Advertisement
Advertisement
 Search | |
| |
31-Mar-2012, 09:48 AM
#1 | ||||||
| Infected Last edited by Teh_Gambit; 31-Mar-2012 at 10:02 AM.. |
31-Mar-2012, 10:30 AM
#2 | ||||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
31-Mar-2012, 11:47 AM
#3 | ||||||
| It BSOD on me on the first run. Then it went fine :/ --------------------------------------------------------------------------------- ComboFix 12-03-31.02 - Alex 03/31/2012 11:36:23.2.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1464 [GMT -4:00] Running from: c:\documents and settings\Alex\Desktop\Username123.exe AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documents and settings\Amy\WINDOWS C:\install.exe c:\windows\iun6002.exe . . ((((((((((((((((((((((((( Files Created from 2012-02-28 to 2012-03-31 ))))))))))))))))))))))))))))))) . . 2012-03-31 13:55 . 2012-03-31 13:55 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll 2012-03-31 13:55 . 2012-03-31 13:55 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll 2012-03-24 15:06 . 2012-03-24 15:06 119568 ----a-w- c:\windows\system32\vb6fr.dll 2012-03-15 17:29 . 2012-03-15 17:29 -------- d-----w- c:\documents and settings\Amy\.swt 2012-03-15 16:44 . 2012-03-15 16:44 -------- d-----w- c:\program files\IrfanView 2012-03-15 15:11 . 2012-03-15 15:11 -------- d-----w- c:\program files\Common Files\Java 2012-03-15 15:10 . 2012-03-15 15:10 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-03-12 02:32 . 2012-03-12 02:32 -------- d-----w- c:\program files\Auslogics 2012-03-12 01:19 . 2012-03-12 01:19 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2012-03-10 19:07 . 2012-03-10 19:07 -------- d-----w- c:\documents and settings\Alex\Application Data\MinMaxGames 2012-03-10 03:23 . 2012-03-31 15:34 -------- d-----w- c:\documents and settings\Alex\Application Data\Dropbox 2012-03-08 03:35 . 2012-03-08 03:35 -------- d-----w- c:\program files\iPod 2012-03-08 03:35 . 2012-03-08 03:36 -------- d-----w- c:\program files\iTunes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-19 03:00 . 2011-07-21 14:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-15 15:10 . 2011-02-06 15:59 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-02-29 23:58 . 2011-11-05 21:32 881984 ----a-w- c:\windows\system32\nvgenco32.dll 2012-02-29 23:58 . 2011-11-05 21:32 1000256 ----a-w- c:\windows\system32\nvdispco32.dll 2012-02-29 23:58 . 2010-07-10 10:38 65536 ----a-w- c:\windows\system32\OpenCL.dll 2012-02-29 23:58 . 2010-07-10 10:38 5918720 ----a-w- c:\windows\system32\nvcuda.dll 2012-02-29 23:58 . 2010-07-10 10:38 2522944 ----a-w- c:\windows\system32\nvcuvid.dll 2012-02-29 23:58 . 2010-07-10 10:38 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-02-29 23:58 . 2010-07-10 10:38 17534976 ----a-w- c:\windows\system32\nvcompiler.dll 2012-02-29 23:58 . 2008-03-17 10:51 4309760 ----a-w- c:\windows\system32\nv4_disp.dll 2012-02-29 23:58 . 2008-03-17 10:51 2291712 ----a-w- c:\windows\system32\nvapi.dll 2012-02-29 23:58 . 2008-03-17 10:51 18624512 ----a-w- c:\windows\system32\nvoglnt.dll 2012-02-29 23:58 . 2008-03-17 10:51 13417632 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2012-02-29 20:30 . 2011-01-08 00:56 54272 ----a-w- c:\windows\system32\nvwddi.dll 2012-02-29 20:30 . 2011-01-08 00:56 15494464 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-29 20:30 . 2011-01-08 00:56 143680 ----a-w- c:\windows\system32\nvcolor.exe 2012-02-29 20:30 . 2011-01-08 00:56 164160 ----a-w- c:\windows\system32\nvsvc32.exe 2012-02-29 20:30 . 2011-01-08 00:56 108352 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-15 16:01 . 2011-02-06 16:25 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll 2012-02-15 16:01 . 2011-02-06 16:25 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2012-02-09 03:22 . 2011-03-26 16:44 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2012-02-09 03:21 . 2011-03-26 16:44 52096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2012-02-09 03:21 . 2011-03-26 16:44 30592 ----a-w- c:\windows\system32\LMIport.dll 2012-02-09 03:21 . 2011-03-26 16:43 87424 ----a-w- c:\windows\system32\LMIinit.dll 2012-02-03 09:22 . 2008-04-14 00:00 1860096 ----a-w- c:\windows\system32\win32k.sys 2012-01-17 12:46 . 2011-02-06 20:30 27968 ----a-w- c:\windows\system32\nvhdap32.dll 2012-01-17 12:45 . 2011-02-05 15:54 123712 ----a-w- c:\windows\system32\drivers\nvhda32.sys 2012-01-17 12:45 . 2012-02-23 03:34 876864 ----a-w- c:\windows\system32\nvhdagenco3220103.dll 2012-01-11 19:06 . 2012-02-16 05:04 3072 ------w- c:\windows\system32\iacenc.dll 2012-01-09 16:20 . 2011-02-05 15:33 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-01-07 06:30 . 2012-01-07 06:28 2829 ----a-w- c:\windows\War3Unin.pif 2012-01-07 06:30 . 