API tools faq
paste
Ressy

CJ Log

Ressy
Feb 8th, 2011
133
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.51 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-02-08.01 - CRIS 02/08/2011 13:06:06.1.2 - x86
  2. Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1680 [GMT -5:00]
  3. Running from: c:\documents and settings\CRIS\Desktop\Combo-Fix.exe
  4. .
  5.  
  6. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  7. .
  8.  
  9. c:\documents and settings\CRIS\Application Data\PriceGong
  10. c:\documents and settings\CRIS\Application Data\PriceGong\Data\1.xml
  11. c:\documents and settings\CRIS\Application Data\PriceGong\Data\a.xml
  12. c:\documents and settings\CRIS\Application Data\PriceGong\Data\b.xml
  13. c:\documents and settings\CRIS\Application Data\PriceGong\Data\c.xml
  14. c:\documents and settings\CRIS\Application Data\PriceGong\Data\d.xml
  15. c:\documents and settings\CRIS\Application Data\PriceGong\Data\e.xml
  16. c:\documents and settings\CRIS\Application Data\PriceGong\Data\f.xml
  17. c:\documents and settings\CRIS\Application Data\PriceGong\Data\g.xml
  18. c:\documents and settings\CRIS\Application Data\PriceGong\Data\h.xml
  19. c:\documents and settings\CRIS\Application Data\PriceGong\Data\i.xml
  20. c:\documents and settings\CRIS\Application Data\PriceGong\Data\J.xml
  21. c:\documents and settings\CRIS\Application Data\PriceGong\Data\k.xml
  22. c:\documents and settings\CRIS\Application Data\PriceGong\Data\l.xml
  23. c:\documents and settings\CRIS\Application Data\PriceGong\Data\m.xml
  24. c:\documents and settings\CRIS\Application Data\PriceGong\Data\mru.xml
  25. c:\documents and settings\CRIS\Application Data\PriceGong\Data\n.xml
  26. c:\documents and settings\CRIS\Application Data\PriceGong\Data\o.xml
  27. c:\documents and settings\CRIS\Application Data\PriceGong\Data\p.xml
  28. c:\documents and settings\CRIS\Application Data\PriceGong\Data\q.xml
  29. c:\documents and settings\CRIS\Application Data\PriceGong\Data\r.xml
  30. c:\documents and settings\CRIS\Application Data\PriceGong\Data\s.xml
  31. c:\documents and settings\CRIS\Application Data\PriceGong\Data\t.xml
  32. c:\documents and settings\CRIS\Application Data\PriceGong\Data\u.xml
  33. c:\documents and settings\CRIS\Application Data\PriceGong\Data\v.xml
  34. c:\documents and settings\CRIS\Application Data\PriceGong\Data\w.xml
  35. c:\documents and settings\CRIS\Application Data\PriceGong\Data\x.xml
  36. c:\documents and settings\CRIS\Application Data\PriceGong\Data\y.xml
  37. c:\documents and settings\CRIS\Application Data\PriceGong\Data\z.xml
  38. c:\documents and settings\CRIS\Desktop\Windows Disk.lnk
  39. c:\documents and settings\CRIS\Start Menu\Programs\Windows Disk
  40. c:\documents and settings\CRIS\Start Menu\Programs\Windows Disk\Uninstall Windows Disk.lnk
  41. c:\documents and settings\CRIS\Start Menu\Programs\Windows Disk\Windows Disk.lnk
  42. c:\program files\BabylonIM\Plugins\IE\iePLugin.dll
  43.  
  44. Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
  45. Restored copy from - Kitty had a snack :p
  46. .
  47. ((((((((((((((((((((((((( Files Created from 2011-01-08 to 2011-02-08 )))))))))))))))))))))))))))))))
  48. .
  49.  
