API tools faq
paste
filipovicvuk

Combofix log 2

filipovicvuk
Mar 13th, 2011
92
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.80 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-03-12.01 - Vuk 13.03.2011 23:05:53.2.2 - x86
  2. Microsoft Windows 7 Ultimate 6.1.7600.0.1250.381.1033.18.3071.2016 [GMT 1:00]
  3. Running from: c:\users\Vuk\Desktop\ComboFix.exe
  4. Command switches used :: c:\users\Vuk\Desktop\CFScript.txt
  5. AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
  6. SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
  7. SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  8. .
  9. .
  10. ((((((((((((((((((((((((( Files Created from 2011-02-13 to 2011-03-13 )))))))))))))))))))))))))))))))
  11. .
  12. .
  13. 2011-03-13 22:09 . 2011-03-13 22:09 -------- d-----w- c:\users\Default\AppData\Local\temp
  14. 2011-03-10 10:52 . 2011-03-10 12:22 -------- d-----w- c:\programdata\PC Tools
  15. 2011-03-10 09:59 . 2011-03-10 10:07 -------- dc----w- c:\windows\system32\DRVSTORE
  16. 2011-03-10 09:59 . 2011-03-10 09:59 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
  17. 2011-03-10 09:59 . 2011-03-10 09:59 -------- d-----w- c:\users\Vuk\AppData\Local\Sunbelt Software
  18. 2011-03-10 09:58 . 2011-03-10 10:07 -------- d-----w- c:\programdata\Lavasoft
  19. 2011-03-10 07:03 . 2011-03-10 07:03 -------- d-----w- c:\users\Vuk\AppData\Roaming\Malwarebytes
  20. 2011-03-10 07:02 . 2011-03-10 07:02 -------- d-----w- c:\programdata\Malwarebytes
  21. 2011-03-10 05:59 . 2011-02-23 08:35 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{969EAB79-936A-422C-9525-145F607C05B8}\mpengine.dll
  22. 2011-03-10 05:04 . 2011-02-19 05:33 802304 ----a-w- c:\windows\system32\FntCache.dll
  23. 2011-03-10 05:04 . 2011-02-19 05:32 1074176 ----a-w- c:\windows\system32\DWrite.dll
  24. 2011-03-10 05:04 . 2011-02-19 05:32 739840 ----a-w- c:\windows\system32\d2d1.dll
  25. 2011-03-10 05:04 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
  26. 2011-03-10 05:04 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
  27. 2011-03-10 05:04 . 2010-12-23 05:28 534528 ----a-w- c:\windows\system32\EncDec.dll
  28. 2011-03-10 05:04 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
  29. 2011-03-10 05:04 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
  30. 2011-03-10 05:04 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\system32\mstsc.exe
  31. 2011-03-06 03:12 . 2011-03-06 03:12 -------- d-----w- c:\users\Vuk\AppData\Local\Activision
  32. 2011-03-06 03:00 . 2011-03-06 03:00 -------- d-----w- c:\programdata\ATI
  33. 2011-02-28 01:57 . 2011-02-28 03:42 -------- d-----w- c:\users\Vuk\AppData\Local\Turbine
  34. 2011-02-28 01:56 . 2011-02-28 21:16 -------- d-----w- c:\users\Vuk\AppData\Local\ApplicationHistory
  35. 2011-02-28 01:37 . 2011-02-28 01:37 -------- d-----w- c:\users\Vuk\AppData\Local\The Lord of the Rings Online
  36. 2011-02-24 02:00 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
  37. 2011-02-23 11:29 . 2011-01-07 07:31 442880 ----a-w- c:\windows\system32\XpsPrint.dll
  38. 2011-02-23 11:29 . 2011-01-07 07:31 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
  39. 2011-02-18 19:00 . 2011-02-18 19:00 -------- d-----w- c:\users\Vuk\AppData\Local\EA Games
  40. 2011-02-14 16:36 . 2011-02-14 16:36 -------- d-----w- c:\users\Vuk\AppData\Roaming\RegGenie
  41. .
  42. .
  43. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  44. .
