API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jun 30th, 2012
902
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.59 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 12-06-30.01 - Paul 06/30/2012 13:41:39.1.4 - x64
  2. Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12256.9796 [GMT -4:00]
  3. Running from: c:\users\Paul\Desktop\ComboFix.exe
  4. AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
  5. SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
  6. SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  7. .
  8. .
  9. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  10. .
  11. .
  12. C:\install.exe
  13. c:\programdata\1340699150.bdinstall.bin
  14. c:\programdata\adobe_pdf_icon.ico
  15. c:\programdata\Icon_1.ico
  16. c:\programdata\icon18.ico
  17. c:\users\Paul\AppData\Roaming\Microsoft\Windows\Recent\Crysis 2.url
  18. c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\7ubuurk3.default\searchplugins\bing-zugo.xml
  19. c:\users\Paul\AppData\Roaming\RSBuddy_supa sord .ini
  20. c:\windows\apppatch\AppLoc.exe
  21. c:\windows\apppatch\AppLocA.exe
  22. c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
  23. c:\windows\apppatch\unins000.dat
  24. c:\windows\apppatch\unins000.exe
  25. c:\windows\RazorDOX
  26. c:\windows\RazorDOX\RazorDOX.dll
  27. c:\windows\SysWow64\logs
  28. c:\windows\SysWow64\logs\Game - R3d Logs\2012-02-25_16-11-06_r3dlog.txt
  29. c:\windows\SysWow64\setup.ini
  30. c:\windows\SysWow64\tmp43EA.tmp
  31. c:\windows\SysWow64\tmp8343.tmp
  32. c:\windows\SysWow64\tmp8344.tmp
  33. c:\windows\SysWow64\tmpC80F.tmp
  34. c:\windows\SysWow64\tmpC89D.tmp
  35. .
  36. .
  37. ((((((((((((((((((((((((( Files Created from 2012-05-28 to 2012-06-30 )))))))))))))))))))))))))))))))
  38. .
  39. .
  40. 2012-06-30 17:46 . 2012-06-30 17:46 -------- d-----w- c:\users\UpdatusUser.COCAIN-PC\AppData\Local\temp
  41. 2012-06-30 17:46 . 2012-06-30 17:46 -------- d-----w- c:\users\Default\AppData\Local\temp
  42. 2012-06-30 17:25 . 2012-06-30 17:32 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5810D0DC-964F-44DF-B4F0-647816093513}\offreg.dll
  43. 2012-06-30 17:11 . 2012-06-30 17:11 -------- d-----w- C:\_OTL
  44. 2012-06-30 16:01 . 2012-06-30 16:04 -------- d-----w- c:\users\Paul\AppData\Roaming\TinyWall
  45. 2012-06-30 16:00 . 2012-06-30 17:24 -------- d-----w- c:\programdata\TinyWall
  46. 2012-06-30 16:00 . 2012-06-30 16:01 -------- d-----w- c:\program files (x86)\TinyWall
  47. 2012-06-30 15:59 . 2012-06-30 15:59 388096 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
  48. 2012-06-30 15:59 . 2012-06-30 15:59 -------- d-----w- c:\program files (x86)\Trend Micro
  49. 2012-06-30 15:29 . 2012-06-30 15:29 -------- d-----w- c:\programdata\CPA_VA
  50. 2012-06-30 15:26 . 2012-06-30 17:34 -------- d-----w- c:\programdata\Spybot - Search & Destroy
  51. 2012-06-30 15:26 . 2012-06-30 17:34 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
  52. 2012-06-30 15:24 . 2012-06-30 15:25 -------- d-----w- c:\programdata\Comodo
  53. 2012-06-30 15:24 . 2012-06-30 15:29 -------- d-----w- c:\program files\COMODO
  54. 2012-06-30 12:47 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5810D0DC-964F-44DF-B4F0-647816093513}\mpengine.dll
  55. 2012-06-29 09:06 . 2012-06-29 09:06 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
  56. 2012-06-29 09:06 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
  57. 2012-06-29 05:43 . 2012-05-31 04:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  58. 2012-06-28 19:44 . 2012-06-28 19:44 -------- d-----w- c:\program files\MoparScape
  59. 2012-06-28 18:10 . 2012-06-28 18:10 -------- d-----w- c:\program files (x86)\Common Files\Java