  50. 2011-02-08 17:48 . 2011-02-08 17:48 -------- d-----w- c:\documents and settings\CRIS\Local Settings\Application Data\D-Link Toolbar
  51. 2011-02-08 17:19 . 2011-02-08 17:19 388096 ----a-r- c:\documents and settings\CRIS\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
  52. 2011-02-08 17:19 . 2011-02-08 17:19 -------- d-----w- c:\program files\Trend Micro
  53. 2011-02-08 17:11 . 2011-02-08 17:11 -------- d-----w- c:\program files\D-Link Toolbar
  54. 2011-02-08 17:11 . 2011-02-08 17:11 -------- d-----w- c:\documents and settings\All Users\Application Data\D-Link Toolbar
  55. 2011-02-08 17:11 . 2011-02-08 17:11 -------- d-----w- c:\program files\Common Files\Software Update Utility
  56. 2011-02-08 16:47 . 2011-02-08 16:47 -------- d-----w- c:\documents and settings\CRIS\Application Data\VirtualStore
  57. 2011-02-08 01:20 . 2011-02-08 01:20 -------- d-----w- c:\windows\system32\wbem\Repository
  58. 2011-02-07 11:34 . 2011-02-07 11:34 -------- d-----w- c:\documents and settings\NetworkService\IETldCache
  59. 2011-02-06 18:20 . 2011-02-06 18:20 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
  60. 2011-02-03 20:14 . 2011-02-03 20:14 -------- d-sh--w- c:\documents and settings\CRIS\PrivacIE
  61. 2011-02-03 16:04 . 2011-02-03 16:04 -------- d-sh--w- c:\documents and settings\CRIS\IETldCache
  62. 2011-02-03 15:39 . 2010-11-06 00:34 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
  63. 2011-02-03 15:39 . 2010-11-06 00:34 468480 -c----w- c:\windows\system32\dllcache\msfeeds.dll
  64. 2011-02-03 15:39 . 2010-11-06 00:34 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
  65. 2011-02-03 15:39 . 2010-11-06 00:34 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
  66. 2011-02-03 15:39 . 2010-11-06 00:34 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
  67. 2011-02-03 15:39 . 2010-10-21 12:11 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
  68. 2011-02-03 15:39 . 2010-02-22 22:04 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
  69. 2011-02-03 15:39 . 2010-11-06 00:34 6075904 -c----w- c:\windows\system32\dllcache\ieframe.dll
  70. 2011-02-03 15:23 . 2011-02-03 15:25 -------- dc-h--w- c:\windows\ie8
  71. 2011-02-03 13:55 . 2011-02-03 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\EA Logs
  72. 2011-02-03 13:11 . 2011-02-03 13:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
  73. 2011-01-30 01:19 . 2011-01-30 01:19 -------- d-----w- c:\windows\B9DB4C7601A446D58910F7AA6376DBAF.TMP
  74. 2011-01-30 01:13 . 2011-01-30 01:13 -------- d-----w- c:\documents and settings\CRIS\Local Settings\Application Data\Electronic Arts
  75. 2011-01-30 00:46 . 2011-01-30 00:46 -------- d-----w- C:\sims
  76. 2011-01-29 23:15 . 2011-02-03 20:45 -------- d-----w- c:\program files\Electronic Arts
  77. 2011-01-29 20:36 . 2011-01-29 20:36 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
  78. 2011-01-29 20:35 . 2011-02-08 02:29 252080 ----a-w- c:\windows\system32\nvdrsdb0.bin
  79. 2011-01-29 20:35 . 2011-02-08 02:29 1 ----a-w- c:\windows\system32\nvdrssel.bin
  80. 2011-01-29 20:35 . 2011-02-08 02:29 252080 ----a-w- c:\windows\system32\nvdrsdb1.bin
  81. 2011-01-29 20:34 . 2011-01-08 03:27 941160 ----a-w- c:\windows\system32\nvdispco322090.dll
  82. 2011-01-29 20:34 . 2011-01-08 03:27 837736 ----a-w- c:\windows\system32\nvgenco322040.dll
  83. 2011-01-29 20:34 . 2011-01-08 03:27 61440 ----a-w- c:\windows\system32\OpenCL.dll
  84. 2011-01-29 20:34 . 2011-01-08 03:27 13004800 ----a-w- c:\windows\system32\nvcompiler.dll
  85. 2011-01-29 20:34 . 2011-02-08 02:29 -------- d-----w- c:\program files\NVIDIA Corporation
  86. 2011-01-28 22:36 . 2011-01-28 22:36 -------- d-----w- c:\program files\Microsoft WSE
  87. 2011-01-27 04:22 . 2011-01-27 06:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
  88. 2011-01-27 04:22 . 2011-01-27 04:22 -------- d-----w- c:\program files\Spybot - Search & Destroy
  89. 2011-01-21 18:44 . 2011-01-21 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\171DF
  90. 2011-01-21 18:44 . 2011-01-29 04:52 -------- d-----w- c:\documents and settings\CRIS\Application Data\bearsharemediabartb
  91. 2011-01-21 18:43 . 2011-01-22 18:19 -------- d-----w- c:\documents and settings\CRIS\Local Settings\Application Data\BearShare
  92. 2011-01-21 18:43 . 2011-01-26 06:35 -------- d-----w- c:\program files\BearShare Applications
  93. 2011-01-21 18:42 . 2011-01-21 18:42 -------- d-----w- c:\documents and settings\CRIS\Local Settings\Application Data\PackageAware
  94.  
