API tools faq
paste
Advertisement
Ressy

Cadalie

Ressy
Feb 10th, 2011
114
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 30.12 KB | None | 0 0
raw download clone embed print report
  1.  
  2. ComboFix 11-02-09.05 - RUSSELL 02/10/2011 13:54:02.1.4 - x64
  3. Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3071.1454 [GMT -5:00]
  4. Running from: c:\users\RUSSELL\Downloads\ComboFix.exe
  5. AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
  6. SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
  7. SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  8. .
  9.  
  10. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  11. .
  12.  
  13. C:\settingsxx.exe
  14. c:\settingsxx.exe\config.bin
  15. c:\users\RUSSELL\g2ax_customer_downloadhelper_win32_x86.exe
  16. c:\windows\Downloaded Program Files\x64
  17. c:\windows\Downloaded Program Files\x64\racodec.ax
  18. c:\windows\Downloaded Program Files\x86
  19. c:\windows\Downloaded Program Files\x86\racodec.ax
  20. c:\windows\SysWow64\html
  21. c:\windows\SysWow64\html\calendar.html
  22. c:\windows\SysWow64\html\calendarbottom.html
  23. c:\windows\SysWow64\html\calendartop.html
  24. c:\windows\SysWow64\html\crystalexportdialog.htm
  25. c:\windows\SysWow64\html\crystalprinthost.html
  26. c:\windows\SysWow64\images
  27. c:\windows\SysWow64\images\toolbar\calendar.gif
  28. c:\windows\SysWow64\images\toolbar\crlogo.gif
  29. c:\windows\SysWow64\images\toolbar\export.gif
  30. c:\windows\SysWow64\images\toolbar\export_over.gif
  31. c:\windows\SysWow64\images\toolbar\exportd.gif
  32. c:\windows\SysWow64\images\toolbar\First.gif
  33. c:\windows\SysWow64\images\toolbar\first_over.gif
  34. c:\windows\SysWow64\images\toolbar\Firstd.gif
  35. c:\windows\SysWow64\images\toolbar\gotopage.gif
  36. c:\windows\SysWow64\images\toolbar\gotopage_over.gif
  37. c:\windows\SysWow64\images\toolbar\gotopaged.gif
  38. c:\windows\SysWow64\images\toolbar\grouptree.gif
  39. c:\windows\SysWow64\images\toolbar\grouptree_over.gif
  40. c:\windows\SysWow64\images\toolbar\grouptreed.gif
  41. c:\windows\SysWow64\images\toolbar\grouptreepressed.gif
  42. c:\windows\SysWow64\images\toolbar\Last.gif
  43. c:\windows\SysWow64\images\toolbar\last_over.gif
  44. c:\windows\SysWow64\images\toolbar\Lastd.gif
  45. c:\windows\SysWow64\images\toolbar\Next.gif
  46. c:\windows\SysWow64\images\toolbar\next_over.gif
  47. c:\windows\SysWow64\images\toolbar\Nextd.gif
  48. c:\windows\SysWow64\images\toolbar\Prev.gif
  49. c:\windows\SysWow64\images\toolbar\prev_over.gif
  50. c:\windows\SysWow64\images\toolbar\Prevd.gif
  51. c:\windows\SysWow64\images\toolbar\print.gif
  52. c:\windows\SysWow64\images\toolbar\print_over.gif
  53. c:\windows\SysWow64\images\toolbar\printd.gif
  54. c:\windows\SysWow64\images\toolbar\Refresh.gif
  55. c:\windows\SysWow64\images\toolbar\refresh_over.gif
  56. c:\windows\SysWow64\images\toolbar\refreshd.gif
  57. c:\windows\SysWow64\images\toolbar\Search.gif
  58. c:\windows\SysWow64\images\toolbar\search_over.gif
  59. c:\windows\SysWow64\images\toolbar\searchd.gif
  60. c:\windows\SysWow64\images\toolbar\up.gif
  61. c:\windows\SysWow64\images\toolbar\up_over.gif
  62. c:\windows\SysWow64\images\toolbar\upd.gif
  63. c:\windows\SysWow64\images\tree\begindots.gif
  64. c:\windows\SysWow64\images\tree\beginminus.gif
  65. c:\windows\SysWow64\images\tree\beginplus.gif
  66. c:\windows\SysWow64\images\tree\blank.gif
  67. c:\windows\SysWow64\images\tree\blankdots.gif
  68. c:\windows\SysWow64\images\tree\dots.gif
  69. c:\windows\SysWow64\images\tree\lastdots.gif
  70. c:\windows\SysWow64\images\tree\lastminus.gif
  71. c:\windows\SysWow64\images\tree\lastplus.gif
  72. c:\windows\SysWow64\images\tree\Magnify.gif
  73. c:\windows\SysWow64\images\tree\minus.gif
  74. c:\windows\SysWow64\images\tree\minusbox.gif
  75. c:\windows\SysWow64\images\tree\plus.gif
  76. c:\windows\SysWow64\images\tree\plusbox.gif
  77. c:\windows\SysWow64\images\tree\singleminus.gif
  78. c:\windows\SysWow64\images\tree\singleplus.gif
  79.  
