ComboFix 11-05-01.01 - Administrator 02/05/2011 2:19.3.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.44.1033.18.3070.1816 [GMT 1:00]
Running from: c:\users\Administrator\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-04-02 to 2011-05-02 )))))))))))))))))))))))))))))))
.
.
2011-05-02 01:29 . 2011-05-02 01:33 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-05-02 01:29 . 2011-05-02 01:29 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-05-02 01:29 . 2011-05-02 01:29 -------- d-----w- c:\users\shahbaz\AppData\Local\temp
2011-05-02 01:29 . 2011-05-02 01:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-02 00:49 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B46A3DE2-6E06-4A25-ADD8-EB0D4E907C58}\mpengine.dll
2011-04-30 12:44 . 2011-04-30 21:53 -------- d-----w- c:\users\Administrator\AppData\Roaming\Skype
2011-04-28 21:10 . 2011-02-22 13:24 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-04-28 21:09 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-28 21:09 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-28 21:09 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-28 21:09 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-28 21:09 . 2011-02-12 08:39 191488 ----a-w- c:\windows\system32\FXSCOVER.exe
2011-04-27 14:12 . 2011-04-27 14:12 -------- d-----w- c:\users\Administrator\AppData\Local\Mozilla
2011-04-27 13:02 . 2011-04-27 13:02 -------- d-----w- c:\users\Administrator\AppData\Roaming\Template
2011-04-27 01:41 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-27 01:41 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-26 23:31 . 2011-04-26 23:32 -------- d-----w- c:\users\Administrator\AppData\Local\Adobe
2011-04-26 02:18 . 2011-04-26 02:18 -------- d-----w- c:\program files\ESET
2011-04-22 01:12 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-04-20 22:46 . 2011-04-20 22:46 -------- d-----w- c:\users\shahbaz\AppData\Local\DDMSettings
2011-04-20 22:42 . 2011-04-20 22:42 -------- d-----w- c:\program files\Common Files\DivX Shared
2011-04-20 01:46 . 2011-04-20 01:46 -------- d-----w- c:\users\shahbaz\AppData\Local\Mozilla
2011-04-19 00:18 . 2011-04-19 00:26 -------- d-----w- c:\users\shahbaz\AppData\Local\ElevatedDiagnostics
2011-04-19 00:16 . 2011-04-19 00:16 -------- d-----w- c:\program files\Microsoft ATS
2011-04-19 00:01 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-19 00:01 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-04-19 00:01 . 2011-02-22 13:33 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-04-18 03:25 . 2011-04-18 03:25 -------- d-----w- C:\ab26ce1d3b121af7df7fc04e
2011-04-18 03:22 . 2011-01-20 14:14 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-04-18 03:22 . 2011-01-20 16:06 2873344 ----a-w- c:\windows\system32\mf.dll
2011-04-18 03:22 . 2011-01-20 14:14 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-04-18 03:22 . 2011-01-20 16:08 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-04-18 03:22 . 2011-01-20 14:24 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-04-18 03:22 . 2011-01-20 14:28 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-04-18 03:22 . 2011-01-20 14:25 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-04-18 02:31 . 2011-04-18 02:45 -------- d-----w- c:\users\Administrator\AppData\Roaming\Sammsoft
2011-04-18 02:19 . 2011-04-18 02:23 -------- d-----w- c:\windows\$regcmp$
2011-04-18 02:11 . 2011-04-18 02:11 -------- d-----w- c:\users\Administrator\AppData\Roaming\SmartPCTools
2011-04-14 15:46 . 2010-11-30 10:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88999D78-2F69-4109-9574-2F1CBC1E0D68}\gapaengine.dll
2011-04-14 15:40 . 2011-04-14 15:40 -------- d-----w- c:\program files\Microsoft Security Client
2011-04-14 15:36 . 2011-04-14 15:36 -------- d-----w- c:\program files\Common Files\Java
2011-04-13 00:24 . 2011-04-13 00:24 -------- d-----w- c:\users\Administrator\AppData\Roaming\Malwarebytes
2011-04-12 22:58 . 2011-04-12 22:58 -------- d-----w- c:\users\shahbaz\AppData\Roaming\Malwarebytes
2011-04-12 22:58 . 2011-04-12 22:58 -------- d-----w- c:\programdata\Malwarebytes
2011-04-12 22:58 . 2011-04-27 01:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-12 16:23 . 2011-04-14 23:17 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Adobe
2011-04-03 19:31 . 2011-04-03 19:31 -------- d-----w- c:\windows\Sun
