ComboFix 11-07-29.03 - Austin 07/30/2011 1:04.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3838.2196 [GMT -5:00]
Running from: c:\users\Austin\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\dns_lookup.tmp
C:\Install.exe
c:\programdata\5162qny2ob203v1p2ryg257h14
c:\users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}
c:\users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}\chrome.manifest
c:\users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}\chrome\content\_cfg.js
c:\users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}\chrome\content\overlay.xul
c:\users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}\install.rdf
c:\users\Austin\AppData\Local\5162qny2ob203v1p2ryg257h14
c:\users\Austin\AppData\Roaming\inst.exe
c:\users\Austin\AppData\Roaming\Microsoft\Windows\Templates\5162qny2ob203v1p2ryg257h14
c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}
c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\chrome.manifest
c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\chrome\xulcache.jar
c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\defaults\preferences\xulcache.js
c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\install.rdf
c:\users\Austin\g2mdlhlpx.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-06-28 to 2011-07-30 )))))))))))))))))))))))))))))))
.
.
2011-07-30 06:30 . 2011-07-30 06:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-28 07:54 . 2011-07-28 07:54 -------- d-----w- c:\programdata\AVS4YOU
2011-07-28 07:54 . 2011-07-28 07:54 -------- d-----w- c:\users\Austin\AppData\Roaming\AVS4YOU
2011-07-28 07:48 . 2011-07-28 08:01 -------- d-----w- c:\program files (x86)\Common Files\AVSMedia
2011-07-28 07:47 . 2011-06-23 18:26 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2011-07-27 22:55 . 2011-07-27 22:55 -------- d-----w- c:\users\Austin\AppData\Roaming\Avira
2011-07-27 22:50 . 2011-07-28 22:54 88288 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-27 22:50 . 2011-07-28 22:54 123784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-07-27 22:50 . 2011-07-27 22:50 -------- d-----w- c:\programdata\Avira
2011-07-27 22:50 . 2011-07-27 22:50 -------- d-----w- c:\program files (x86)\Avira
2011-07-26 17:44 . 2011-07-28 08:05 -------- d-----w- c:\program files (x86)\Citrix
2011-07-26 15:56 . 2011-07-26 15:56 -------- d-----w- c:\program files\CCleaner
2011-07-15 18:19 . 2011-07-24 04:25 -------- d-----r- c:\users\Austin\Dropbox
2011-07-15 18:17 . 2011-07-24 04:26 -------- d-----w- c:\users\Austin\AppData\Roaming\Dropbox
2011-07-01 16:10 . 2011-07-01 16:10 -------- d-----w- c:\users\Austin\AppData\Local\FeedDemon
2011-07-01 16:10 . 2011-07-01 16:10 -------- d-----w- c:\program files (x86)\FeedDemon
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-17 09:06 . 2010-09-27 04:42 23112 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-07-07 00:52 . 2010-08-19 02:23 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-07 00:52 . 2010-08-19 02:23 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-23 18:25 . 2010-03-08 16:36 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-06-22 18:43 . 2011-06-22 18:43 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2011-06-22 18:43 . 2011-06-22 18:43 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-06-22 18:43 . 2011-06-22 18:43 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-06-22 18:43 . 2011-06-22 18:43 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2011-06-22 18:43 . 2011-06-22 18:43 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2011-06-22 18:43 . 2011-06-22 18:43 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2011-06-22 18:43 . 2011-06-22 18:43 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-06-22 18:43 . 2011-06-22 18:43 367104 ----a-w- c:\windows\SysWow64\html.iec
2011-06-22 18:43 . 2011-06-22 18:43 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-06-22 18:43 . 2011-06-22 18:43 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2011-06-22 18:43 . 2011-06-22 18:43 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll
2011-06-22 18:43 . 2011-06-22 18:43 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2011-06-22 18:43 . 2011-06-22 18:43 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2011-06-22 18:43 . 2011-06-22 18:43 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2011-06-22 18:43 . 2011-06-22 18:43 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2011-06-22 18:43 . 2011-06-22 18:43 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-06-22 18:43 . 2011-06-22 18:43 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2011-06-22 18:43 . 2011-06-22 18:43 1126912 ----a-w- c:\windows\SysWow64\wininet.dll
2011-06-22 18:43 . 2011-06-22 18:43 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-06-22 18:43 . 2011-06-22 18:43 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2011-06-22 18:43 . 2011-06-22 18:43 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-06-22 18:43 . 2011-06-22 18:43 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-06-22 18:43 . 2011-06-22 18:43 85504 ----a-w- c:\windows\system32\iesetup.dll