  95. .
  96. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  97. .
  98. 2011-01-08 03:27 . 2009-06-10 23:33 9888672 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
  99. 2011-01-08 03:27 . 2009-06-10 23:33 6397824 ----a-w- c:\windows\system32\nv4_disp.dll
  100. 2011-01-08 03:27 . 2009-06-10 23:33 4980736 ----a-w- c:\windows\system32\nvcuda.dll
  101. 2011-01-08 03:27 . 2009-06-10 23:33 2916968 ----a-w- c:\windows\system32\nvcuvid.dll
  102. 2011-01-08 03:27 . 2009-06-10 23:33 2251368 ----a-w- c:\windows\system32\nvcuvenc.dll
  103. 2011-01-08 03:27 . 2009-06-10 23:33 1958400 ----a-w- c:\windows\system32\nvapi.dll
  104. 2011-01-08 03:27 . 2009-06-10 23:33 14671872 ----a-w- c:\windows\system32\nvoglnt.dll
  105. 2011-01-08 00:56 . 2011-01-08 00:56 81920 ----a-w- c:\windows\system32\nvwddi.dll
  106. 2011-01-08 00:56 . 2011-01-08 00:56 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
  107. 2011-01-08 00:56 . 2011-01-08 00:56 277608 ----a-w- c:\windows\system32\nvmccs.dll
  108. 2011-01-08 00:56 . 2011-01-08 00:56 156776 ----a-w- c:\windows\system32\nvsvc32.exe
  109. 2011-01-08 00:56 . 2011-01-08 00:56 145000 ----a-w- c:\windows\system32\nvcolor.exe
  110. 2011-01-08 00:56 . 2011-01-08 00:56 13880424 ----a-w- c:\windows\system32\nvcpl.dll
  111. 2011-01-08 00:56 . 2011-01-08 00:56 111208 ----a-w- c:\windows\system32\nvmctray.dll
  112. 2010-12-20 23:09 . 2010-02-22 03:50 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
  113. 2010-12-20 23:08 . 2010-02-22 03:50 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
  114. 2010-11-18 18:12 . 2010-02-19 00:13 81920 ----a-w- c:\windows\system32\isign32.dll
  115. 2010-11-12 22:50 . 2010-11-12 22:50 4724 ----a-w- c:\windows\system32\PerfStringBackup.TMP
  116. 2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
  117. 2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
  118. 2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
  119. .
  120.  
  121. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  122. .
  123. .
  124. *Note* empty entries & legit default entries are not shown
  125. REGEDIT4
  126.  
  127. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  128. "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1244040]
  129. "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog2.dll" [2010-10-18 3908192]
  130. "{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\program files\myBabylon_English\tbmyB2.dll" [2010-10-18 3908192]
  131. "{ad708c09-d51b-45b3-9d28-4eba2681febf}"= "c:\program files\Download_Energy\tbDow2.dll" [2010-10-18 3908192]
  132. "{fcbf663e-8530-46f8-a880-ac5abe9d2b23}"= "c:\program files\mobilewitch\tbmob0.dll" [2010-10-18 3908192]
  133. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo0.dll" [2010-12-26 3911776]
  134.  