2012-01-07 06:28 139264 ----a-w- c:\windows\War3Unin.exe 2012-01-05 15:48 . 2012-01-05 15:48 98304 ----a-w- c:\windows\W2BNEUnin.exe 2012-01-05 15:48 . 2012-01-05 15:48 2829 ----a-w- c:\windows\W2BNEUnin.pif 2012-03-31 13:55 . 2012-01-03 17:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2012-02-22 2761024] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2008-03-17 16858112] "Mouse Suite 98 Daemon"="ICO.EXE" [2003-11-20 57344] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240] "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-09-17 63048] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 3080264] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-07 421736] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-29 15494464] "NvMediaCenter"="NvMCTray.dll" [2012-02-29 108352] "nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-29 1634112] . c:\documents and settings\Alex\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Alex\Application Data\Dropbox\bin\Dropbox.exe [2012-2-14 24246216] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2012-02-09 03:21 87424 ----a-w- c:\windows\system32\LMIinit.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "JavaQuickStarterService"=2 (0x2) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"= "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Documents and Settings\\Alex\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Winamp\\winamp.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Look@LAN\\LookAtLan.exe"= "c:\\Program Files\\Look@LAN\\LookAtHost.exe"= "c:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"= "c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdController.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdServer.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdServices.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40k.exe"= "c:\\Documents and Settings\\Alex\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\THQ\\DarkCrusade\\DarkCrusade.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40kWA.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\World of Warcraft1\\Launcher.exe"= "c:\\Program Files\\World of Warcraft1\\BackgroundDownloader.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\solar 2\\Solar2.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Alex\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"= "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "5985:TCP"= 5985:TCP:*  isabled:Windows Remote Management "8381:TCP"= 8381:TCP:League of Legends Launcher "8381:UDP"= 8381:UDP:League of Legends Launcher "8382:TCP"= 8382:TCP:League of Legends Launcher "8382:UDP"= 8382:UDP:League of Legends Launcher "8383:TCP"= 8383:TCP:League of Legends Launcher "8383:UDP"= 8383:UDP:League of Legends Launcher "8393:TCP"= 8393:TCP:League of Legends Lobby "8393:UDP"= 8393:UDP:League of Legends Lobby "8390:TCP"= 8390:TCP:League of Legends Game Client "8390:UDP"= 8390:UDP:League of Legends Game Client "6931:TCP"= 6931:TCP:League of Legends Launcher "6931:UDP"= 6931:UDP:League of Legends Launcher . R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [12/21/2010 4:04 PM 118104] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2010 2:47 PM 103112] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/22/2011 1:03 PM 974944] R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [12/8/2010 1:11 PM 374152] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2/22/2012 11:37 PM 2348352] R2 RosettaStoneLtdController;RosettaStoneLtdController;c:\program files\RosettaStoneLtdServices\RosettaStoneLtdController.exe [9/16/2008 11:02 AM 352312] R2 RPCQT;Remote Procedure Call (CQTPM);c:\windows\System32\svchost.exe -k netsvcs [4/14/2008 12:42 AM 14336] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2/5/2011 11:54 AM 123712] R3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [9/17/2010 3:39 PM 13408] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/24/2011 7:48 PM 136176] S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/17/2010 3:40 PM 12856] S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\Drivers\Scutum50.sys --> c:\windows\system32\Drivers\Scutum50.sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/24/2011 7:48 PM 136176] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/14/2008 12:42 AM 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v040 0.exe [3/18/2010 2:16 PM 753504] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs RPCQT . Contents of the 'Scheduled Tasks' folder . 2012-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57] . 2012-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-12-24 23:48] . 2012-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-12-24 23:48] . 