API tools faq
paste
filipovicvuk

Combofix log

filipovicvuk
Mar 13th, 2011
83
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.14 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 11-03-12.01 - Vuk 13.03.2011 12:02:13.1.2 - x86
  2. Microsoft Windows 7 Ultimate 6.1.7600.0.1250.381.1033.18.3071.1807 [GMT 1:00]
  3. Running from: c:\users\Vuk\Desktop\ComboFix.exe
  4. AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}
  5. SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}
  6. SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  7. * Created a new restore point
  8. .
  9. .
  10. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  11. .
  12. .
  13. c:\programdata\Microsoft\Windows\Start Menu\Programs\RegGenie
  14. c:\programdata\Microsoft\Windows\Start Menu\Programs\RegGenie\RegGenie.lnk
  15. c:\programdata\Microsoft\Windows\Start Menu\Programs\RegGenie\Uninstall RegGenie.lnk
  16. c:\users\Vuk\Desktop\RegGenie.lnk
  17. c:\windows\system32\Drivers\wvip.sys
  18. E:\install.exe
  19. .
  20. .
  21. ((((((((((((((((((((((((( Files Created from 2011-02-13 to 2011-03-13 )))))))))))))))))))))))))))))))
  22. .
  23. .
  24. 2011-03-13 11:06 . 2011-03-13 11:06 -------- d-----w- c:\users\Default\AppData\Local\temp
  25. 2011-03-10 10:52 . 2011-03-10 12:22 -------- d-----w- c:\programdata\PC Tools
  26. 2011-03-10 09:59 . 2011-03-10 10:07 -------- dc----w- c:\windows\system32\DRVSTORE
  27. 2011-03-10 09:59 . 2011-03-10 09:59 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
  28. 2011-03-10 09:59 . 2011-03-10 09:59 -------- d-----w- c:\users\Vuk\AppData\Local\Sunbelt Software
  29. 2011-03-10 09:58 . 2011-03-10 10:07 -------- d-----w- c:\programdata\Lavasoft
  30. 2011-03-10 07:03 . 2011-03-10 07:03 -------- d-----w- c:\users\Vuk\AppData\Roaming\Malwarebytes
  31. 2011-03-10 07:02 . 2011-03-10 07:02 -------- d-----w- c:\programdata\Malwarebytes
  32. 2011-03-10 05:59 . 2011-02-23 08:35 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{969EAB79-936A-422C-9525-145F607C05B8}\mpengine.dll
  33. 2011-03-10 05:04 . 2011-02-19 05:33 802304 ----a-w- c:\windows\system32\FntCache.dll
  34. 2011-03-10 05:04 . 2011-02-19 05:32 1074176 ----a-w- c:\windows\system32\DWrite.dll
  35. 2011-03-10 05:04 . 2011-02-19 05:32 739840 ----a-w- c:\windows\system32\d2d1.dll
  36. 2011-03-10 05:04 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
  37. 2011-03-10 05:04 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
  38. 2011-03-10 05:04 . 2010-12-23 05:28 534528 ----a-w- c:\windows\system32\EncDec.dll
  39. 2011-03-10 05:04 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
  40. 2011-03-10 05:04 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
  41. 2011-03-10 05:04 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\system32\mstsc.exe
  42. 2011-03-06 03:12 . 2011-03-06 03:12 -------- d-----w- c:\users\Vuk\AppData\Local\Activision
  43. 2011-03-06 03:00 . 2011-03-06 03:00 -------- d-----w- c:\programdata\ATI
  44. 2011-02-28 01:57 . 2011-02-28 03:42 -------- d-----w- c:\users\Vuk\AppData\Local\Turbine
  45. 2011-02-28 01:56 . 2011-02-28 21:16 -------- d-----w- c:\users\Vuk\AppData\Local\ApplicationHistory
  46. 2011-02-28 01:37 . 2011-02-28 01:37 -------- d-----w- c:\users\Vuk\AppData\Local\The Lord of the Rings Online
  47. 2011-02-24 02:00 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
  48. 2011-02-23 11:29 . 2011-01-07 07:31 442880 ----a-w- c:\windows\system32\XpsPrint.dll
  49. 2011-02-23 11:29 . 2011-01-07 07:31 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
  50. 2011-02-18 19:00 . 2011-02-18 19:00 -------- d-----w- c:\users\Vuk\AppData\Local\EA Games
  51. 2011-02-14 16:36 . 2011-02-14 16:36 -------- d-----w- c:\users\Vuk\AppData\Roaming\RegGenie
  52. .
