API tools faq
paste
Ressy

Untitled

Ressy
Feb 10th, 2011
131
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 30.12 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-02-09.05 - RUSSELL 02/10/2011 13:54:02.1.4 - x64
  2. Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.1454 [GMT -5:00]
  3. Running from: c:\users\RUSSELL\Downloads\ComboFix.exe
  4. AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
  5. SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
  6. SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  7. .
  8.  
  9. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  10. .
  11.  
  12. C:\settingsxx.exe
  13. c:\settingsxx.exe\config.bin
  14. c:\users\RUSSELL\g2ax_customer_downloadhelper_win32_x86.exe
  15. c:\windows\Downloaded Program Files\x64
  16. c:\windows\Downloaded Program Files\x64\racodec.ax
  17. c:\windows\Downloaded Program Files\x86
  18. c:\windows\Downloaded Program Files\x86\racodec.ax
  19. c:\windows\SysWow64\html
  20. c:\windows\SysWow64\html\calendar.html
  21. c:\windows\SysWow64\html\calendarbottom.html
  22. c:\windows\SysWow64\html\calendartop.html
  23. c:\windows\SysWow64\html\crystalexportdialog.htm
  24. c:\windows\SysWow64\html\crystalprinthost.html
  25. c:\windows\SysWow64\images
  26. c:\windows\SysWow64\images\toolbar\calendar.gif
  27. c:\windows\SysWow64\images\toolbar\crlogo.gif
  28. c:\windows\SysWow64\images\toolbar\export.gif
  29. c:\windows\SysWow64\images\toolbar\export_over.gif
  30. c:\windows\SysWow64\images\toolbar\exportd.gif
  31. c:\windows\SysWow64\images\toolbar\First.gif
  32. c:\windows\SysWow64\images\toolbar\first_over.gif
  33. c:\windows\SysWow64\images\toolbar\Firstd.gif
  34. c:\windows\SysWow64\images\toolbar\gotopage.gif
  35. c:\windows\SysWow64\images\toolbar\gotopage_over.gif
  36. c:\windows\SysWow64\images\toolbar\gotopaged.gif
  37. c:\windows\SysWow64\images\toolbar\grouptree.gif
  38. c:\windows\SysWow64\images\toolbar\grouptree_over.gif
  39. c:\windows\SysWow64\images\toolbar\grouptreed.gif
  40. c:\windows\SysWow64\images\toolbar\grouptreepressed.gif
  41. c:\windows\SysWow64\images\toolbar\Last.gif
  42. c:\windows\SysWow64\images\toolbar\last_over.gif
  43. c:\windows\SysWow64\images\toolbar\Lastd.gif
  44. c:\windows\SysWow64\images\toolbar\Next.gif
  45. c:\windows\SysWow64\images\toolbar\next_over.gif
  46. c:\windows\SysWow64\images\toolbar\Nextd.gif
  47. c:\windows\SysWow64\images\toolbar\Prev.gif
  48. c:\windows\SysWow64\images\toolbar\prev_over.gif
  49. c:\windows\SysWow64\images\toolbar\Prevd.gif
  50. c:\windows\SysWow64\images\toolbar\print.gif
  51. c:\windows\SysWow64\images\toolbar\print_over.gif
  52. c:\windows\SysWow64\images\toolbar\printd.gif
  53. c:\windows\SysWow64\images\toolbar\Refresh.gif
  54. c:\windows\SysWow64\images\toolbar\refresh_over.gif
  55. c:\windows\SysWow64\images\toolbar\refreshd.gif
  56. c:\windows\SysWow64\images\toolbar\Search.gif
  57. c:\windows\SysWow64\images\toolbar\search_over.gif
  58. c:\windows\SysWow64\images\toolbar\searchd.gif
  59. c:\windows\SysWow64\images\toolbar\up.gif
  60. c:\windows\SysWow64\images\toolbar\up_over.gif
  61. c:\windows\SysWow64\images\toolbar\upd.gif
  62. c:\windows\SysWow64\images\tree\begindots.gif
  63. c:\windows\SysWow64\images\tree\beginminus.gif
  64. c:\windows\SysWow64\images\tree\beginplus.gif
  65. c:\windows\SysWow64\images\tree\blank.gif
  66. c:\windows\SysWow64\images\tree\blankdots.gif
  67. c:\windows\SysWow64\images\tree\dots.gif
  68. c:\windows\SysWow64\images\tree\lastdots.gif
  69. c:\windows\SysWow64\images\tree\lastminus.gif
  70. c:\windows\SysWow64\images\tree\lastplus.gif
  71. c:\windows\SysWow64\images\tree\Magnify.gif
  72. c:\windows\SysWow64\images\tree\minus.gif
  73. c:\windows\SysWow64\images\tree\minusbox.gif
  74. c:\windows\SysWow64\images\tree\plus.gif
  75. c:\windows\SysWow64\images\tree\plusbox.gif
  76. c:\windows\SysWow64\images\tree\singleminus.gif
  77. c:\windows\SysWow64\images\tree\singleplus.gif
  78.  