2011-06-22 18:43 . 2011-06-22 18:43 76800 ----a-w- c:\windows\system32\tdc.ocx
2011-06-22 18:43 . 2011-06-22 18:43 603648 ----a-w- c:\windows\system32\vbscript.dll
2011-06-22 18:43 . 2011-06-22 18:43 49664 ----a-w- c:\windows\system32\imgutil.dll
2011-06-22 18:43 . 2011-06-22 18:43 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-06-22 18:43 . 2011-06-22 18:43 448512 ----a-w- c:\windows\system32\html.iec
2011-06-22 18:43 . 2011-06-22 18:43 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2011-06-22 18:43 . 2011-06-22 18:43 30720 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-22 18:43 . 2011-06-22 18:43 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-06-22 18:43 . 2011-06-22 18:43 2303488 ----a-w- c:\windows\system32\jscript9.dll
2011-06-22 18:43 . 2011-06-22 18:43 222208 ----a-w- c:\windows\system32\msls31.dll
2011-06-22 18:43 . 2011-06-22 18:43 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2011-06-22 18:43 . 2011-06-22 18:43 165888 ----a-w- c:\windows\system32\iexpress.exe
2011-06-22 18:43 . 2011-06-22 18:43 160256 ----a-w- c:\windows\system32\wextract.exe
2011-06-22 18:43 . 2011-06-22 18:43 1492992 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-22 18:43 . 2011-06-22 18:43 1389056 ----a-w- c:\windows\system32\wininet.dll
2011-06-22 18:43 . 2011-06-22 18:43 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-06-22 18:43 . 2011-06-22 18:43 12288 ----a-w- c:\windows\system32\mshta.exe
2011-06-22 18:43 . 2011-06-22 18:43 114176 ----a-w- c:\windows\system32\admparse.dll
2011-06-22 18:43 . 2011-06-22 18:43 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-06-22 18:42 . 2011-06-22 18:42 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-06-22 18:42 . 2011-06-22 18:42 902656 ----a-w- c:\windows\system32\d2d1.dll
2011-06-22 18:42 . 2011-06-22 18:42 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
2011-06-22 18:42 . 2011-06-22 18:42 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-06-22 18:42 . 2011-06-22 18:42 470016 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-06-22 18:42 . 2011-06-22 18:42 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-06-22 18:42 . 2011-06-22 18:42 4068864 ----a-w- c:\windows\system32\mf.dll
2011-06-22 18:42 . 2011-06-22 18:42 320512 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-06-22 18:42 . 2011-06-22 18:42 3181568 ----a-w- c:\windows\SysWow64\mf.dll
2011-06-22 18:42 . 2011-06-22 18:42 283648 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-06-22 18:42 . 2011-06-22 18:42 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-06-22 18:42 . 2011-06-22 18:42 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-06-22 18:42 . 2011-06-22 18:42 229888 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-06-22 18:42 . 2011-06-22 18:42 218624 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
2011-06-22 18:42 . 2011-06-22 18:42 206848 ----a-w- c:\windows\system32\mfps.dll
2011-06-22 18:42 . 2011-06-22 18:42 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2011-06-22 18:42 . 2011-06-22 18:42 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll
2011-06-22 18:42 . 2011-06-22 18:42 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-06-22 18:42 . 2011-06-22 18:42 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll
2011-06-22 18:42 . 2011-06-22 18:42 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
2011-06-22 18:42 . 2011-06-22 18:42 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2011-06-22 18:42 . 2011-06-22 18:42 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2011-06-22 18:42 . 2011-06-22 18:42 1540608 ----a-w- c:\windows\system32\DWrite.dll
2011-06-22 18:42 . 2011-06-22 18:42 1495040 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2011-06-22 18:42 . 2011-06-22 18:42 144384 ----a-w- c:\windows\system32\cdd.dll
2011-06-22 18:42 . 2011-06-22 18:42 135168 ----a-w- c:\windows\SysWow64\XpsRasterService.dll
2011-06-22 18:42 . 2011-06-22 18:42 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2011-06-22 18:42 . 2011-06-22 18:42 1133568 ----a-w- c:\windows\system32\FntCache.dll
2011-06-22 18:42 . 2011-06-22 18:42 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-29 39408]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"AirPort Base Station Agent"="c:\program files (x86)\AirPort\APAgent.exe" [2009-11-11 771360]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-12-13 421160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-07 1047656]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
c:\users\Austin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Austin\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"VideoWebCamera"="c:\program files (x86)\VideoWebCamera\VideoWebCamera.exe" -a
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k
.