  80. .
  81. ((((((((((((((((((((((((( Files Created from 2011-01-10 to 2011-02-10 )))))))))))))))))))))))))))))))
  82. .
  83.  
  84. 2011-02-10 19:00 . 2011-02-10 19:00 -------- d-----w- c:\users\Default\AppData\Local\temp
  85. 2011-02-10 19:00 . 2011-02-10 19:00 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp
  86. 2011-02-10 18:31 . 2011-02-10 18:37 -------- d-----w- c:\users\RUSSELL\AppData\Roaming\mIRC
  87. 2011-02-10 17:35 . 2011-01-13 07:20 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A5913E52-8629-4FFC-8EED-268069317869}\mpengine.dll
  88. 2011-02-09 20:58 . 2011-02-09 20:58 -------- d-----w- c:\users\RUSSELL\AppData\Local\AMD
  89. 2011-02-09 20:58 . 2011-02-09 20:58 -------- d-----w- c:\programdata\ATI
  90. 2011-02-09 20:57 . 2011-02-09 20:58 -------- d-----w- c:\program files (x86)\ATI Stream
  91. 2011-02-09 20:57 . 2011-02-09 20:57 -------- d-----w- c:\programdata\AMD
  92. 2011-02-09 20:57 . 2010-02-18 14:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys
  93. 2011-02-09 16:32 . 2010-09-17 17:33 108376 ----a-w- c:\windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
  94. 2011-02-09 16:32 . 2010-09-17 15:16 72536 ----a-w- c:\windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.2.4000.0.dll
  95. 2011-02-09 16:31 . 2010-09-17 15:16 72536 ----a-w- c:\windows\SysWow64\perf-MSSQLSERVER-sqlctr10.2.4000.0.dll
  96. 2011-02-09 16:31 . 2010-09-17 17:33 108376 ----a-w- c:\windows\system32\perf-MSSQLSERVER-sqlctr10.2.4000.0.dll
  97. 2011-02-09 16:08 . 2010-12-18 06:11 714752 ----a-w- c:\windows\system32\kerberos.dll
  98. 2011-02-09 16:08 . 2010-12-18 05:29 541184 ----a-w- c:\windows\SysWow64\kerberos.dll
  99. 2011-02-09 16:08 . 2011-01-05 04:00 3127808 ----a-w- c:\windows\system32\win32k.sys
  100. 2011-02-09 16:08 . 2010-12-21 06:16 214016 ----a-w- c:\windows\system32\winsrv.dll
  101. 2011-01-29 01:07 . 2011-01-29 01:07 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{684C6F9E-15B5-442E-B7B0-07E731E991B6}\gapaengine.dll
  102. 2011-01-29 00:55 . 2011-01-29 00:55 -------- d-----w- c:\program files (x86)\Microsoft Security Client
  103. 2011-01-29 00:55 . 2011-01-29 00:55 -------- d-----w- c:\windows\Temp06032E1C-E69A-4D78-2AE9-7263E5A4EB6C-Signatures
  104. 2011-01-29 00:54 . 2011-01-29 00:55 -------- d-----w- c:\program files\Microsoft Security Client
  105. 2011-01-29 00:53 . 2010-04-09 11:06 374664 ----a-w- c:\windows\system32\drivers\netio.sys
  106. 2011-01-25 22:32 . 2011-01-25 22:32 -------- d-s---w- c:\windows\SysWow64\Microsoft
  107. 2011-01-25 22:11 . 2011-01-25 22:11 -------- d-----w- c:\program files (x86)\NuGet
  108. 2011-01-25 21:53 . 2011-01-25 21:53 -------- d-----w- c:\program files (x86)\Microsoft WebMatrix
  109. 2011-01-25 21:52 . 2011-01-25 21:52 -------- d-----w- c:\program files (x86)\IIS Express
  110. 2011-01-25 21:46 . 2011-01-25 21:46 -------- d-----w- c:\program files\Microsoft
  111. 2011-01-20 02:01 . 2011-01-20 02:28 -------- d-----w- c:\users\RUSSELL\workspace
  112. 2011-01-20 01:36 . 2011-01-20 02:28 -------- d-----w- c:\users\RUSSELL\.android
  113. 2011-01-20 01:35 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.netbeans
  114. 2011-01-20 01:35 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.netbeans-registration
  115. 2011-01-20 01:31 . 2011-01-20 01:35 -------- d-----w- c:\users\RUSSELL\.nbi
  116. 2011-01-20 01:24 . 2011-01-20 01:23 521448 ----a-w- c:\windows\system32\deployJava1.dll
  117. 2011-01-20 01:23 . 2011-01-20 01:23 -------- d-----w- c:\program files\Java
  118.  