  79. .
  80. ((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 )))))))))))))))))))))))))))))))
  81. .
  82.  
  83. 2011-02-10 19:00 . 2011-02-10 19:00 -------- d-----w- c:\users\Default\AppData\Local\temp
  84. 2011-02-10 19:00 . 2011-02-10 19:00 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp
  85. 2011-02-10 18:31 . 2011-02-10 18:37 -------- d-----w- c:\users\RUSSELL\AppData\Roaming\mIRC
  86. 2011-02-10 17:35 . 2011-01-13 07:20 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A5913E52-8629-4FFC-8EED-268069317869}\mpengine.dll
  87. 2011-02-09 20:58 . 2011-02-09 20:58 -------- d-----w- c:\users\RUSSELL\AppData\Local\AMD
  88. 2011-02-09 20:58 . 2011-02-09 20:58 -------- d-----w- c:\programdata\ATI
  89. 2011-02-09 20:57 . 2011-02-09 20:58 -------- d-----w- c:\program files (x86)\ATI Stream
  90. 2011-02-09 20:57 . 2011-02-09 20:57 -------- d-----w- c:\programdata\AMD
  91. 2011-02-09 20:57 . 2010-02-18 14:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
  92. 2011-02-09 16:32 . 2010-09-17 17:33 108376 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
  93. 2011-02-09 16:32 . 2010-09-17 15:16 72536 ----a-w- c:\windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
  94. 2011-02-09 16:31 . 2010-09-17 15:16 72536 ----a-w- c:\windows\SysWow64\perf-MSSQLSERVER-sqlctr10.2.4000.0.dll
  95. 2011-02-09 16:31 . 2010-09-17 17:33 108376 ----a-w- c:\windows\system32\perf-MSSQLSERVER-sqlctr10.2.4000.0.dll
  96. 2011-02-09 16:08 . 2010-12-18 06:11 714752 ----a-w- c:\windows\system32\kerberos.dll
  97. 2011-02-09 16:08 . 2010-12-18 05:29 541184 ----a-w- c:\windows\SysWow64\kerberos.dll
  98. 2011-02-09 16:08 . 2011-01-05 04:00 3127808 ----a-w- c:\windows\system32\win32k.sys
  99. 2011-02-09 16:08 . 2010-12-21 06:16 214016 ----a-w- c:\windows\system32\winsrv.dll
  100. 2011-01-29 01:07 . 2011-01-29 01:07 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{684C6F9E-15B5-442E-B7B0-07E731E991B6}\gapaengine.dll
  101. 2011-01-29 00:55 . 2011-01-29 00:55 -------- d-----w- c:\program files (x86)\Microsoft Security Client
  102. 2011-01-29 00:55 . 2011-01-29 00:55 -------- d-----w- c:\windows\Temp06032E1C-E69A-4D78-2AE9-7263E5A4EB6C-Signatures
  103. 2011-01-29 00:54 . 2011-01-29 00:55 -------- d-----w- c:\program files\Microsoft Security Client
  104. 2011-01-29 00:53 . 2010-04-09 11:06 374664 ----a-w- c:\windows\system32\drivers\netio.sys
  105. 2011-01-25 22:32 . 2011-01-25 22:32 -------- d-s---w- c:\windows\SysWow64\Microsoft
  106. 2011-01-25 22:11 . 2011-01-25 22:11 -------- d-----w- c:\program files (x86)\NuGet
  107. 2011-01-25 21:53 . 2011-01-25 21:53 -------- d-----w- c:\program files (x86)\Microsoft WebMatrix
  108. 2011-01-25 21:52 . 2011-01-25 21:52 -------- d-----w- c:\program files (x86)\IIS Express
  109. 2011-01-25 21:46 . 2011-01-25 21:46 -------- d-----w- c:\program files\Microsoft