  135. [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
  136.  
  137. [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
  138.  
  139. [HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
  140.  
  141. [HKEY_CLASSES_ROOT\clsid\{ad708c09-d51b-45b3-9d28-4eba2681febf}]
  142.  
  143. [HKEY_CLASSES_ROOT\clsid\{fcbf663e-8530-46f8-a880-ac5abe9d2b23}]
  144.  
  145. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  146.  
  147. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
  148. 2010-10-18 10:26 3908192 ----a-w- c:\program files\ToggleEN\tbTog2.dll
  149.  
  150. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}]
  151. 2009-12-20 09:51 87480 ----a-w- c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll
  152.  
  153. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}]
  154. 2010-03-28 19:53 353656 ----a-w- c:\program files\PriceGong\2.1.0\PriceGongIE.dll
  155.  
  156. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  157. 2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
  158.  
  159. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{627af46b-2076-42ae-a2fd-8428734d3e74}]
  160. 2010-02-10 16:36 86016 ----a-w- c:\program files\simppulltoolbar\simppulldx.dll
  161.  
  162. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
  163. 2011-01-06 14:06 721840 ----a-w- c:\progra~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll
  164.  
  165. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ad708c09-d51b-45b3-9d28-4eba2681febf}]
  166. 2010-10-18 10:26 3908192 ----a-w- c:\program files\Download_Energy\tbDow2.dll
  167.  
  168. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
  169. 2010-10-18 10:26 3908192 ----a-w- c:\program files\myBabylon_English\tbmyB2.dll
  170.  
  171. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  172. 2010-12-26 22:53 3911776 ----a-w- c:\program files\uTorrentBar\tbuTo0.dll
  173.  
  174. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4B8BAB4-1667-11DF-A242-BA9455D89593}]
  175. 2009-10-20 15:50 258008 ----a-w- c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
  176.  
  177. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  178. 2010-09-28 03:40 1244040 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
  179.  
  180. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fcbf663e-8530-46f8-a880-ac5abe9d2b23}]
  181. 2010-10-18 10:26 3908192 ----a-w- c:\program files\mobilewitch\tbmob0.dll
  182.  
  183. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  184. "{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "c:\program files\ToggleEN\tbTog2.dll" [2010-10-18 3908192]
  185. "{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\program files\myBabylon_English\tbmyB2.dll" [2010-10-18 3908192]
  186. "{ad708c09-d51b-45b3-9d28-4eba2681febf}"= "c:\program files\Download_Energy\tbDow2.dll" [2010-10-18 3908192]
  187. "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1244040]
  188. "{627af46b-2076-42ae-a2fd-8428734d3e74}"= "c:\program files\simppulltoolbar\simppulldx.dll" [2010-02-10 86016]
  189. "{fcbf663e-8530-46f8-a880-ac5abe9d2b23}"= "c:\program files\mobilewitch\tbmob0.dll" [2010-10-18 3908192]
  190. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTo0.dll" [2010-12-26 3911776]
  191. "{0974BA1E-64EC-11DE-B2A5-E43756D89593}"= "c:\progra~1\BEARSH~1\MediaBar\ToolBar\BearshareMediabarDx.dll" [2009-12-20 87480]
  192.  
  193. [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
  194.  
  195. [HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
  196.  
  197. [HKEY_CLASSES_ROOT\clsid\{ad708c09-d51b-45b3-9d28-4eba2681febf}]
  198.  
  199. [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  200. [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  201. [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  202. [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  203.  
  204. [HKEY_CLASSES_ROOT\clsid\{627af46b-2076-42ae-a2fd-8428734d3e74}]
  205.  
  206. [HKEY_CLASSES_ROOT\clsid\{fcbf663e-8530-46f8-a880-ac5abe9d2b23}]
  207.  
  208. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  209.  
  210. [HKEY_CLASSES_ROOT\clsid\{0974ba1e-64ec-11de-b2a5-e43756d89593}]
  211.  