  60. 2012-06-28 18:10 . 2012-06-28 18:10 -------- d-----w- c:\program files (x86)\Oracle
  61. 2012-06-28 18:10 . 2012-05-04 23:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
  62. 2012-06-28 18:09 . 2012-06-28 18:09 -------- d-----w- c:\programdata\McAfee
  63. 2012-06-26 08:25 . 2012-06-26 08:25 -------- d-----w- c:\program files\Common Files\Bitdefender
  64. 2012-06-23 17:52 . 2012-06-23 17:53 -------- d-----w- c:\users\Paul\AppData\Roaming\iZotope
  65. 2012-06-23 17:51 . 2012-06-23 17:51 -------- d-----w- c:\program files (x86)\iZotope
  66. 2012-06-23 17:51 . 2012-06-23 17:51 -------- d-----w- c:\program files\Common Files\VST3
  67. 2012-06-23 05:31 . 2012-02-10 03:14 6074176 ----a-w- c:\windows\system32\nvcpl.dll
  68. 2012-06-23 05:31 . 2012-02-10 03:14 3089728 ----a-w- c:\windows\system32\nvsvc64.dll
  69. 2012-06-23 05:31 . 2012-02-10 03:07 2561856 ----a-w- c:\windows\system32\nvsvcr.dll
  70. 2012-06-23 05:31 . 2012-02-10 03:07 889664 ----a-w- c:\windows\system32\nvvsvc.exe
  71. 2012-06-23 05:31 . 2012-02-10 03:07 63296 ----a-w- c:\windows\system32\nvshext.dll
  72. 2012-06-23 05:31 . 2012-02-10 03:07 118080 ----a-w- c:\windows\system32\nvmctray.dll
  73. 2012-06-23 05:31 . 2012-02-10 03:05 2497985 ----a-w- c:\windows\system32\nvcoproc.bin
  74. 2012-06-23 05:24 . 2012-06-23 05:24 -------- d-----w- c:\programdata\NVIDIA Corporation
  75. 2012-06-23 04:57 . 2012-06-23 05:22 -------- d-----w- c:\programdata\NVIDIA
  76. 2012-06-20 02:23 . 2012-06-20 02:23 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
  77. 2012-06-19 19:19 . 2012-06-19 19:19 -------- d-----w- c:\program files (x86)\Origin Games
  78. 2012-06-19 19:19 . 2012-06-19 19:19 -------- d-----w- c:\users\Paul\AppData\Local\Origin
  79. 2012-06-19 19:18 . 2012-06-19 19:18 -------- d-----w- c:\program files (x86)\Origin
  80. 2012-06-19 07:31 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
  81. 2012-06-19 07:31 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
  82. 2012-06-19 07:31 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
  83. 2012-06-19 07:31 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
  84. 2012-06-19 07:30 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
  85. 2012-06-19 07:30 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
  86. 2012-06-19 07:30 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
  87. 2012-06-19 07:30 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
  88. 2012-06-19 07:30 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
  89. 2012-06-17 05:24 . 2012-06-17 05:24 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
  90. 2012-06-17 05:24 . 2012-06-17 05:24 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
  91. 2012-06-14 02:02 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll
  92. 2012-06-14 02:02 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
  93. 2012-06-14 02:02 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
  94. 2012-06-14 02:02 . 2012-05-01 05:40 209920 ----a-w- c:\windows\system32\profsvc.dll
  95. 2012-06-14 02:02 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
  96. 2012-06-14 02:02 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
  97. 2012-06-14 02:02 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
  98. 2012-06-14 02:02 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys
  99. 2012-06-14 02:02 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
  100. 2012-06-14 02:01 . 2012-04-07 12:31 3216384 ----a-w- c:\windows\system32\msi.dll
  101. 2012-06-14 02:01 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\SysWow64\msi.dll