  119. .
  120. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  121. .
  122. 2011-01-25 22:11 . 2009-11-24 20:26 2392416 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
  123. 2011-01-13 07:20 . 2009-10-25 07:37 7844688 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  124. 2011-01-05 03:37 . 2011-01-05 03:37 8283136 ----a-w- c:\windows\system32\drivers\atikmdag.sys
  125. 2011-01-05 03:22 . 2011-01-05 03:22 22100480 ----a-w- c:\windows\system32\atio6axx.dll
  126. 2011-01-05 03:03 . 2011-01-05 03:03 17043968 ----a-w- c:\windows\SysWow64\atioglxx.dll
  127. 2011-01-05 03:02 . 2011-01-05 03:02 143360 ----a-w- c:\windows\system32\atiapfxx.exe
  128. 2011-01-05 03:02 . 2010-09-29 01:55 596480 ----a-w- c:\windows\SysWow64\aticfx32.dll
  129. 2011-01-05 03:01 . 2010-09-29 01:54 708608 ----a-w- c:\windows\system32\aticfx64.dll
  130. 2011-01-05 02:58 . 2011-01-05 02:58 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
  131. 2011-01-05 02:58 . 2011-01-05 02:58 480256 ----a-w- c:\windows\system32\atieclxx.exe
  132. 2011-01-05 02:57 . 2011-01-05 02:57 203776 ----a-w- c:\windows\system32\atiesrxx.exe
  133. 2011-01-05 02:56 . 2011-01-05 02:56 120320 ----a-w- c:\windows\system32\atitmm64.dll
  134. 2011-01-05 02:56 . 2011-01-05 02:56 423424 ----a-w- c:\windows\system32\atipdl64.dll
  135. 2011-01-05 02:56 . 2011-01-05 02:56 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
  136. 2011-01-05 02:55 . 2011-01-05 02:55 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
  137. 2011-01-05 02:55 . 2011-01-05 02:55 16384 ----a-w- c:\windows\system32\atimuixx.dll
  138. 2011-01-05 02:55 . 2011-01-05 02:55 59392 ----a-w- c:\windows\system32\atiedu64.dll
  139. 2011-01-05 02:55 . 2011-01-05 02:55 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
  140. 2011-01-05 02:52 . 2011-01-05 02:52 4101632 ----a-w- c:\windows\SysWow64\atidxx32.dll
  141. 2011-01-05 02:43 . 2010-09-29 01:37 4844544 ----a-w- c:\windows\system32\atidxx64.dll
  142. 2011-01-05 02:33 . 2011-01-05 02:33 51200 ----a-w- c:\windows\system32\aticalrt64.dll
  143. 2011-01-05 02:33 . 2011-01-05 02:33 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
  144. 2011-01-05 02:33 . 2011-01-05 02:33 44544 ----a-w- c:\windows\system32\aticalcl64.dll
  145. 2011-01-05 02:33 . 2010-10-27 02:28 4162048 ----a-w- c:\windows\SysWow64\atiumdag.dll
  146. 2011-01-05 02:33 . 2011-01-05 02:33 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
  147. 2011-01-05 02:33 . 2011-01-05 02:33 6815232 ----a-w- c:\windows\system32\aticaldd64.dll
  148. 2011-01-05 02:32 . 2011-01-05 02:32 1208320 ----a-w- c:\windows\system32\atiumd6v.dll
  149. 2011-01-05 02:32 . 2011-01-05 02:32 3218944 ----a-w- c:\windows\system32\atiumd6a.dll
  150. 2011-01-05 02:31 . 2011-01-05 02:31 5441024 ----a-w- c:\windows\SysWow64\aticaldd.dll
  151. 2011-01-05 02:28 . 2010-08-04 05:23 58880 ----a-w- c:\windows\system32\coinst.dll
  152. 2011-01-05 02:27 . 2011-01-05 02:27 5305856 ----a-w- c:\windows\system32\atiumd64.dll
  153. 2011-01-05 02:25 . 2010-10-27 01:50 3461120 ----a-w- c:\windows\SysWow64\atiumdva.dll