  212. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  213. "{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "c:\program files\ToggleEN\tbTog2.dll" [2010-10-18 3908192]
  214. "{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}"= "c:\program files\myBabylon_English\tbmyB2.dll" [2010-10-18 3908192]
  215. "{AD708C09-D51B-45B3-9D28-4EBA2681FEBF}"= "c:\program files\Download_Energy\tbDow2.dll" [2010-10-18 3908192]
  216. "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1244040]
  217. "{FCBF663E-8530-46F8-A880-AC5ABE9D2B23}"= "c:\program files\mobilewitch\tbmob0.dll" [2010-10-18 3908192]
  218. "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTo0.dll" [2010-12-26 3911776]
  219.  
  220. [HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
  221.  
  222. [HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
  223.  
  224. [HKEY_CLASSES_ROOT\clsid\{ad708c09-d51b-45b3-9d28-4eba2681febf}]
  225.  
  226. [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
  227. [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
  228. [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
  229. [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  230.  
  231. [HKEY_CLASSES_ROOT\clsid\{fcbf663e-8530-46f8-a880-ac5abe9d2b23}]
  232.  
  233. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  234.  
  235. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  236. "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
  237. "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
  238. "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
  239. "EADM"="c:\program files\Electronic Arts\EADM\EADMUI\EADMUI.exe" [2011-02-03 11509760]
  240.  
  241. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  242. "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 53248]
  243. "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
  244. "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-23 149280]
  245. "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
  246. "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]
  247. "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
  248. "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
  249. "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
  250. "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
  251. "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-08 13880424]
  252. "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-01-08 111208]
  253. "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
  254.  
  255. c:\documents and settings\CRIS\Start Menu\Programs\Startup\
  256. CurseClientStartup.ccip [2010-2-19 0]
  257.  
  258. c:\documents and settings\All Users\Start Menu\Programs\Startup\
  259. Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-2-18 24576]
  260. HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
  261.  
  262. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  263. "AppInit_DLLs"=c:\progra~1\BABYLO~1\BndHook.dll
  264.  
  265. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
  266. @="Driver"
  267.  
  268. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  269. "EnableFirewall"= 0 (0x0)
  270.  
  271. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  272. "%windir%\\system32\\sessmgr.exe"=
  273. "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  274. "c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=
  275. "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
  276. "c:\\Program Files\\AIM\\aim.exe"=
  277. "c:\\Program Files\\LimeWire\\LimeWire.exe"=
  278. "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  279. "c:\\Program Files\\iTunes\\iTunes.exe"=
  280. "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  281. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
  282. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
  283. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
  284. "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
  285. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
  286. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
  287. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
  288. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
  289. "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
  290. "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
  291. "c:\\Program Files\\Turbine\\DDO Unlimited\\dndclient.exe"=
  292. "c:\\Program Files\\WinMX Music\\WinMX Music.exe"=
  293. "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
  294. "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
  295. "c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
  296. "c:\\Program Files\\World of Warcraft\\Blizzard Downloader.exe"=
  297. "c:\\Program Files\\Morpheus Music\\Morpheus Music.exe"=
  298. "c:\\Program Files\\LimeRunner\\LimeRunner.exe"=
  299. "c:\\WINDOWS\\system32\\dpvsetup.exe"=
  300. "c:\\Documents and Settings\\CRIS\\Local Settings\\Apps\\2.0\\2V4J0AEP.G0A\\K9LPR48D.HR8\\curs..tion_eee711038731a406_0004.0000_efb506202a7c3b08\\CurseClient.exe"=
  301.  
  302. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
  303. "56780:TCP"= 56780:TCP:Pando Media Booster
  304. "56780:UDP"= 56780:UDP:Pando Media Booster
  305. "6882:TCP"= 6882:TCP:Blizzard Downloader: 6882
  306.  
  307. R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/22/2010 3:26 PM 691696]
  308. R1 cmosa;cmosa;c:\windows\system32\drivers\cmosa.sys [2/18/2010 7:24 PM 29344]
  309. R2 BabylonIM Coordinator;BabylonIM Coordinator;c:\progra~1\BABYLO~1\Bandoo.exe [7/26/2010 6:19 PM 1937344]
  310. S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe" --> c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [?]
  311.  
  312. [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
  313. HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
  314. hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
  315. .