  102. 2012-06-14 02:01 . 2012-04-24 05:37 184320 ----a-w- c:\windows\system32\cryptsvc.dll
  103. 2012-06-14 02:01 . 2012-04-24 05:37 140288 ----a-w- c:\windows\system32\cryptnet.dll
  104. 2012-06-14 02:01 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll
  105. 2012-06-14 02:01 . 2012-04-24 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
  106. 2012-06-14 02:01 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll
  107. 2012-06-14 02:01 . 2012-04-24 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
  108. 2012-06-12 18:17 . 2012-02-10 09:34 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2AEBE2BB-749B-40B5-B048-BD09239ED3BE}\gapaengine.dll
  109. 2012-06-03 18:16 . 2012-06-03 18:16 -------- d-----w- c:\users\Paul\AppData\Roaming\Malwarebytes
  110. 2012-06-03 18:16 . 2012-06-03 18:16 -------- d-----w- c:\programdata\Malwarebytes
  111. 2012-06-03 01:23 . 2012-06-03 01:23 -------- d-----w- C:\Riot Games
  112. .
  113. .
  114. .
  115. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  116. .
  117. 2012-06-23 01:45 . 2011-05-20 04:02 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
  118. 2012-06-23 01:45 . 2011-05-20 04:02 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
  119. 2012-06-23 01:45 . 2011-05-20 04:02 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
  120. 2012-06-20 02:31 . 2011-05-20 04:02 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
  121. 2012-05-15 06:21 . 2012-05-15 06:21 423744 ----a-w- c:\windows\SysWow64\nvStreaming.exe
  122. 2012-05-04 23:29 . 2011-05-19 23:45 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
  123. 2012-04-28 03:33 . 2012-04-28 03:33 225280 ----atw- c:\users\Paul\AppData\Roaming\Microsoft\AdjMmsVista.dll
  124. 2012-04-17 21:18 . 2012-04-17 21:18 140664 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{6CDC43A5-83FD-42F2-A6C1-92BEC6A0698E}\ShortcutUpdater_B4EEAB5A25624B9CB01E300A7199EE30.exe
  125. 2012-04-17 21:18 . 2012-04-17 21:18 140664 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{6CDC43A5-83FD-42F2-A6C1-92BEC6A0698E}\ARPPRODUCTICON.exe
  126. 2012-04-17 21:16 . 2012-04-17 21:16 136568 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{E3AC9740-66D4-412F-AE55-DD0428F78175}\RazerZoneWebsite_51B2803B39F24EC28AFA6EFC67070FD2.exe
  127. 2012-04-17 21:16 . 2012-04-17 21:16 136568 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{E3AC9740-66D4-412F-AE55-DD0428F78175}\NewShortcut2_E032CCCB26C04AAEA5D133D9643D20E8.exe
  128. 2012-04-17 21:16 . 2012-04-17 21:16 136568 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{E3AC9740-66D4-412F-AE55-DD0428F78175}\BWConfig_14BFF80D8D994A26B6FD51288576B324.exe
  129. 2012-04-17 21:16 . 2012-04-17 21:16 136568 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{E3AC9740-66D4-412F-AE55-DD0428F78175}\ARPPRODUCTICON.exe
  130. 2010-08-03 16:11 819200 --sha-w- c:\windows\SysWOW64\xvidcore.dll
  131. 2010-08-03 16:11 180224 --sha-w- c:\windows\SysWOW64\xvidvfw.dll
  132. .
  133. .
  134. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  135. .
  136. .
  137. *Note* empty entries & legit default entries are not shown
  138. REGEDIT4
  139. .
  140. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
  141. @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
  142. [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
  143. 2011-02-18 05:12 94208 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  144. .
  145. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
  146. @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
  147. [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
  148. 2011-02-18 05:12 94208 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  149. .