  110. 2011-01-20 02:01 . 2011-01-20 02:28 -------- d-----w- c:\users\RUSSELL\workspace
  111. 2011-01-20 01:36 . 2011-01-20 02:28 -------- d-----w- c:\users\RUSSELL\.android
  112. 2011-01-20 01:35 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.netbeans
  113. 2011-01-20 01:35 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.netbeans-registration
  114. 2011-01-20 01:31 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.nbi
  115. 2011-01-20 01:24 . 2011-01-20 01:23 521448 ----a-w- c:\windows\system32\deployJava1.dll
  116. 2011-01-20 01:23 . 2011-01-20 01:23 -------- d-----w- c:\program files\Java
  117.  
  118. .
  119. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  120. .
  121. 2011-01-25 22:11 . 2009-11-24 20:26 2392416 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
  122. 2011-01-13 07:20 . 2009-10-25 07:37 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  123. 2011-01-05 03:37 . 2011-01-05 03:37 8283136 ----a-w- c:\windows\system32\drivers\atikmdag.sys
  124. 2011-01-05 03:22 . 2011-01-05 03:22 22100480 ----a-w- c:\windows\system32\atio6axx.dll
  125. 2011-01-05 03:03 . 2011-01-05 03:03 17043968 ----a-w- c:\windows\SysWow64\atioglxx.dll
  126. 2011-01-05 03:02 . 2011-01-05 03:02 143360 ----a-w- c:\windows\system32\atiapfxx.exe
  127. 2011-01-05 03:02 . 2010-09-29 01:55 596480 ----a-w- c:\windows\SysWow64\aticfx32.dll
  128. 2011-01-05 03:01 . 2010-09-29 01:54 708608 ----a-w- c:\windows\system32\aticfx64.dll
  129. 2011-01-05 02:58 . 2011-01-05 02:58 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
  130. 2011-01-05 02:58 . 2011-01-05 02:58 480256 ----a-w- c:\windows\system32\atieclxx.exe
  131. 2011-01-05 02:57 . 2011-01-05 02:57 203776 ----a-w- c:\windows\system32\atiesrxx.exe
  132. 2011-01-05 02:56 . 2011-01-05 02:56 120320 ----a-w- c:\windows\system32\atitmm64.dll
  133. 2011-01-05 02:56 . 2011-01-05 02:56 423424 ----a-w- c:\windows\system32\atipdl64.dll
  134. 2011-01-05 02:56 . 2011-01-05 02:56 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
  135. 2011-01-05 02:55 . 2011-01-05 02:55 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
  136. 2011-01-05 02:55 . 2011-01-05 02:55 16384 ----a-w- c:\windows\system32\atimuixx.dll
  137. 2011-01-05 02:55 . 2011-01-05 02:55 59392 ----a-w- c:\windows\system32\atiedu64.dll
  138. 2011-01-05 02:55 . 2011-01-05 02:55 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
  139. 2011-01-05 02:52 . 2011-01-05 02:52 4101632 ----a-w- c:\windows\SysWow64\atidxx32.dll
  140. 2011-01-05 02:43 . 2010-09-29 01:37 4844544 ----a-w- c:\windows\system32\atidxx64.dll
  141. 2011-01-05 02:33 . 2011-01-05 02:33 51200 ----a-w- c:\windows\system32\aticalrt64.dll
  142. 2011-01-05 02:33 . 2011-01-05 02:33 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
  143. 2011-01-05 02:33 . 2011-01-05 02:33 44544 ----a-w- c:\windows\system32\aticalcl64.dll