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 72196045
*NewlyCreated* - AVGNTFLT
*NewlyCreated* - AVIPBB
*NewlyCreated* - RMCAST
*Deregistered* - 72196045
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-16 02:27]
.
2011-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-16 02:27]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Austin\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-22 295936]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-12-16 206208]
"Acer ePower Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2009-09-30 823840]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=nv53&r=27360610n6c6l0420z105a44k1x518
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=nv53&r=27360610n6c6l0420z105a44k1x518
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
TCP: DhcpNameServer = 10.0.1.1
FF - ProfilePath - c:\users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: WebSlingPlayer: {9EB34849-81D3-4841-939D-666D522B889A} - %profile%\extensions\{9EB34849-81D3-4841-939D-666D522B889A}
FF - Ext: Rapportive:
rapportive@rapportive.com - %profile%\extensions\rapportive@rapportive.com
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKU-Default-Run-Safe Run Start - c:\windows\SysWOW64\saferun.exe
Toolbar-Locked - (no file)
AddRemove-McAfee Security Scan - c:\program files (x86)\McAfee Security Scan\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:a9,f2,32,33,14,38,cc,01
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-07-30 01:33:25
ComboFix-quarantined-files.txt 2011-07-30 06:33
.
Pre-Run: 355,777,380,352 bytes free
Post-Run: 355,650,691,072 bytes free
.
- - End Of File - - DD2E37DB882796E1C3D55537D3C6C735
====================================================
ESET
C:\ProgramData\Spybot - Search & Destroy\Recovery\AdRotator8.zip Win32/Bagle.gen.zip worm
C:\ProgramData\Spybot - Search & Destroy\Recovery\WinFakeAlertttam.zip Win32/Bagle.gen.zip worm
C:\Qoobox\Quarantine\C\Users\Austin\AppData\Local\{0B84D067-4F89-45D3-9EF7-205454709767}\chrome\content\overlay.xul.vir probably a variant of Win32/Agent.NVQFFQI trojan
C:\Qoobox\Quarantine\C\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan
C:\Qoobox\Quarantine\C\Users\Austin\AppData\Roaming\Mozilla\Firefox\Profiles\02gy5ajk.default\extensions\{d1f25624-e58f-4811-a96c-0c89d0436750}\chrome\xulcache.jar.vir JS/Agent.NDJ trojan
C:\Users\All Users\Spybot - Search & Destroy\Recovery\AdRotator8.zip Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\WinFakeAlertttam.zip Win32/Bagle.gen.zip worm
C:\Users\Austin\Dragon Naturally Speaking V10 Preferred.rar a variant of Win32/Keygen.AG application
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3a9c5000-4474acaf a variant of Java/Exploit.CVE-2009-2843.B trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6685d300-14262a4e Java/Exploit.CVE-2010-4452.A trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6add3540-1078a65a multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\560f078b-3063e418 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\4a14144e-4cf06321 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\25b8b8f-15cd60df multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\3084712-79d03a0f multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\455b1452-1df4e952 a variant of Win32/Kryptik.LAE trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\49e473d2-441964e8 a variant of Win32/Injector.GIB trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-32f1e3f2 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\50c80b59-7f38132b multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\f4dfdd-30e8ddbd multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\743fee9f-6fdb229d multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\187b0ca2-15cdc859 a variant of Java/Exploit.CVE-2009-2843.B trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\170f8765-50c319ea a variant of Java/Exploit.CVE-2009-2843.B trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\3630b029-17726db1 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\752509ab-5a615bec a variant of Java/Exploit.CVE-2009-2843.B trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\32e44eaf-52bee64b probably a variant of Java/TrojanDownloader.OpenStream.NCC trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\37cf23b0-51fbdb5d a variant of Win32/Kryptik.LAE trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\5461bbba-21276d1e Java/TrojanDownloader.Agent.NCM trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60\686c0d7c-7ad57c57 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\60d9c47e-44e00e17 a variant of Java/TrojanDownloader.OpenStream.NCE trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\60d9c47e-51655cd9 a variant of Java/TrojanDownloader.OpenStream.NCE trojan