  150. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
  151. @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
  152. [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
  153. 2011-02-18 05:12 94208 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  154. .
  155. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
  156. @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
  157. [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
  158. 2011-02-18 05:12 94208 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  159. .
  160. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  161. "Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2010-11-21 1174016]
  162. "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-06-05 17344176]
  163. "SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-05-31 694032]
  164. .
  165. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  166. "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
  167. "Lycosa"="c:\program files (x86)\Razer\Razer Lycosa\razerhid.exe" [2011-03-22 233984]
  168. "Razer Naga Driver"="c:\program files (x86)\Razer\Naga\RazerNagaSysTray.exe" [2011-04-12 953232]
  169. "Live Update 5"="c:\program files (x86)\MSI\Live Update 5\LU5.exe" [2011-10-11 1833488]
  170. "THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2010-11-01 1374720]
  171. "Razer Blackwidow Driver"="c:\program files (x86)\Razer\BlackWidow Ultimate\BlackWidowUltimateTray.exe" [2011-05-16 887712]
  172. "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
  173. .
  174. c:\users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
  175. Dropbox.lnk - c:\users\Paul\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
  176. sidebar.lnk - c:\program files (x86)\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
  177. .
  178. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  179. "ConsentPromptBehaviorAdmin"= 0 (0x0)
  180. "ConsentPromptBehaviorUser"= 3 (0x3)
  181. "EnableLUA"= 0 (0x0)
  182. "EnableUIADesktopToggle"= 0 (0x0)
  183. "PromptOnSecureDesktop"= 0 (0x0)
  184. .
  185. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  186. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  187. .
  188. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
  189. @="Service"
  190. .
  191. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  192. @="Service"
  193. .
  194. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
  195. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
  196. "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
  197. "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  198. "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
  199. "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
  200. "Super-Charger"=c:\program files (x86)\MSI\Super-Charger\StartSuperCharger.exe
  201. "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
  202. "UpdReg"=c:\windows\UpdReg.EXE
  203. .
  204. R2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
  205. R2 AntiVirMailService;Avira Mail Protection;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
  206. R2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-09-23 86224]
  207. R2 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
  208. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  209. R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-05 160944]
  210. R2 WdiSystemHost32;Diagnostic System Host ;c:\windows\system32\iprtrmgr32.exe [x]
  211. R3 ALSysIO;ALSysIO;c:\users\Paul\AppData\Local\Temp\ALSysIO64.sys [x]
  212. R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-04-20 9319936]
  213. R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-04-20 306176]
  214. R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\S.A.D\CyberGhost VPN\CGVPNCliService.exe [2011-07-08 2428968]
  215. R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
  216. R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-03-01 130976]
  217. R3 gbxavs;Maschine Midi;c:\windows\system32\Drivers\gbxavs.sys [2010-10-20 353360]
  218. R3 gbxusb_svc;Maschine Controller;c:\windows\system32\Drivers\gbxusb.sys [2010-10-20 68688]
  219. R3 kx1avs_x64;kx1avs_x64;c:\windows\system32\Drivers\kx1avs_x64.sys [2009-12-07 45136]
  220. R3 kx1usb_x64;kx1usb_x64;c:\windows\system32\Drivers\kx1usb_x64.sys [2009-12-07 300624]
  221. R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [2010-09-08 28928]
  222. R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-20 113120]
  223. R3 MSICDSetup;MSICDSetup;D:\CDriver64.sys [x]
  224. R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]
  225. R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
  226. R3 NTIOLib_1_0_3;NTIOLib_1_0_3;c:\program files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [2010-07-12 14136]
  227. R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files (x86)\Setup Files\Ms7681v1C0\NTIOLib_X64.sys [2011-01-06 11888]
  228. R3 NTIOLib_1_0_8;NTIOLib_1_0_8;c:\progra~1\MSI\MSIWDev\NTIOLib_X64.sys [2011-01-27 11888]
  229. R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
  230. R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-04-10 50720]
  231. R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  232. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
  233. R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