  316. Contents of the 'Scheduled Tasks' folder
  317.  
  318. 2011-02-01 c:\windows\Tasks\AppleSoftwareUpdate.job
  319. - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
  320.  
  321. 2011-02-08 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
  322. - c:\program files\Ask.com\UpdateTask.exe [2010-09-28 03:40]
  323. .
  324. .
  325. ------- Supplementary Scan -------
  326. .
  327. uStart Page = hxxp://search.bearshare.com/
  328. uInternet Settings,ProxyOverride = <local>
  329. uSearchAssistant = hxxp://search.bearshare.com/sidebar.html?src=ssb&sysid=2
  330. IE: Download with &Shareaza - c:\program files\Morpheus Music\RazaWebHook.dll/3000
  331. FF - ProfilePath - c:\documents and settings\CRIS\Application Data\Mozilla\Firefox\Profiles\wi5lbb4o.default\
  332. FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1269415&SearchSource=3&q={searchTerms}
  333. FF - prefs.js: browser.search.selectedEngine - BearShare Web Search
  334. FF - prefs.js: browser.startup.homepage - hxxp://search.bearshare.com/
  335. FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1269415&q=
  336. FF - prefs.js: keyword.url - hxxp://www.startsearcher.com/?q=
  337. FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  338. FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
  339. FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
  340. FF - Ext: FaceTheme - Change your Facebook layout!: [email protected] - %profile%\extensions\[email protected]
  341. FF - Ext: Download Energy Community Toolbar: {ad708c09-d51b-45b3-9d28-4eba2681febf} - %profile%\extensions\{ad708c09-d51b-45b3-9d28-4eba2681febf}
  342. FF - Ext: mobilewitch Toolbar: {fcbf663e-8530-46f8-a880-ac5abe9d2b23} - %profile%\extensions\{fcbf663e-8530-46f8-a880-ac5abe9d2b23}
  343. FF - Ext: Conduit Engine : [email protected] - %profile%\extensions\[email protected]
  344. FF - Ext: MediaBar: {E84D42CA-64EB-11DE-A65F-8C3656D89593} - %profile%\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
  345. FF - Ext: D-Link Toolbar: {926a10d2-4ce7-4331-b96f-ca4e22590fac} - %profile%\extensions\{926a10d2-4ce7-4331-b96f-ca4e22590fac}
  346. FF - Ext: Pastebin: [email protected] - %profile%\extensions\[email protected]
  347. FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
  348. FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff
  349. FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(yahoo.ytff.general.dontshowhpoffer, true);user_pref(network.protocol-handler.warn-external.dnupdate, false
  350. .
  351. - - - - ORPHANS REMOVED - - - -
  352.  
  353. URLSearchHooks-HookURL - (no file)
  354. URLSearchHooks-Rank - (no file)
  355. BHO-{E4E6BF2A-1667-11DF-A01F-1F9655D89593} - (no file)
  356. Toolbar-10 - (no file)
  357. HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
  358. HKCU-Run-SpeedItUpEX - c:\program files\Speeditup Free\SpeedItUp.exe
  359. HKCU-Run-uTorrent - c:\program files\uTorrent\uTorrent.exe
  360. HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
  361. HKLM-Run-Microsoft Default Manager - c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
  362. AddRemove-8461-7759-5462-8226 - c:\program files\Vuze\uninstall.exe
  363. AddRemove-FreeFileViewer_is1 - c:\program files\FreeFileViewer\unins000.exe
  364. AddRemove-McAfee Security Scan - c:\program files\McAfee Security Scan\uninstall.exe
  365. AddRemove-Recuva - c:\program files\Recuva\uninst.exe
  366. AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe
  367. AddRemove-Veetle TV - c:\program files\Veetle\UninstallVeetleTV.exe
  368. AddRemove-{08234a0d-cf39-4dca-99f0-0c5cb496da81} - c:\program files\Bing Bar Installer\InstallManager.exe
  369.  
  370.  
  371.  
  372. **************************************************************************
  373.  
  374. catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  375. Rootkit scan 2011-02-08 13:14
  376. Windows 5.1.2600 Service Pack 3 NTFS
  377.  