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-13 09:29 . 2010-06-24 11:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-03-03 15:40 . 2011-04-28 21:09 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-28 21:10 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-28 21:09 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-28 21:10 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-18 16:36 . 2011-02-18 16:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2011-02-18 16:36 . 2011-02-18 16:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-02-02 20:40 . 2010-12-11 10:57 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 17:11 . 2010-07-31 18:40 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-03-18 17:57 . 2011-04-20 01:39 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-10-11 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-04 4907008]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-01-20 3563520]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-20 1451304]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2010-11-21 274608]
"OEM13Mon.exe"="c:\windows\OEM13Mon.exe" [2008-01-07 36864]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-16 13793824]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2009-06-16 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-01 21:45 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-20 06:36 1451304 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
R1 MpKsl059d5ba4;MpKsl059d5ba4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{76296B95-034E-4BAE-A588-0DE38E2F6B16}\MpKsl059d5ba4.sys [x]
R1 MpKsl0e35e201;MpKsl0e35e201;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A85744DD-B436-4AB7-8489-4D1A3B7688D7}\MpKsl0e35e201.sys [x]
R1 MpKsl15edd4fa;MpKsl15edd4fa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BA842E7F-5CD8-499D-B1BB-F651C57B27C7}\MpKsl15edd4fa.sys [x]
R1 MpKsl1f027bd5;MpKsl1f027bd5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64CA3EFD-5184-46E8-B3FF-AE04E123CCAF}\MpKsl1f027bd5.sys [x]
R1 MpKsl22aec72c;MpKsl22aec72c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7EC21DDF-7B61-4B01-A09A-E26A6FF3C704}\MpKsl22aec72c.sys [x]
R1 MpKsl23a942af;MpKsl23a942af;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3D9E3C33-B3FD-4172-B144-F862A50482C4}\MpKsl23a942af.sys [x]
R1 MpKsl29d4e984;MpKsl29d4e984;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FCD4C0E-13FF-4980-BD74-FD104215BB45}\MpKsl29d4e984.sys [x]
R1 MpKsl2a36455e;MpKsl2a36455e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3D9E3C33-B3FD-4172-B144-F862A50482C4}\MpKsl2a36455e.sys [x]
R1 MpKsl34671c43;MpKsl34671c43;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1EAF9E39-A26E-4194-BB06-875C25C84E36}\MpKsl34671c43.sys [x]
R1 MpKsl3a1516e5;MpKsl3a1516e5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FCD4C0E-13FF-4980-BD74-FD104215BB45}\MpKsl3a1516e5.sys [x]
R1 MpKsl4453f55b;MpKsl4453f55b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64CA3EFD-5184-46E8-B3FF-AE04E123CCAF}\MpKsl4453f55b.sys [x]
R1 MpKsl44854048;MpKsl44854048;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10315178-3E52-4EA6-9F81-502D87DA1D0C}\MpKsl44854048.sys [x]
R1 MpKsl46ed0474;MpKsl46ed0474;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ACD8428D-5B32-4D0C-A5E0-AD52CD52045E}\MpKsl46ed0474.sys [x]
R1 MpKsl4d2e1481;MpKsl4d2e1481;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2DE79C12-1E64-4677-95E0-0460E8116E5B}\MpKsl4d2e1481.sys [x]
R1 MpKsl616f29e3;MpKsl616f29e3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{27231138-BED7-4FE5-A0F1-0BFAEF9B3D56}\MpKsl616f29e3.sys [x]
R1 MpKsl65298408;MpKsl65298408;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FCD4C0E-13FF-4980-BD74-FD104215BB45}\MpKsl65298408.sys [x]
R1 MpKsl665c5764;MpKsl665c5764;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3218C03F-DC73-40E4-BA08-42B2034453B5}\MpKsl665c5764.sys [x]
R1 MpKsl6b835e7f;MpKsl6b835e7f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E21B2C8-FEE0-40E3-BC97-FF41FDCC6F5A}\MpKsl6b835e7f.sys [x]
R1 MpKsl6cdd9eac;MpKsl6cdd9eac;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AF7D0B90-47E9-4D1C-842E-94449A68701C}\MpKsl6cdd9eac.sys [x]
R1 MpKsl7249b573;MpKsl7249b573;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65337EDC-4DA4-4855-BCF4-B93189FA9039}\MpKsl7249b573.sys [x]
R1 MpKsl76d86933;MpKsl76d86933;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B2ED53EF-BD8B-4552-87CF-5807AF008D62}\MpKsl76d86933.sys [x]
R1 MpKsl79002210;MpKsl79002210;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ACD8428D-5B32-4D0C-A5E0-AD52CD52045E}\MpKsl79002210.sys [x]
R1 MpKsl8a07f1d3;MpKsl8a07f1d3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{390D937C-AA4C-4EF7-ADA3-EE04546D1F9E}\MpKsl8a07f1d3.sys [x]
R1 MpKsl9078bbe0;MpKsl9078bbe0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9C85C945-F51D-4568-98DB-BB67477F4506}\MpKsl9078bbe0.sys [x]