  144. 2011-01-05 02:33 . 2010-10-27 02:28 4162048 ----a-w- c:\windows\SysWow64\atiumdag.dll
  145. 2011-01-05 02:33 . 2011-01-05 02:33 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
  146. 2011-01-05 02:33 . 2011-01-05 02:33 6815232 ----a-w- c:\windows\system32\aticaldd64.dll
  147. 2011-01-05 02:32 . 2011-01-05 02:32 1208320 ----a-w- c:\windows\system32\atiumd6v.dll
  148. 2011-01-05 02:32 . 2011-01-05 02:32 3218944 ----a-w- c:\windows\system32\atiumd6a.dll
  149. 2011-01-05 02:31 . 2011-01-05 02:31 5441024 ----a-w- c:\windows\SysWow64\aticaldd.dll
  150. 2011-01-05 02:28 . 2010-08-04 05:23 58880 ----a-w- c:\windows\system32\coinst.dll
  151. 2011-01-05 02:27 . 2011-01-05 02:27 5305856 ----a-w- c:\windows\system32\atiumd64.dll
  152. 2011-01-05 02:25 . 2010-10-27 01:50 3461120 ----a-w- c:\windows\SysWow64\atiumdva.dll
  153. 2011-01-05 02:20 . 2011-01-05 02:20 353792 ----a-w- c:\windows\system32\atiadlxx.dll
  154. 2011-01-05 02:20 . 2011-01-05 02:20 249856 ----a-w- c:\windows\SysWow64\atiadlxy.dll
  155. 2011-01-05 02:19 . 2011-01-05 02:19 14848 ----a-w- c:\windows\system32\atig6pxx.dll
  156. 2011-01-05 02:19 . 2011-01-05 02:19 12800 ----a-w- c:\windows\SysWow64\atiglpxx.dll
  157. 2011-01-05 02:19 . 2011-01-05 02:19 12800 ----a-w- c:\windows\system32\atiglpxx.dll
  158. 2011-01-05 02:19 . 2011-01-05 02:19 32256 ----a-w- c:\windows\system32\atig6txx.dll
  159. 2011-01-05 02:19 . 2011-01-05 02:19 27648 ----a-w- c:\windows\SysWow64\atigktxx.dll
  160. 2011-01-05 02:19 . 2011-01-05 02:19 294400 ----a-w- c:\windows\system32\drivers\atikmpag.sys
  161. 2011-01-05 02:18 . 2010-09-29 01:14 39936 ----a-w- c:\windows\system32\atiuxp64.dll
  162. 2011-01-05 02:18 . 2010-09-29 01:14 30720 ----a-w- c:\windows\SysWow64\atiuxpag.dll
  163. 2011-01-05 02:18 . 2011-01-05 02:18 38400 ----a-w- c:\windows\system32\atiu9p64.dll
  164. 2011-01-05 02:18 . 2010-10-27 02:13 28672 ----a-w- c:\windows\SysWow64\atiu9pag.dll
  165. 2011-01-05 02:17 . 2011-01-05 02:17 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
  166. 2011-01-05 02:11 . 2011-01-05 02:11 53760 ----a-w- c:\windows\system32\atimpc64.dll
  167. 2011-01-05 02:11 . 2011-01-05 02:11 53760 ----a-w- c:\windows\system32\amdpcom64.dll
  168. 2011-01-05 02:11 . 2011-01-05 02:11 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
  169. 2011-01-05 02:11 . 2011-01-05 02:11 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
  170. 2010-12-10 23:29 . 2010-12-10 23:29 2248032 ----a-w- c:\windows\SysWow64\sqlncli.dll
  171. 2010-12-10 22:34 . 2010-12-10 22:34 2882400 ----a-w- c:\windows\system32\sqlncli.dll
  172. 2010-12-07 17:17 . 2010-12-07 17:17 51200 ----a-w- c:\windows\SysWow64\OpenCL.dll
  173. 2010-12-07 17:15 . 2010-12-07 17:15 52736 ----a-w- c:\windows\system32\OpenCL.dll
  174. 2010-11-17 12:04 . 2010-11-17 12:04 115216 ----a-w- c:\windows\system32\drivers\AtihdW76.sys
  175. .