  45. 2011-02-10 06:06 . 2011-02-10 06:06 73046988 ----a-w- c:\windows\system32\xa36347265.exe
  46. 2011-02-10 06:06 . 2011-02-10 06:06 73046988 ----a-w- c:\windows\system32\xa36346485.exe
  47. 2011-02-10 06:05 . 2011-02-10 06:05 73046988 ----a-w- c:\windows\system32\xa36317313.exe
  48. 2011-02-10 06:05 . 2011-02-10 06:05 73046988 ----a-w- c:\windows\system32\xa36314957.exe
  49. 2011-02-03 05:45 . 2011-02-09 18:58 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
  50. 2011-02-02 16:11 . 2010-07-16 15:05 222080 ------w- c:\windows\system32\MpSigStub.exe
  51. 2011-01-26 23:36 . 2011-01-26 23:36 7566848 ----a-w- c:\windows\system32\drivers\atikmdag.sys
  52. 2011-01-26 23:00 . 2011-01-26 23:00 143360 ----a-w- c:\windows\system32\atiapfxx.exe
  53. 2011-01-26 23:00 . 2010-05-05 02:19 596480 ----a-w- c:\windows\system32\aticfx32.dll
  54. 2011-01-26 22:59 . 2011-01-26 22:59 17204736 ----a-w- c:\windows\system32\atioglxx.dll
  55. 2011-01-26 22:56 . 2011-01-05 02:58 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
  56. 2011-01-26 22:55 . 2011-01-26 22:55 393216 ----a-w- c:\windows\system32\atieclxx.exe
  57. 2011-01-26 22:55 . 2011-01-26 22:55 176128 ----a-w- c:\windows\system32\atiesrxx.exe
  58. 2011-01-26 22:54 . 2011-01-26 22:54 159744 ----a-w- c:\windows\system32\atitmmxx.dll
  59. 2011-01-26 22:53 . 2011-01-05 02:56 356352 ----a-w- c:\windows\system32\atipdlxx.dll
  60. 2011-01-26 22:53 . 2011-01-26 22:53 278528 ----a-w- c:\windows\system32\Oemdspif.dll
  61. 2011-01-26 22:53 . 2011-01-26 22:53 15872 ----a-w- c:\windows\system32\atimuixx.dll
  62. 2011-01-26 22:53 . 2011-01-26 22:53 43520 ----a-w- c:\windows\system32\ati2edxx.dll
  63. 2011-01-26 22:49 . 2010-05-05 02:08 4105728 ----a-w- c:\windows\system32\atidxx32.dll
  64. 2011-01-26 22:32 . 2011-01-26 22:32 1912832 ----a-w- c:\windows\system32\atiumdmv.dll
  65. 2011-01-26 22:28 . 2011-01-05 02:33 4170752 ----a-w- c:\windows\system32\atiumdag.dll
  66. 2011-01-26 22:27 . 2011-01-26 22:27 46080 ----a-w- c:\windows\system32\aticalrt.dll
  67. 2011-01-26 22:27 . 2011-01-26 22:27 44032 ----a-w- c:\windows\system32\aticalcl.dll
  68. 2011-01-26 22:25 . 2011-01-26 22:25 5580800 ----a-w- c:\windows\system32\aticaldd.dll
  69. 2011-01-26 22:24 . 2011-01-05 02:25 3463680 ----a-w- c:\windows\system32\atiumdva.dll
  70. 2011-01-26 22:20 . 2010-05-05 01:34 52736 ----a-w- c:\windows\system32\coinst.dll
  71. 2011-01-26 22:14 . 2011-01-05 02:20 249856 ----a-w- c:\windows\system32\atiadlxx.dll
  72. 2011-01-26 22:13 . 2011-01-26 22:13 12800 ----a-w- c:\windows\system32\atiglpxx.dll
  73. 2011-01-26 22:13 . 2011-01-26 22:13 32768 ----a-w- c:\windows\system32\atigktxx.dll
  74. 2011-01-26 22:13 . 2011-01-26 22:13 238592 ----a-w- c:\windows\system32\drivers\atikmpag.sys
  75. 2011-01-26 22:12 . 2010-05-05 01:22 30720 ----a-w- c:\windows\system32\atiuxpag.dll
  76. 2011-01-26 22:12 . 2010-05-05 01:22 28672 ----a-w- c:\windows\system32\atiu9pag.dll
  77. 2011-01-26 22:11 . 2011-01-26 22:11 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
  78. 2011-01-26 22:08 . 2011-01-26 22:08 52736 ----a-w- c:\windows\system32\atimpc32.dll
  79. 2011-01-26 22:08 . 2011-01-26 22:08 52736 ----a-w- c:\windows\system32\amdpcom32.dll
  80. 2011-01-07 07:27 . 2011-02-09 18:59 34304 ----a-w- c:\windows\system32\atmlib.dll
  81. 2011-01-07 05:33 . 2011-02-09 18:59 294400 ----a-w- c:\windows\system32\atmfd.dll
  82. 2011-01-05 05:37 . 2011-02-09 18:59 428032 ----a-w- c:\windows\system32\vbscript.dll
  83. 2011-01-05 03:37 . 2011-02-09 18:59 2329088 ----a-w- c:\windows\system32\win32k.sys
  84. 2010-12-21 05:38 . 2011-02-09 18:58 73728 ----a-w- c:\windows\system32\wscsvc.dll
  85. 2010-12-21 05:38 . 2011-02-09 18:58 51200 ----a-w- c:\windows\system32\wscapi.dll
  86. 2010-12-21 05:38 . 2011-02-09 18:58 981504 ----a-w- c:\windows\system32\wininet.dll
  87. 2010-12-21 05:38 . 2011-02-09 18:58 350720 ----a-w- c:\windows\system32\winhttp.dll
  88. 2010-12-21 05:38 . 2011-02-09 18:58 204800 ----a-w- c:\windows\system32\WebClnt.dll
  89. 2010-12-21 05:38 . 2011-02-09 18:58 204288 ----a-w- c:\windows\system32\upnp.dll
  90. 2010-12-21 05:38 . 2011-02-09 18:58 14336 ----a-w- c:\windows\system32\slwga.dll
  91. 2010-12-21 05:36 . 2011-02-09 18:58 1389568 ----a-w- c:\windows\system32\msxml6.dll
  92. 2010-12-21 05:36 . 2011-02-09 18:58 1236992 ----a-w- c:\windows\system32\msxml3.dll
  93. 2010-12-21 05:34 . 2011-02-09 18:58 80384 ----a-w- c:\windows\system32\davclnt.dll
  94. 2010-12-18 05:29 . 2011-02-09 18:59 44544 ----a-w- c:\windows\system32\licmgr10.dll
  95. 2010-12-18 05:29 . 2011-02-09 18:59 541184 ----a-w- c:\windows\system32\kerberos.dll
  96. 2010-12-18 04:20 . 2011-02-09 18:59 386048 ----a-w- c:\windows\system32\html.iec
  97. 2010-12-18 03:47 . 2011-02-09 18:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb
  98. .