  53. .
  54. (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  55. .
  56. 2011-02-10 06:06 . 2011-02-10 06:06 73046988 ----a-w- c:\windows\system32\xa36347265.exe
  57. 2011-02-10 06:06 . 2011-02-10 06:06 73046988 ----a-w- c:\windows\system32\xa36346485.exe
  58. 2011-02-10 06:05 . 2011-02-10 06:05 73046988 ----a-w- c:\windows\system32\xa36317313.exe
  59. 2011-02-10 06:05 . 2011-02-10 06:05 73046988 ----a-w- c:\windows\system32\xa36314957.exe
  60. 2011-02-03 05:45 . 2011-02-09 18:58 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
  61. 2011-02-02 16:11 . 2010-07-16 15:05 222080 ------w- c:\windows\system32\MpSigStub.exe
  62. 2011-01-26 23:36 . 2011-01-26 23:36 7566848 ----a-w- c:\windows\system32\drivers\atikmdag.sys
  63. 2011-01-26 23:00 . 2011-01-26 23:00 143360 ----a-w- c:\windows\system32\atiapfxx.exe
  64. 2011-01-26 23:00 . 2010-05-05 02:19 596480 ----a-w- c:\windows\system32\aticfx32.dll
  65. 2011-01-26 22:59 . 2011-01-26 22:59 17204736 ----a-w- c:\windows\system32\atioglxx.dll
  66. 2011-01-26 22:56 . 2011-01-05 02:58 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
  67. 2011-01-26 22:55 . 2011-01-26 22:55 393216 ----a-w- c:\windows\system32\atieclxx.exe
  68. 2011-01-26 22:55 . 2011-01-26 22:55 176128 ----a-w- c:\windows\system32\atiesrxx.exe
  69. 2011-01-26 22:54 . 2011-01-26 22:54 159744 ----a-w- c:\windows\system32\atitmmxx.dll
  70. 2011-01-26 22:53 . 2011-01-05 02:56 356352 ----a-w- c:\windows\system32\atipdlxx.dll
  71. 2011-01-26 22:53 . 2011-01-26 22:53 278528 ----a-w- c:\windows\system32\Oemdspif.dll
  72. 2011-01-26 22:53 . 2011-01-26 22:53 15872 ----a-w- c:\windows\system32\atimuixx.dll
  73. 2011-01-26 22:53 . 2011-01-26 22:53 43520 ----a-w- c:\windows\system32\ati2edxx.dll
  74. 2011-01-26 22:49 . 2010-05-05 02:08 4105728 ----a-w- c:\windows\system32\atidxx32.dll
  75. 2011-01-26 22:32 . 2011-01-26 22:32 1912832 ----a-w- c:\windows\system32\atiumdmv.dll
  76. 2011-01-26 22:28 . 2011-01-05 02:33 4170752 ----a-w- c:\windows\system32\atiumdag.dll
  77. 2011-01-26 22:27 . 2011-01-26 22:27 46080 ----a-w- c:\windows\system32\aticalrt.dll
  78. 2011-01-26 22:27 . 2011-01-26 22:27 44032 ----a-w- c:\windows\system32\aticalcl.dll
  79. 2011-01-26 22:25 . 2011-01-26 22:25 5580800 ----a-w- c:\windows\system32\aticaldd.dll
  80. 2011-01-26 22:24 . 2011-01-05 02:25 3463680 ----a-w- c:\windows\system32\atiumdva.dll
  81. 2011-01-26 22:20 . 2010-05-05 01:34 52736 ----a-w- c:\windows\system32\coinst.dll
  82. 2011-01-26 22:14 . 2011-01-05 02:20 249856 ----a-w- c:\windows\system32\atiadlxx.dll
  83. 2011-01-26 22:13 . 2011-01-26 22:13 12800 ----a-w- c:\windows\system32\atiglpxx.dll
  84. 2011-01-26 22:13 . 2011-01-26 22:13 32768 ----a-w- c:\windows\system32\atigktxx.dll