  176.  
  177. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  178. .
  179. .
  180. *Note* empty entries & legit default entries are not shown
  181. REGEDIT4
  182.  
  183. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  184. "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
  185. "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
  186.  
  187. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  188. "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
  189. "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
  190. "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
  191. "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
  192. "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-05 336384]
  193.  
  194. c:\users\RUSSELL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
  195. Logitech . Product Registration.lnk - c:\program files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [N/A]
  196.  
  197. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  198. HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
  199. Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2009-10-24 660848]
  200.  
  201. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  202. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  203. "ConsentPromptBehaviorUser"= 3 (0x3)
  204. "EnableUIADesktopToggle"= 0 (0x0)
  205. "PromptOnSecureDesktop"= 0 (0x0)
  206.  
  207. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  208. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  209.  
  210. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  211. @="Service"
  212.  
  213. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  214. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  215. R3 BackupReader;BackupReader;c:\windows\system32\DRIVERS\BackupReader.sys [2009-07-12 53096]
  216. R3 dump_wmimmc;dump_wmimmc;d:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
  217. R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;d:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888]
  218. R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 40832]
  219. R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-01-07 63304]
  220. R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 72064]
  221. R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
  222. R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
  223. R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
  224. R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
  225. R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-12 1255736]
  226. R3 WPFFontCache_v0400;WPFFontCache_v0400;c:\windows\Microsoft.NET\Framework64\v4.0.30128\WPF\WPFFontCache_v0400.exe [x]
  227. R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
  228. R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]
  229. R4 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);d:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [2008-07-10 34840]
  230. R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 61976]
  231. R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 311656]
  232. R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 430424]
  233. R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
  234. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-05 203776]
  235. S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-05 354304]
  236. S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
  237. S2 arXfrSvc;Windows Media Center TV Archive Transfer Service;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [2009-07-12 227184]
  238. S2 esClient;Windows Media Center Client Service;c:\program files\Windows Home Server\esClient.exe [2009-07-12 109936]
  239. S2 MsDtsServer100;SQL Server Integration Services 10.0;d:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2010-09-17 210776]
  240. S2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);d:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2010-09-17 2085208]
  241. S2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [2009-07-12 449904]
  242. S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
  243. S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-05 8283136]
  244. S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-05 294400]
  245. S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
  246. S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
  247. S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2009-12-01 38992]
  248. S3 ubloxVcp;u-blox Virtual COM port driver;c:\windows\system32\DRIVERS\ubloxVcp.sys [2009-11-02 62976]
  249.  
  250.  
  251. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
  252. iissvcs REG_MULTI_SZ w3svc was
  253. apphost REG_MULTI_SZ apphostsvc
  254. hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
  255. .
  256. Contents of the 'Scheduled Tasks' folder
  257.  
  258. 2011-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-743355720-4223594951-3482061950-1000Core.job
  259. - c:\users\RUSSELL\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-11 18:11]
  260.  
  261. 2011-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-743355720-4223594951-3482061950-1000UA.job
  262. - c:\users\RUSSELL\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-11 18:11]
  263. .
  264.  
  265. --------- x86-64 -----------
  266.  
  267.  
  268. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
  269. @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
  270. [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
  271. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  272.  
  273. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
  274. @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
  275. [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
  276. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  277.  
  278. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
  279. @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
  280. [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
  281. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  282.  
  283. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
  284. @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
  285. [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
  286. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  287.  
  288. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
  289. @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
  290. [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
  291. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  292.  
  293. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
  294. @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
  295. [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
  296. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  297.  
  298. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
  299. @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
  300. [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
  301. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  302.  
  303. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
  304. @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
  305. [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
  306. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  307.  
  308. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
  309. @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
  310. [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
  311. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  312.  
  313. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  314. "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-24 7833120]
  315. "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-24 1833504]
  316. "BCSSync"="d:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
  317. "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
  318. "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
  319. "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
  320.  
  321. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  322. "LoadAppInit_DLLs"=0x0
  323. .
  324. ------- Supplementary Scan -------
  325. .