  99. .
  100. (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
  101. .
  102. .
  103. --- c:\windows\system32\xa36347265.exe ---
  104. Company: ------
  105. File Description: ------
  106. File Version: ------
  107. Product Name: ------
  108. Copyright: ------
  109. Original Filename: ------
  110. File size: 73046988
  111. Created time: 2011-02-10 06:06
  112. Modified time: 2011-02-10 06:06
  113. MD5: 58CBE239F42E20DCA750D628DB75E120
  114. SHA1: D53B9F0FC86DEE16B04E6D15688187B0A9679249
  115. .
  116. .
  117. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  118. .
  119. .
  120. *Note* empty entries & legit default entries are not shown
  121. REGEDIT4
  122. .
  123. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  124. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  125. .
  126. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  127. .
  128. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  129. 2010-11-29 14:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
  130. .
  131. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  132. 2010-11-29 14:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
  133. .
  134. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  135. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  136. "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
  137. .
  138. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  139. .
  140. [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
  141. .
  142. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  143. "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  144. "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
  145. .
  146. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  147. .
  148. [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
  149. .
  150. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  151. "egui"="e:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]
  152. "ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
  153. "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
  154. .
  155. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  156. SketchBook Snapshot.lnk - e:\program files\Autodesk\SketchBookPro2010\SketchBookSnapshot.exe [2009-2-23 708608]
  157. .
  158. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  159. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  160. "ConsentPromptBehaviorUser"= 3 (0x3)
  161. "EnableUIADesktopToggle"= 0 (0x0)
  162. .
  163. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  164. 2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  165. .
  166. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  167. 2011-01-31 08:44 35760 ----a-w- e:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
  168. .
  169. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
  170. 2010-03-06 01:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
  171. .
  172. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
  173. 2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
  174. .
  175. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
  176. 2009-10-30 11:57 369200 ----a-w- e:\program files\DAEMON Tools Lite\DTLite.exe
  177. .
  178. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
  179. 2009-12-22 14:23 2647040 ----a-w- c:\program files\Anti-Vibrate Oscar Editor\OscarEditor.exe
  180. .
  181. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
  182. 2009-10-14 13:42 292824 ----a-w- e:\program files\Registry Mechanic\RMTray.exe
  183. .
  184. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSDMonitor]
  185. 2009-10-14 13:42 104408 ----a-w- c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
  186. .
  187. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  188. 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
  189. .
  190. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
  191. 2010-02-19 11:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
  192. .
  193. R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
  194. R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
  195. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  196. R3 SaiHF518;SaiHF518;c:\windows\system32\DRIVERS\SaiHF518.sys [2007-05-31 135048]
  197. R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  198. R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
  199. S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-16 691696]
  200. S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-29 108792]
  201. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 176128]
  202. S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-30 20968]
  203. S2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-29 735960]
  204. S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-09-29 95896]
  205. S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2009-10-14 583640]
  206. S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-11-23 4497704]
  207. S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-11-23 113448]
  208. S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 7566848]
  209. S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 238592]
  210. S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-11-17 101392]
  211. S3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\DRIVERS\WacomVTHid.sys [2009-07-09 13480]
  212. S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
  213. .
  214. .
  215. .
  216. ------- Supplementary Scan -------
  217. .
  218. uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
  219. IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
  220. .
  221. .
  222. --------------------- LOCKED REGISTRY KEYS ---------------------
  223. .
  224. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  225. @Denied: (Full) (Everyone)
  226. .
  227. Completion time: 2011-03-13 23:10:09
  228. ComboFix-quarantined-files.txt 2011-03-13 22:10
  229. ComboFix2.txt 2011-03-13 11:06
  230. .
  231. Pre-Run: 18.185.781.248 bytes free
  232. Post-Run: 18.273.275.904 bytes free
  233. .
  234. - - End Of File - - 5B63A8646D427408319B3A4861514019
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!