  234. R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
  235. R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-02 51712]
  236. R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-21 1255736]
  237. R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
  238. S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2011-09-16 139512]
  239. S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-16 27760]
  240. S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
  241. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-20 203776]
  242. S2 DJM-900nexus_AutoSetup;DJM-900nexus_AutoSetup;c:\program files (x86)\Pioneer\DJM-900nexus\DJM-900nexus_AutoSetup.exe [2010-12-29 57344]
  243. S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
  244. S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
  245. S2 PaceLicenseDServices;PACE License Services;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [2011-07-09 2932224]
  246. S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]
  247. S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
  248. S2 TinyWall;TinyWall Service;c:\program files (x86)\TinyWall\TinyWall.exe [2012-06-23 623272]
  249. S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2011-12-08 2028864]
  250. S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]
  251. S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2011-09-16 113768]
  252. S3 DJM-900nexusAudio;DJM-900nexus WDM Audio;c:\windows\system32\drivers\DJM-900nexusAudio64.sys [2011-05-23 48768]
  253. S3 kx1avs;Traktor Kontrol X1 Midi;c:\windows\system32\Drivers\kx1avs.sys [2010-10-20 353360]
  254. S3 kx1usb_svc;Traktor Kontrol X1;c:\windows\system32\Drivers\kx1usb.sys [2010-10-20 70736]
  255. S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
  256. S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344]
  257. S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
  258. S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\progra~1\MSI\MSIWDev\msibios64_100507.sys [2010-05-10 33592]
  259. S3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [2010-10-22 14136]
  260. S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]
  261. S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]
  262. S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-11-11 155752]
  263. S3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys [2010-05-27 14648]
  264. S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]
  265. S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-01-06 676864]
  266. S3 RzSynapse;Razer Driver;c:\windows\system32\DRIVERS\RzSynapse.sys [2011-05-12 154624]
  267. S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2011-02-10 11856]
  268. S3 VKbms;Virtual HID Minidriver;c:\windows\system32\DRIVERS\VKbms.sys [2010-10-01 13312]
  269. S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
  270. .
  271. .
  272. --- Other Services/Drivers In Memory ---
  273. .
  274. *NewlyCreated* - NTIOLIB_1_0_1
  275. *Deregistered* - NTIOLib_1_0_1
  276. .
  277. Contents of the 'Scheduled Tasks' folder
  278. .
  279. 2012-06-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1816576451-940877209-2385228107-1000Core.job
  280. - c:\users\Paul\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-27 01:20]
  281. .
  282. 2012-06-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1816576451-940877209-2385228107-1000UA.job
  283. - c:\users\Paul\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-27 01:20]
  284. .
  285. .
  286. --------- X64 Entries -----------
  287. .
  288. .
  289. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
  290. @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
  291. [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
  292. 2011-02-18 05:12 97792 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  293. .
  294. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
  295. @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
  296. [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
  297. 2011-02-18 05:12 97792 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  298. .
  299. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
  300. @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
  301. [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
  302. 2011-02-18 05:12 97792 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  303. .
  304. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
  305. @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
  306. [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
  307. 2011-02-18 05:12 97792 ----a-w- c:\users\Paul\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  308. .
  309. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  310. "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-01-04 6602856]
  311. "IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
  312. "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
  313. "TinyWall Controller"="c:\program files (x86)\TinyWall\TinyWall.exe" [2012-06-23 623272]
  314. .
  315. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  316. "LoadAppInit_DLLs"=0x1
  317. .
  318. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
  319. UxTuneUp
  320. .
  321. ------- Supplementary Scan -------
  322. .