  154. 2011-01-05 02:20 . 2011-01-05 02:20 353792 ----a-w- c:\windows\system32\atiadlxx.dll
  155. 2011-01-05 02:20 . 2011-01-05 02:20 249856 ----a-w- c:\windows\SysWow64\atiadlxy.dll
  156. 2011-01-05 02:19 . 2011-01-05 02:19 14848 ----a-w- c:\windows\system32\atig6pxx.dll
  157. 2011-01-05 02:19 . 2011-01-05 02:19 12800 ----a-w- c:\windows\SysWow64\atiglpxx.dll
  158. 2011-01-05 02:19 . 2011-01-05 02:19 12800 ----a-w- c:\windows\system32\atiglpxx.dll
  159. 2011-01-05 02:19 . 2011-01-05 02:19 32256 ----a-w- c:\windows\system32\atig6txx.dll
  160. 2011-01-05 02:19 . 2011-01-05 02:19 27648 ----a-w- c:\windows\SysWow64\atigktxx.dll
  161. 2011-01-05 02:19 . 2011-01-05 02:19 294400 ----a-w- c:\windows\system32\drivers\atikmpag.sys
  162. 2011-01-05 02:18 . 2010-09-29 01:14 39936 ----a-w- c:\windows\system32\atiuxp64.dll
  163. 2011-01-05 02:18 . 2010-09-29 01:14 30720 ----a-w- c:\windows\SysWow64\atiuxpag.dll
  164. 2011-01-05 02:18 . 2011-01-05 02:18 38400 ----a-w- c:\windows\system32\atiu9p64.dll
  165. 2011-01-05 02:18 . 2010-10-27 02:13 28672 ----a-w- c:\windows\SysWow64\atiu9pag.dll
  166. 2011-01-05 02:17 . 2011-01-05 02:17 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
  167. 2011-01-05 02:11 . 2011-01-05 02:11 53760 ----a-w- c:\windows\system32\atimpc64.dll
  168. 2011-01-05 02:11 . 2011-01-05 02:11 53760 ----a-w- c:\windows\system32\amdpcom64.dll
  169. 2011-01-05 02:11 . 2011-01-05 02:11 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
  170. 2011-01-05 02:11 . 2011-01-05 02:11 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
  171. 2010-12-10 23:29 . 2010-12-10 23:29 2248032 ----a-w- c:\windows\SysWow64\sqlncli.dll
  172. 2010-12-10 22:34 . 2010-12-10 22:34 2882400 ----a-w- c:\windows\system32\sqlncli.dll
  173. 2010-12-07 17:17 . 2010-12-07 17:17 51200 ----a-w- c:\windows\SysWow64\OpenCL.dll
  174. 2010-12-07 17:15 . 2010-12-07 17:15 52736 ----a-w- c:\windows\system32\OpenCL.dll
  175. 2010-11-17 12:04 . 2010-11-17 12:04 115216 ----a-w- c:\windows\system32\drivers\AtihdW76.sys
  176. .
  177.  
  178. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  179. .
  180. .
  181. *Note* empty entries & legit default entries are not shown
  182. REGEDIT4
  183.  
  184. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  185. "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
  186. "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-09-23 4240760]
  187.  
  188. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  189. "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
  190. "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
  191. "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
  192. "ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
  193. "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-05 336384]
  194.  
  195. c:\users\RUSSELL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
  196. Logitech . Product Registration.lnk - c:\program files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [N/A]
  197.  