  326. uLocal Page = c:\windows\system32\blank.htm
  327. uStart Page = hxxp://www.bing.com/
  328. mLocal Page = c:\windows\SysWOW64\blank.htm
  329. uInternet Settings,ProxyOverride = *.local
  330. IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
  331. IE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
  332. IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
  333. IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM
  334. IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM
  335. IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
  336. Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
  337. DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/US/TechConsole/x86/RescueControl.cab
  338. FF - ProfilePath - c:\users\RUSSELL\AppData\Roaming\Mozilla\Firefox\Profiles\bb5elcg7.default\
  339. FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
  340. FF - prefs.js: browser.search.selectedEngine - Bing
  341. FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com
  342. FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
  343. FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  344. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
  345. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
  346. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
  347. FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
  348. FF - Ext: FiddlerHook: fiddlerhook@fiddler2.com - c:\program files (x86)\Fiddler2\FiddlerHook
  349. .
  350. - - - - ORPHANS REMOVED - - - -
  351.  
  352. AddRemove-2266116396.elitistjerks.com - c:\program files (x86)\Microsoft Silverlight\4.0.50524.0\Silverlight.Configuration.exe
  353. AddRemove-950291360.www.silverlight.net - c:\program files (x86)\Microsoft Silverlight\4.0.41108.0\Silverlight.Configuration.exe
  354.  
  355.  
  356.  
  357. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
  358. "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
  359.  
  360. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
  361. "ImagePath"="c:\windows\system32\GameMon.des -service"
  362. .
  363. --------------------- LOCKED REGISTRY KEYS ---------------------
  364.  
  365. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  366. @Denied: (A 2) (Everyone)
  367. @="FlashBroker"
  368. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
  369.  
  370. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  371. "Enabled"=dword:00000001
  372.  
  373. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  374. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
  375.  
  376. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  377. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  378.  
  379. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  380. @Denied: (A 2) (Everyone)
  381. @="Shockwave Flash Object"
  382.  
  383. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  384. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
  385. "ThreadingModel"="Apartment"
  386.  
  387. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  388. @="0"
  389.  
  390. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  391. @="ShockwaveFlash.ShockwaveFlash.10"
  392.  
  393. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  394. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
  395.  
  396. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  397. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  398.  
  399. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  400. @="1.0"
  401.  
  402. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  403. @="ShockwaveFlash.ShockwaveFlash"
  404.  
  405. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  406. @Denied: (A 2) (Everyone)
  407. @="Macromedia Flash Factory Object"
  408.  
  409. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  410. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
  411. "ThreadingModel"="Apartment"
  412.  
  413. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  414. @="FlashFactory.FlashFactory.1"
  415.  
  416. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  417. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
  418.  
  419. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  420. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  421.  
  422. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  423. @="1.0"
  424.  
  425. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  426. @="FlashFactory.FlashFactory"
  427.  
  428. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  429. @Denied: (A 2) (Everyone)
  430. @="IFlashBroker4"
  431.  
  432. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  433. @="{00020424-0000-0000-C000-000000000046}"
  434.  
  435. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  436. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  437. "Version"="1.0"
  438.  
  439. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
  440. @Denied: (A) (Everyone)
  441. "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
  442.  
  443. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
  444. @Denied: (A) (Everyone)
  445. "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
  446.  
  447. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
  448. @Denied: (A) (Everyone)
  449.  
  450. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
  451. "Key"="ActionsPane"
  452. "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
  453.  
  454. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
  455. @Denied: (A) (Everyone)
  456.  
  457. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
  458. "Key"="ActionsPane3"
  459. "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
  460.  
  461. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  462. @Denied: (Full) (Everyone)
  463. .
  464. ------------------------ Other Running Processes ------------------------
  465. .
  466. c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  467. c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
  468. c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
  469. c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
  470. .
  471. **************************************************************************
  472. .
  473. Completion time: 2011-02-10 14:10:12 - machine was rebooted
  474. ComboFix-quarantined-files.txt 2011-02-10 19:10
  475.  
  476. Pre-Run: 110,667,706,368 bytes free
  477. Post-Run: 111,228,940,288 bytes free
  478.  
  479. - - End Of File - - 7CE5C4FA70378579BB7F71D6D62E0A20
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!