  323. uInternet Settings,ProxyOverride = *.local
  324. LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
  325. Trusted Zone: com\www.msi
  326. Trusted Zone: com.tw\asia.msi
  327. Trusted Zone: com.tw\global.msi
  328. TCP: DhcpNameServer = 192.168.1.1
  329. FF - ProfilePath - c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\7ubuurk3.default\
  330. FF - prefs.js: browser.startup.homepage - google.com
  331. FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z131&form=ZGAADF&install_date=20111208&q=
  332. FF - user.js: network.http.max-persistent-connections-per-server - 4
  333. FF - user.js: nglayout.initialpaint.delay - 600
  334. FF - user.js: content.notify.interval - 600000
  335. FF - user.js: content.max.tokenizing.time - 1800000
  336. FF - user.js: content.switch.threshold - 600000
  337. FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101641
  338. FF - user.js: extensions.BabylonToolbar_i.babExt -
  339. FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
  340. FF - user.js: extensions.BabylonToolbar_i.id - 4eddbc4300000000000000ff265c9e01
  341. FF - user.js: extensions.BabylonToolbar_i.hardId - 4eddbc4300000000000000ff265c9e01
  342. FF - user.js: extensions.BabylonToolbar_i.instlDay - 15392
  343. FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
  344. FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
  345. FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.171:20
  346. FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
  347. FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
  348. FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
  349. FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
  350. FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
  351. FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
  352. .
  353. - - - - ORPHANS REMOVED - - - -
  354. .
  355. URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
  356. AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
  357. AddRemove-{9143B17E-BBDE-4EA7-A4E3-20D384D9C8A5}_is1 - c:\windows\AppPatch\unins000.exe
  358. AddRemove-{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA} - c:\users\Paul\AppData\Local\{784E3329-1B2A-421E-9427-596088B766F6}\setup_blazemp.exe
  359. .
  360. .
  361. .
  362. --------------------- LOCKED REGISTRY KEYS ---------------------
  363. .
  364. [HKEY_USERS\S-1-5-21-1816576451-940877209-2385228107-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
  365. @Denied: (2) (LocalSystem)
  366. "Progid"="WindowsLiveMail.Email.1"
  367. .
  368. [HKEY_USERS\S-1-5-21-1816576451-940877209-2385228107-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
  369. @Denied: (2) (LocalSystem)
  370. "Progid"="WindowsLiveMail.VCard.1"
  371. .
  372. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  373. @Denied: (A 2) (Everyone)
  374. @="FlashBroker"
  375. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
  376. .
  377. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  378. "Enabled"=dword:00000001
  379. .
  380. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  381. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
  382. .
  383. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  384. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  385. .
  386. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  387. @Denied: (A 2) (Everyone)
  388. @="Shockwave Flash Object"
  389. .
  390. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  391. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
  392. "ThreadingModel"="Apartment"
  393. .
  394. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  395. @="0"
  396. .
  397. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  398. @="ShockwaveFlash.ShockwaveFlash.10"
  399. .
  400. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  401. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
  402. .
  403. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  404. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  405. .
  406. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  407. @="1.0"
  408. .
  409. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  410. @="ShockwaveFlash.ShockwaveFlash"
  411. .
  412. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  413. @Denied: (A 2) (Everyone)
  414. @="Macromedia Flash Factory Object"
  415. .
  416. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  417. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
  418. "ThreadingModel"="Apartment"
  419. .
  420. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  421. @="FlashFactory.FlashFactory.1"
  422. .
  423. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  424. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
  425. .
  426. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  427. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  428. .
  429. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  430. @="1.0"
  431. .
  432. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  433. @="FlashFactory.FlashFactory"
  434. .
  435. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  436. @Denied: (A 2) (Everyone)
  437. @="IFlashBroker4"
  438. .
  439. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  440. @="{00020424-0000-0000-C000-000000000046}"
  441. .
  442. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  443. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  444. "Version"="1.0"
  445. .
  446. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  447. @Denied: (Full) (Everyone)
  448. .
  449. Completion time: 2012-06-30 13:48:47
  450. ComboFix-quarantined-files.txt 2012-06-30 17:48
  451. .
  452. Pre-Run: 143,491,940,352 bytes free
  453. Post-Run: 143,112,605,696 bytes free
  454. .
  455. - - End Of File - - 2549223875FC0446794F50229B7D6670
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!