  198. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  199. HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
  200. Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2009-10-24 660848]
  201.  
  202. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  203. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  204. "ConsentPromptBehaviorUser"= 3 (0x3)
  205. "EnableUIADesktopToggle"= 0 (0x0)
  206. "PromptOnSecureDesktop"= 0 (0x0)
  207.  
  208. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  209. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  210.  
  211. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  212. @="Service"
  213.  
  214. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  215. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  216. R3 BackupReader;BackupReader;c:\windows\system32\DRIVERS\BackupReader.sys [2009-07-12 53096]
  217. R3 dump_wmimmc;dump_wmimmc;d:\program files (x86)\NCsoft\Lineage II\system\GameGuard\dump_wmimmc.sys [x]
  218. R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;d:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888]
  219. R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 40832]
  220. R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-01-07 63304]
  221. R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 72064]
  222. R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]
  223. R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
  224. R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
  225. R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
  226. R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-12 1255736]
  227. R3 WPFFontCache_v0400;WPFFontCache_v0400;c:\windows\Microsoft.NET\Framework64\v4.0.30128\WPF\WPFFontCache_v0400.exe [x]
  228. R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
  229. R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]
  230. R4 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);d:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [2008-07-10 34840]
  231. R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 61976]
  232. R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 311656]
  233. R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2010-09-17 430424]
  234. R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
  235. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-05 203776]
  236. S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-05 354304]
  237. S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
  238. S2 arXfrSvc;Windows Media Center TV Archive Transfer Service;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [2009-07-12 227184]
  239. S2 esClient;Windows Media Center Client Service;c:\program files\Windows Home Server\esClient.exe [2009-07-12 109936]
  240. S2 MsDtsServer100;SQL Server Integration Services 10.0;d:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [2010-09-17 210776]
  241. S2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);d:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe [2010-09-17 2085208]
  242. S2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [2009-07-12 449904]
  243. S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
  244. S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-05 8283136]
  245. S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-05 294400]
  246. S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
  247. S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
  248. S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2009-12-01 38992]
  249. S3 ubloxVcp;u-blox Virtual COM port driver;c:\windows\system32\DRIVERS\ubloxVcp.sys [2009-11-02 62976]
  250.  
  251.  
  252. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
  253. iissvcs REG_MULTI_SZ w3svc was
  254. apphost REG_MULTI_SZ apphostsvc
  255. hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
  256. .
  257. Contents of the 'Scheduled Tasks' folder
  258.  
  259. 2011-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-743355720-4223594951-3482061950-1000Core.job
  260. - c:\users\RUSSELL\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-11 18:11]
  261.  
  262. 2011-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-743355720-4223594951-3482061950-1000UA.job
  263. - c:\users\RUSSELL\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-11 18:11]
  264. .
  265.  
  266. --------- x86-64 -----------
  267.  
  268.  
  269. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
  270. @="{C5994560-53D9-4125-87C9-F193FC689CB2}"
  271. [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
  272. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  273.  
  274. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
  275. @="{C5994561-53D9-4125-87C9-F193FC689CB2}"
  276. [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
  277. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  278.  
  279. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
  280. @="{C5994562-53D9-4125-87C9-F193FC689CB2}"
  281. [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
  282. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  283.  
  284. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
  285. @="{C5994563-53D9-4125-87C9-F193FC689CB2}"
  286. [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
  287. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  288.  
  289. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
  290. @="{C5994564-53D9-4125-87C9-F193FC689CB2}"
  291. [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
  292. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  293.  
  294. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
  295. @="{C5994565-53D9-4125-87C9-F193FC689CB2}"
  296. [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
  297. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  298.  
  299. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
  300. @="{C5994566-53D9-4125-87C9-F193FC689CB2}"
  301. [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
  302. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  303.  
  304. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
  305. @="{C5994567-53D9-4125-87C9-F193FC689CB2}"
  306. [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
  307. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  308.  
  309. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
  310. @="{C5994568-53D9-4125-87C9-F193FC689CB2}"
  311. [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
  312. 2010-03-21 12:55 99080 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
  313.  
  314. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  315. "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-24 7833120]
  316. "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-24 1833504]
  317. "BCSSync"="d:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
  318. "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
  319. "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
  320. "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]
  321.  
  322. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  323. "LoadAppInit_DLLs"=0x0
  324. .