R1 MpKsl9890e981;MpKsl9890e981;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{64CA3EFD-5184-46E8-B3FF-AE04E123CCAF}\MpKsl9890e981.sys [x]
R1 MpKsl9efac3e3;MpKsl9efac3e3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E21B2C8-FEE0-40E3-BC97-FF41FDCC6F5A}\MpKsl9efac3e3.sys [x]
R1 MpKsla120204d;MpKsla120204d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AF7D0B90-47E9-4D1C-842E-94449A68701C}\MpKsla120204d.sys [x]
R1 MpKsla19e334d;MpKsla19e334d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{349A63F7-8208-4980-BD37-4D83F8649B29}\MpKsla19e334d.sys [x]
R1 MpKsla4df3f62;MpKsla4df3f62;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D1912C3F-972A-4137-A817-8B464CDA0F7C}\MpKsla4df3f62.sys [x]
R1 MpKslaa083dd1;MpKslaa083dd1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2FCD4C0E-13FF-4980-BD74-FD104215BB45}\MpKslaa083dd1.sys [x]
R1 MpKslbf9e0f08;MpKslbf9e0f08;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E21B2C8-FEE0-40E3-BC97-FF41FDCC6F5A}\MpKslbf9e0f08.sys [x]
R1 MpKsldcb01bf3;MpKsldcb01bf3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5E1A6555-A1F4-4FD3-9DFC-052D36C7C23B}\MpKsldcb01bf3.sys [x]
R1 MpKslf3776eca;MpKslf3776eca;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7AA07AC5-7517-4FF9-BE8D-DB62C1CCAC79}\MpKslf3776eca.sys [x]
R1 MpKslfd10cd6c;MpKslfd10cd6c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2DE79C12-1E64-4677-95E0-0460E8116E5B}\MpKslfd10cd6c.sys [x]
R1 MpKslfea62f1e;MpKslfea62f1e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B2ED53EF-BD8B-4552-87CF-5807AF008D62}\MpKslfea62f1e.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-11 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-11 136176]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-06-10 24576]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2010-03-25 114688]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2010-04-19 105856]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2008-02-04 77824]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-07-29 51288]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2008-06-12 43608]
S3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\DRIVERS\OEM13Vfx.sys [2007-03-05 7424]
S3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\DRIVERS\OEM13Vid.sys [2008-05-28 235840]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2010-07-31 10:14]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-11 13:12]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-11 13:12]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3345154763-3622116426-816371545-1000Core.job
- c:\users\shahbaz\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-29 16:44]
.
2011-05-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3345154763-3622116426-816371545-1000UA.job
- c:\users\shahbaz\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-29 16:44]
.
2011-04-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3345154763-3622116426-816371545-1000.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-11-05 11:33]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bbc.co.uk/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\igk5pcsv.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-05-02 02:32
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,3d,1b,b6,e9,9c,d5,40,93,f9,48,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,89,3d,1b,b6,e9,9c,d5,40,93,f9,48,\
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\S-1-5-21-3345154763-3622116426-816371545-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (Administrator)
"Progid"="IE.AssocFile.URL"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(2852)
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\program files\Common Files\Roxio Shared\9.0\DLLShared\DLAAPI_W.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\nvvsvc.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\DRIVERS\o2flash.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\RtHDVCpl.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Common Files\Teleca Shared\logger.exe
c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
c:\program files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\DbgOut.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
c:\program files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe
.
**************************************************************************
.
Completion time: 2011-05-02 02:42:05 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-02 01:42
ComboFix2.txt 2011-04-30 22:27
.
Pre-Run: 233,197,764,608 bytes free
Post-Run: 233,528,967,168 bytes free
.
- - End Of File - - B6C51E41C89F568C17F39DB77912C8EC