2012-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-2052111302-682003330-1003Core.job - c:\documents and settings\Alex\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-06 15:46] . 2012-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-2052111302-682003330-1003UA.job - c:\documents and settings\Alex\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-06 15:46] . . ------- Supplementary Scan ------- . uStart Page = hxxp://isearch.avg.com/?cid={94BCAB5A-9676-4FC9-B695-CD81FE74CB1A}&mid=acff73d85de047d191ddd154d40fb78d-0b179b9f24f5811b0655fe7c282453f0bbcdbbda&lang=en&ds=st011&pr=sa&d=2012-03-11 21:20&v=10.0.0.7&sap=hp uInternet Settings,ProxyOverride = *.local IE: &Envoyer à OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 24.200.243.189 24.200.210.241 24.200.228.113 FF - ProfilePath - c:\documents and settings\Alex\Application Data\Mozilla\Firefox\Profiles\21lj4x5f.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search . - - - - ORPHANS REMOVED - - - - . AddRemove-Look@LAN_1.0 - c:\windows\iun6002.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-03-31 11:43 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*] "value"="?\0c\00\04\125&e" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(720) c:\windows\system32\LMIinit.dll c:\windows\system32\LMIRfsClientNP.dll . - - - - - - - > 'lsass.exe'(784) c:\windows\system32\LMIRfsClientNP.dll . Completion time: 2012-03-31 11:44:35 ComboFix-quarantined-files.txt 2012-03-31 15:44 . Pre-Run: 115,333,836,800 bytes free Post-Run: 115,340,046,336 bytes free . - - End Of File - - 2E9C55081A0BA832252DD318471B3529 |
31-Mar-2012, 04:02 PM
#4 | ||||||
| |
31-Mar-2012, 04:40 PM
#5 | ||||||
| Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press SAVE and choose desktop in the list of selections in that window & press save) Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished Close any open browsers Then drag the CFScript.txt into the ComboFix.exe or renamed combofix icon as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply . Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
31-Mar-2012, 10:45 PM
#6 | ||||||
| ComboFix 12-03-31.03 - Alex 03/31/2012 22:23:54.3.4 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1349 [GMT -4:00] Running from: c:\documents and settings\Alex\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Alex\My Documents\Downloads\CFScript.txt AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_RPCQT -------\Service_RPCQT . . ((((((((((((((((((((((((( Files Created from 2012-03-01 to 2012-04-01 ))))))))))))))))))))))))))))))) . . 2012-03-31 17:38 . 2012-03-31 17:38 -------- d-----w- c:\windows\Performance 2012-03-31 17:38 . 2012-03-31 17:38 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\Microsoft Corporation 2012-03-31 17:37 . 2012-03-31 17:37 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor 2012-03-31 13:55 . 2012-03-31 13:55 592824 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll 2012-03-31 13:55 . 2012-03-31 13:55 44472 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll 2012-03-24 15:06 . 2012-03-24 15:06 119568 ----a-w- c:\windows\system32\vb6fr.dll 2012-03-15 17:29 . 2012-03-15 17:29 -------- d-----w- c:\documents and settings\Amy\.swt 2012-03-15 16:44 . 2012-03-15 16:44 -------- d-----w- c:\program files\IrfanView 2012-03-15 15:11 . 2012-03-15 15:11 -------- d-----w- c:\program files\Common Files\Java 2012-03-15 15:10 . 2012-03-15 15:10 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-03-12 02:32 . 2012-03-12 02:32 -------- d-----w- c:\program files\Auslogics 2012-03-12 01:19 . 2012-03-12 01:19 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files 2012-03-10 19:07 . 2012-03-10 19:07 -------- d-----w- c:\documents and settings\Alex\Application Data\MinMaxGames 2012-03-10 03:23 . 2012-04-01 02:37 -------- d-----w- c:\documents and settings\Alex\Application Data\Dropbox 2012-03-08 03:35 . 2012-03-08 03:35 -------- d-----w- c:\program files\iPod 2012-03-08 03:35 . 2012-03-08 03:36 -------- d-----w- c:\program files\iTunes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-03-19 03:00 . 2011-07-21 14:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-03-15 15:10 . 2011-02-06 15:59 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-02-29 23:58 . 2011-11-05 21:32 881984 ----a-w- c:\windows\system32\nvgenco32.dll 2012-02-29 23:58 . 2011-11-05 21:32 1000256 ----a-w- c:\windows\system32\nvdispco32.dll 2012-02-29 23:58 . 2010-07-10 10:38 65536 ----a-w- c:\windows\system32\OpenCL.dll 2012-02-29 23:58 . 2010-07-10 10:38 5918720 ----a-w- c:\windows\system32\nvcuda.dll 2012-02-29 23:58 . 2010-07-10 10:38 2522944 ----a-w- c:\windows\system32\nvcuvid.dll 2012-02-29 23:58 . 2010-07-10 10:38 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-02-29 23:58 . 2010-07-10 10:38 17534976 ----a-w- c:\windows\system32\nvcompiler.dll 2012-02-29 23:58 . 