  325. ------- Supplementary Scan -------
  326. .
  327. uLocal Page = c:\windows\system32\blank.htm
  328. uStart Page = hxxp://www.bing.com/
  329. mLocal Page = c:\windows\SysWOW64\blank.htm
  330. uInternet Settings,ProxyOverride = *.local
  331. IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
  332. IE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
  333. IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
  334. IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTM
  335. IE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTM
  336. IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
  337. Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
  338. DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/US/TechConsole/x86/RescueControl.cab
  339. FF - ProfilePath - c:\users\RUSSELL\AppData\Roaming\Mozilla\Firefox\Profiles\bb5elcg7.default\
  340. FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
  341. FF - prefs.js: browser.search.selectedEngine - Bing
  342. FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com
  343. FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
  344. FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  345. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
  346. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
  347. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
  348. FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
  349. FF - Ext: FiddlerHook: fiddlerhook@fiddler2.com - c:\program files (x86)\Fiddler2\FiddlerHook
  350. .
  351. - - - - ORPHANS REMOVED - - - -
  352.  
  353. AddRemove-2266116396.elitistjerks.com - c:\program files (x86)\Microsoft Silverlight\4.0.50524.0\Silverlight.Configuration.exe
  354. AddRemove-950291360.www.silverlight.net - c:\program files (x86)\Microsoft Silverlight\4.0.41108.0\Silverlight.Configuration.exe
  355.  
  356.  
  357.  
  358. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
  359. "ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
  360.  
  361. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
  362. "ImagePath"="c:\windows\system32\GameMon.des -service"
  363. .
  364. --------------------- LOCKED REGISTRY KEYS ---------------------
  365.  
  366. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  367. @Denied: (A 2) (Everyone)
  368. @="FlashBroker"
  369. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
  370.  
  371. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  372. "Enabled"=dword:00000001
  373.  
  374. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  375. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
  376.  
  377. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  378. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  379.  
  380. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  381. @Denied: (A 2) (Everyone)
  382. @="Shockwave Flash Object"
  383.  
  384. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  385. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
  386. "ThreadingModel"="Apartment"
  387.  
  388. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  389. @="0"
  390.  
  391. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  392. @="ShockwaveFlash.ShockwaveFlash.10"
  393.  
  394. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  395. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
  396.  
  397. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  398. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  399.  
  400. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  401. @="1.0"
  402.  
  403. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  404. @="ShockwaveFlash.ShockwaveFlash"
  405.  
  406. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  407. @Denied: (A 2) (Everyone)
  408. @="Macromedia Flash Factory Object"
  409.  
  410. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  411. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
  412. "ThreadingModel"="Apartment"
  413.  
  414. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  415. @="FlashFactory.FlashFactory.1"
  416.  
  417. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  418. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
  419.  
  420. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  421. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  422.  
  423. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  424. @="1.0"
  425.  
  426. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  427. @="FlashFactory.FlashFactory"
  428.  
  429. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  430. @Denied: (A 2) (Everyone)
  431. @="IFlashBroker4"
  432.  
  433. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  434. @="{00020424-0000-0000-C000-000000000046}"
  435.  
  436. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  437. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  438. "Version"="1.0"
  439.  
  440. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
  441. @Denied: (A) (Everyone)
  442. "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
  443.  
  444. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
  445. @Denied: (A) (Everyone)
  446. "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
  447.  
  448. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
  449. @Denied: (A) (Everyone)
  450.  
  451. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
  452. "Key"="ActionsPane"
  453. "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
  454.  
  455. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
  456. @Denied: (A) (Everyone)
  457.  
  458. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
  459. "Key"="ActionsPane3"
  460. "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
  461.  
  462. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  463. @Denied: (Full) (Everyone)
  464. .
  465. ------------------------ Other Running Processes ------------------------
  466. .
  467. c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
  468. c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
  469. c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
  470. c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
  471. .
  472. **************************************************************************
  473. .
  474. Completion time: 2011-02-10 14:10:12 - machine was rebooted
  475. ComboFix-quarantined-files.txt 2011-02-10 19:10
  476.  
  477. Pre-Run: 110,667,706,368 bytes free
  478. Post-Run: 111,228,940,288 bytes free
  479.  
  480. - - End Of File - - 7CE5C4FA70378579BB7F71D6D62E0A20
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!