  378. scanning hidden processes ...
  379.  
  380. scanning hidden autostart entries ...
  381.  
  382. scanning hidden files ...
  383.  
  384. scan completed successfully
  385. hidden files: 0
  386.  
  387. **************************************************************************
  388. .
  389. --------------------- LOCKED REGISTRY KEYS ---------------------
  390.  
  391. [HKEY_USERS\S-1-5-21-1078081533-1580436667-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
  392. @Allowed: (Read) (RestrictedCode)
  393. @Allowed: (Read) (RestrictedCode)
  394. "??"=hex:e2,56,da,2b,cd,03,85,3a,83,aa,9f,29,e1,4b,39,88,e2,1e,b8,67,20,03,45,
  395. 71,30,3b,55,bf,a1,6f,9b,69,c1,0b,21,91,37,09,70,74,f5,20,72,71,78,42,e2,d9,\
  396. "??"=hex:cd,8a,a3,cf,1c,2c,7b,ad,8a,ac,d2,0d,e1,d2,64,ed
  397.  
  398. [HKEY_USERS\S-1-5-21-1078081533-1580436667-839522115-1003\Software\SecuROM\License information*]
  399. "datasecu"=hex:77,00,c7,52,3b,1c,d1,49,0b,c2,6f,21,21,07,09,a8,05,8f,8e,53,79,
  400. e4,2b,59,e8,c3,f5,62,fd,40,14,f8,b0,05,53,f3,6c,0b,7a,84,7d,d8,db,a3,0b,c6,\
  401. "rkeysecu"=hex:82,ec,e4,c5,70,78,7c,8c,b5,21,59,ac,72,d0,d0,f6
  402.  
  403. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  404. @Denied: (A 2) (Everyone)
  405. @="FlashBroker"
  406. "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
  407.  
  408. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  409. "Enabled"=dword:00000001
  410.  
  411. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  412. @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
  413.  
  414. [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  415. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  416.  
  417. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  418. @Denied: (A 2) (Everyone)
  419. @="IFlashBroker4"
  420.  
  421. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  422. @="{00020424-0000-0000-C000-000000000046}"
  423.  
  424. [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  425. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  426. "Version"="1.0"
  427. .
  428. --------------------- DLLs Loaded Under Running Processes ---------------------
  429.  
  430. - - - - - - - > 'explorer.exe'(2104)
  431. c:\windows\system32\ieframe.dll
  432. c:\windows\system32\OneX.DLL
  433. c:\windows\system32\eappprxy.dll
  434. c:\windows\system32\webcheck.dll
  435. c:\windows\system32\WPDShServiceObj.dll
  436. c:\windows\system32\PortableDeviceTypes.dll
  437. c:\windows\system32\PortableDeviceApi.dll
  438. c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
  439. .
  440. ------------------------ Other Running Processes ------------------------
  441. .
  442. c:\windows\system32\nvsvc32.exe
  443. c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  444. c:\program files\Bonjour\mDNSResponder.exe
  445. c:\program files\Java\jre6\bin\jqs.exe
  446. c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
  447. c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
  448. c:\windows\system32\wscntfy.exe
  449. c:\program files\Windows Media Player\WMPNetwk.exe
  450. c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
  451. c:\windows\stsystra.exe
  452. c:\progra~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE
  453. c:\windows\system32\RUNDLL32.EXE
  454. c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
  455. c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
  456. c:\program files\iPod\bin\iPodService.exe
  457. c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
  458. c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
  459. c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
  460. .
  461. **************************************************************************
  462. .
  463. Completion time: 2011-02-08 13:16:54 - machine was rebooted
  464. ComboFix-quarantined-files.txt 2011-02-08 18:16
  465.  
  466. Pre-Run: 54,867,456,000 bytes free
  467. Post-Run: 64,221,110,272 bytes free
  468.  
  469. WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
  470. [boot loader]
  471. timeout=2
  472. default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
  473. [operating systems]
  474. c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
  475. UnsupportedDebug="do not select this" /debug
  476. multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
  477.  
  478. - - End Of File - - C5282101200F703C8B205041D166A9FB
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!