  85. 2011-01-26 22:13 . 2011-01-26 22:13 238592 ----a-w- c:\windows\system32\drivers\atikmpag.sys
  86. 2011-01-26 22:12 . 2010-05-05 01:22 30720 ----a-w- c:\windows\system32\atiuxpag.dll
  87. 2011-01-26 22:12 . 2010-05-05 01:22 28672 ----a-w- c:\windows\system32\atiu9pag.dll
  88. 2011-01-26 22:11 . 2011-01-26 22:11 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
  89. 2011-01-26 22:08 . 2011-01-26 22:08 52736 ----a-w- c:\windows\system32\atimpc32.dll
  90. 2011-01-26 22:08 . 2011-01-26 22:08 52736 ----a-w- c:\windows\system32\amdpcom32.dll
  91. 2011-01-07 07:27 . 2011-02-09 18:59 34304 ----a-w- c:\windows\system32\atmlib.dll
  92. 2011-01-07 05:33 . 2011-02-09 18:59 294400 ----a-w- c:\windows\system32\atmfd.dll
  93. 2011-01-05 05:37 . 2011-02-09 18:59 428032 ----a-w- c:\windows\system32\vbscript.dll
  94. 2011-01-05 03:37 . 2011-02-09 18:59 2329088 ----a-w- c:\windows\system32\win32k.sys
  95. 2010-12-21 05:38 . 2011-02-09 18:58 73728 ----a-w- c:\windows\system32\wscsvc.dll
  96. 2010-12-21 05:38 . 2011-02-09 18:58 51200 ----a-w- c:\windows\system32\wscapi.dll
  97. 2010-12-21 05:38 . 2011-02-09 18:58 981504 ----a-w- c:\windows\system32\wininet.dll
  98. 2010-12-21 05:38 . 2011-02-09 18:58 350720 ----a-w- c:\windows\system32\winhttp.dll
  99. 2010-12-21 05:38 . 2011-02-09 18:58 204800 ----a-w- c:\windows\system32\WebClnt.dll
  100. 2010-12-21 05:38 . 2011-02-09 18:58 204288 ----a-w- c:\windows\system32\upnp.dll
  101. 2010-12-21 05:38 . 2011-02-09 18:58 14336 ----a-w- c:\windows\system32\slwga.dll
  102. 2010-12-21 05:36 . 2011-02-09 18:58 1389568 ----a-w- c:\windows\system32\msxml6.dll
  103. 2010-12-21 05:36 . 2011-02-09 18:58 1236992 ----a-w- c:\windows\system32\msxml3.dll
  104. 2010-12-21 05:34 . 2011-02-09 18:58 80384 ----a-w- c:\windows\system32\davclnt.dll
  105. 2010-12-18 05:29 . 2011-02-09 18:59 44544 ----a-w- c:\windows\system32\licmgr10.dll
  106. 2010-12-18 05:29 . 2011-02-09 18:59 541184 ----a-w- c:\windows\system32\kerberos.dll
  107. 2010-12-18 04:20 . 2011-02-09 18:59 386048 ----a-w- c:\windows\system32\html.iec
  108. 2010-12-18 03:47 . 2011-02-09 18:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb
  109. .
  110. .
  111. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  112. .
  113. .
  114. *Note* empty entries & legit default entries are not shown
  115. REGEDIT4
  116. .
  117. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  118. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  119. .
  120. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  121. .
  122. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
  123. 2010-11-29 14:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
  124. .