2008-03-17 10:51 4309760 ----a-w- c:\windows\system32\nv4_disp.dll 2012-02-29 23:58 . 2008-03-17 10:51 2291712 ----a-w- c:\windows\system32\nvapi.dll 2012-02-29 23:58 . 2008-03-17 10:51 18624512 ----a-w- c:\windows\system32\nvoglnt.dll 2012-02-29 23:58 . 2008-03-17 10:51 13417632 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2012-02-29 20:30 . 2011-01-08 00:56 54272 ----a-w- c:\windows\system32\nvwddi.dll 2012-02-29 20:30 . 2011-01-08 00:56 15494464 ----a-w- c:\windows\system32\nvcpl.dll 2012-02-29 20:30 . 2011-01-08 00:56 143680 ----a-w- c:\windows\system32\nvcolor.exe 2012-02-29 20:30 . 2011-01-08 00:56 164160 ----a-w- c:\windows\system32\nvsvc32.exe 2012-02-29 20:30 . 2011-01-08 00:56 108352 ----a-w- c:\windows\system32\nvmctray.dll 2012-02-15 16:01 . 2011-02-06 16:25 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll 2012-02-15 16:01 . 2011-02-06 16:25 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2012-02-09 03:22 . 2011-03-26 16:44 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll 2012-02-09 03:21 . 2011-03-26 16:44 52096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll 2012-02-09 03:21 . 2011-03-26 16:44 30592 ----a-w- c:\windows\system32\LMIport.dll 2012-02-09 03:21 . 2011-03-26 16:43 87424 ----a-w- c:\windows\system32\LMIinit.dll 2012-02-03 09:22 . 2008-04-14 00:00 1860096 ----a-w- c:\windows\system32\win32k.sys 2012-01-17 12:46 . 2011-02-06 20:30 27968 ----a-w- c:\windows\system32\nvhdap32.dll 2012-01-17 12:45 . 2011-02-05 15:54 123712 ----a-w- c:\windows\system32\drivers\nvhda32.sys 2012-01-17 12:45 . 2012-02-23 03:34 876864 ----a-w- c:\windows\system32\nvhdagenco3220103.dll 2012-01-11 19:06 . 2012-02-16 05:04 3072 ------w- c:\windows\system32\iacenc.dll 2012-01-09 16:20 . 2011-02-05 15:33 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-01-07 06:30 . 2012-01-07 06:28 2829 ----a-w- c:\windows\War3Unin.pif 2012-01-07 06:30 . 2012-01-07 06:28 139264 ----a-w- c:\windows\War3Unin.exe 2012-01-05 15:48 . 2012-01-05 15:48 98304 ----a-w- c:\windows\W2BNEUnin.exe 2012-01-05 15:48 . 2012-01-05 15:48 2829 ----a-w- c:\windows\W2BNEUnin.pif 2012-03-31 13:55 . 2012-01-03 17:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-03-31_15.43.25 ))))))))))))))))))))))))))))))))))))))))) . + 2012-04-01 02:33 . 2012-04-01 02:33 16384 c:\windows\Temp\Perflib_Perfdata_104.dat + 2012-03-31 17:37 . 2012-03-31 17:37 602624 c:\windows\Installer\63b5f3.msi + 2008-03-20 23:06 . 2009-06-25 17:20 1485176 c:\windows\system32\LegitCheckControl.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shell iconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-14 22:58 94208 ----a-w- c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2012-02-22 2761024] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2008-03-17 16858112] "Mouse Suite 98 Daemon"="ICO.EXE" [2003-11-20 57344] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240] "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-09-17 63048] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 3080264] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-07 421736] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-29 15494464] "NvMediaCenter"="NvMCTray.dll" [2012-02-29 108352] "nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-29 1634112] . c:\documents and settings\Alex\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Alex\Application Data\Dropbox\bin\Dropbox.exe [2012-2-14 24246216] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2012-02-09 03:21 87424 ----a-w- c:\windows\system32\LMIinit.dll . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "JavaQuickStarterService"=2 (0x2) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"= "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Documents and Settings\\Alex\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Winamp\\winamp.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Look@LAN\\LookAtLan.exe"= "c:\\Program Files\\Look@LAN\\LookAtHost.exe"= "c:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"= "c:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdController.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdServer.exe"= "c:\\Program Files\\RosettaStoneLtdServices\\RosettaStoneLtdServices.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40k.exe"= "c:\\Documents and Settings\\Alex\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\THQ\\DarkCrusade\\DarkCrusade.exe"= "c:\\Program Files\\THQ\\Dawn Of War\\W40kWA.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "c:\\Program Files\\World of Warcraft1\\Launcher.exe"= "c:\\Program Files\\World of Warcraft1\\BackgroundDownloader.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\solar 2\\Solar2.