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2f19163f-2a72b692 multiple threats
C:\Users\Austin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\bfacb09-6e1834fc multiple threats
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\ggbrzx[1].htm Win32/Adware.SpywareProtect2009 application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\id2[1].htm multiple threats
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\iss22[1].exe Win32/TrojanDownloader.Small.OVG trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\jwrlgbvd[1].htm a variant of Win32/Kryptik.GXW trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\spsf12[1].exe a variant of Win32/Injector.CDG trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KT8WHFS0\ggbrzx[1].htm Win32/Adware.SpywareProtect2009 application
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KT8WHFS0\gkbjdlwqlt[1].htm a variant of Win32/Cimag.CQ trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\kksahc[1].htm Win32/TrojanDownloader.Small.OTT trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\nss32[1].exe Win32/TrojanDownloader.FakeAlert.AQI trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\wzdytaicxe[1].htm probably a variant of Win32/Agent.CPURUFH trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\dms419[1].exe a variant of Win32/Injector.CDG trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\dst213[1].exe a variant of Win32/Olmarik.AFR trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\gkbjdlwqlt[1].htm a variant of Win32/Cimag.CQ trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\jjaiqxsq[1].htm a variant of Win32/Kryptik.EZZ trojan
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\kksaupwr[1].htm a variant of Win32/Kryptik.FAT trojan
C:\Windows\System32\config\systemprofile\AppData\Local\{A4DC2456-3039-49BE-B5B3-33C4D2FCBAA3}\chrome\content\overlay.xul probably a variant of Win32/Agent.NVQFFQI trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\ggbrzx[1].htm Win32/Adware.SpywareProtect2009 application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\id2[1].htm multiple threats
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\iss22[1].exe Win32/TrojanDownloader.Small.OVG trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\jwrlgbvd[1].htm a variant of Win32/Kryptik.GXW trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MFI6OWG\spsf12[1].exe a variant of Win32/Injector.CDG trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KT8WHFS0\ggbrzx[1].htm Win32/Adware.SpywareProtect2009 application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KT8WHFS0\gkbjdlwqlt[1].htm a variant of Win32/Cimag.CQ trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\kksahc[1].htm Win32/TrojanDownloader.Small.OTT trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\nss32[1].exe Win32/TrojanDownloader.FakeAlert.AQI trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WTF1F5ZG\wzdytaicxe[1].htm probably a variant of Win32/Agent.CPURUFH trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\dms419[1].exe a variant of Win32/Injector.CDG trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\dst213[1].exe a variant of Win32/Olmarik.AFR trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\gkbjdlwqlt[1].htm a variant of Win32/Cimag.CQ trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\jjaiqxsq[1].htm a variant of Win32/Kryptik.EZZ trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XL8CZ26P\kksaupwr[1].htm a variant of Win32/Kryptik.FAT trojan
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\{A4DC2456-3039-49BE-B5B3-33C4D2FCBAA3}\chrome\content\overlay.xul probably a variant of Win32/Agent.NVQFFQI trojan