  125. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  126. 2010-11-29 14:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
  127. .
  128. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  129. "{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  130. "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
  131. .
  132. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  133. .
  134. [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
  135. .
  136. [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  137. "{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-11-29 3908192]
  138. "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]
  139. .
  140. [HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
  141. .
  142. [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
  143. .
  144. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  145. "egui"="e:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]
  146. "ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
  147. "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
  148. .
  149. c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
  150. SketchBook Snapshot.lnk - e:\program files\Autodesk\SketchBookPro2010\SketchBookSnapshot.exe [2009-2-23 708608]
  151. .
  152. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  153. "ConsentPromptBehaviorAdmin"= 5 (0x5)
  154. "ConsentPromptBehaviorUser"= 3 (0x3)
  155. "EnableUIADesktopToggle"= 0 (0x0)
  156. .
  157. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  158. 2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  159. .
  160. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  161. 2011-01-31 08:44 35760 ----a-w- e:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
  162. .
  163. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
  164. 2010-03-06 01:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
  165. .
  166. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
  167. 2010-02-22 02:57 406992 ----a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
  168. .
  169. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
  170. 2009-10-30 11:57 369200 ----a-w- e:\program files\DAEMON Tools Lite\DTLite.exe
  171. .
  172. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OscarEditor]
  173. 2009-12-22 14:23 2647040 ----a-w- c:\program files\Anti-Vibrate Oscar Editor\OscarEditor.exe
  174. .
  175. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
  176. 2009-10-14 13:42 292824 ----a-w- e:\program files\Registry Mechanic\RMTray.exe
  177. .
  178. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSDMonitor]
  179. 2009-10-14 13:42 104408 ----a-w- c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
  180. .
  181. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  182. 2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
  183. .
  184. [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
  185. 2010-02-19 11:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
  186. .
  187. R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
  188. R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
  189. R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
  190. R3 SaiHF518;SaiHF518;c:\windows\system32\DRIVERS\SaiHF518.sys [2007-05-31 135048]
  191. R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
  192. R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
  193. S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-16 691696]
  194. S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-29 108792]
  195. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 176128]
  196. S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-30 20968]
  197. S2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-29 735960]
  198. S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-09-29 95896]
  199. S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2009-10-14 583640]
  200. S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-11-23 4497704]
  201. S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-11-23 113448]
  202. S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 7566848]
  203. S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 238592]
  204. S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-11-17 101392]
  205. S3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\DRIVERS\WacomVTHid.sys [2009-07-09 13480]
  206. S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
  207. .
  208. .
  209. Contents of the 'Scheduled Tasks' folder
  210. .
  211. .
  212. ------- Supplementary Scan -------
  213. .
  214. uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
  215. IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
  216. .
  217. - - - - ORPHANS REMOVED - - - -
  218. .
  219. HKCU-Run-AdobeBridge - (no file)
  220. .
  221. .
  222. .
  223. --------------------- LOCKED REGISTRY KEYS ---------------------
  224. .
  225. [HKEY_USERS\S-1-5-21-1438708494-2505514828-1194108675-1001\Software\SecuROM\License information*]
  226. "datasecu"=hex:a4,cc,93,b4,58,b5,78,33,bf,c0,70,c7,7f,28,a3,91,cc,ef,0d,71,43,
  227. de,08,79,de,39,30,d4,da,1a,16,f5,59,25,1f,a2,35,a7,87,d7,f9,b7,f2,e8,16,9f,\
  228. "rkeysecu"=hex:68,d2,64,ab,90,a9,33,85,70,f9,b2,f4,98,62,17,2f
  229. .
  230. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  231. @Denied: (Full) (Everyone)
  232. .
  233. Completion time: 2011-03-13 12:06:46
  234. ComboFix-quarantined-files.txt 2011-03-13 11:06
  235. .
  236. Pre-Run: 11.568.844.800 bytes free
  237. Post-Run: 18.269.339.648 bytes free
  238. .
  239. - - End Of File - - 94C197B7C4720C089527B4105BFB81A9
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!