bytes free
Post-Run: 18,699,026,432 bytes free
.
- - End Of File - - 84D1C9A7230E7BB22881E72DCBA35E13