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Alex\\Application Data\\Dropbox\\bin\\Dropbox.exe"= "c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"= "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "5985:TCP"= 5985:TCP:* isabled:Windows Remote Management "8381:TCP"= 8381:TCP:League of Legends Launcher "8381:UDP"= 8381:UDP:League of Legends Launcher "8382:TCP"= 8382:TCP:League of Legends Launcher "8382:UDP"= 8382:UDP:League of Legends Launcher "8383:TCP"= 8383:TCP:League of Legends Launcher "8383:UDP"= 8383:UDP:League of Legends Launcher "8393:TCP"= 8393:TCP:League of Legends Lobby "8393:UDP"= 8393:UDP:League of Legends Lobby "8390:TCP"= 8390:TCP:League of Legends Game Client "8390:UDP"= 8390:UDP:League of Legends Game Client "6931:TCP"= 6931:TCP:League of Legends Launcher "6931:UDP"= 6931:UDP:League of Legends Launcher . R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [12/21/2010 4:04 PM 118104] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2010 2:47 PM 103112] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/22/2011 1:03 PM 974944] R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [12/8/2010 1:11 PM 374152] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [9/17/2010 3:40 PM 12856] R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2/22/2012 11:37 PM 2348352] R2 RosettaStoneLtdController;RosettaStoneLtdController;c:\program files\RosettaStoneLtdServices\RosettaStoneLtdController.exe [9/16/2008 11:02 AM 352312] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2/5/2011 11:54 AM 123712] R3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [9/17/2010 3:39 PM 13408] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/24/2011 7:48 PM 136176] S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\Drivers\Scutum50.sys --> c:\windows\system32\Drivers\Scutum50.sys [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/24/2011 7:48 PM 136176] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880] S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 10:37 PM 4640000] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/14/2008 12:42 AM 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v040 0.exe [3/18/2010 2:16 PM 753504] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WINRM REG_MULTI_SZ WINRM HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Contents of the 'Scheduled Tasks' folder . 2012-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57] . 2012-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-12-24 23:48] . 2012-03-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2011-12-24 23:48] . 2012-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-2052111302-682003330-1003Core.job - c:\documents and settings\Alex\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-06 15:46] . 2012-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1343024091-2052111302-682003330-1003UA.job - c:\documents and settings\Alex\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-02-06 15:46] . . ------- Supplementary Scan ------- . uStart Page = hxxp://isearch.avg.com/?cid={94BCAB5A-9676-4FC9-B695-CD81FE74CB1A}&mid=acff73d85de047d191ddd154d40fb78d-0b179b9f24f5811b0655fe7c282453f0bbcdbbda&lang=en&ds=st011&pr=sa&d=2012-03-11 21:20&v=10.0.0.7&sap=hp uInternet Settings,ProxyOverride = *.local IE: &Envoyer à OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 24.200.243.189 24.200.210.241 24.200.228.113 FF - ProfilePath - c:\documents and settings\Alex\Application Data\Mozilla\Firefox\Profiles\21lj4x5f.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-03-31 22:37 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*] "value"="?\0c\00\04\125&e" . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents] @Denied: (Full) (LocalSystem) "OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(732) c:\windows\system32\LMIinit.dll c:\windows\system32\LMIRfsClientNP.dll . - - - - - - - > 'lsass.exe'(788) c:\windows\system32\LMIRfsClientNP.dll . - - - - - - - > 'explorer.exe'(3344) c:\windows\system32\WININET.dll c:\documents and settings\Alex\Application Data\Dropbox\bin\DropboxExt.14.dll c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\LogMeIn\x86\RaMaint.exe c:\program files\LogMeIn\x86\LogMeIn.exe c:\program files\CDBurnerXP\NMSAccessU.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\RosettaStoneLtdServices\RosettaStoneLtdServer.exe c:\windows\RTHDCPL.EXE c:\windows\system32\ICO.EXE c:\windows\system32\RunDLL32.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2012-03-31 22:39:32 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-01 02:39 . Pre-Run: 115,601,477,632 bytes free Post-Run: 116,023,410,688 bytes free . - - End Of File - - D7D238F4E77FE06A3BAC962043E4D13B |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
