Previously had run symantec, adware, malwarebytes numerous times in the past week or so - one of the viruses when I read about it in symantec said it job is to attract other viruses...Symantec caught it and delete it but maybe not...(this was last week)
At the end of running the combofix program it created a log and asked to post it - which I am doing now.
I understand from reading a bit of the intros your site that this was not the way combofix should be used - but I had already ran it.
My computer is running fine right now - but I would still appreciate a professional eye to have a look.
by the way it erased some of the files symantec had also flagged but couldn't delete...
Anyway here is a copy of the log -
ComboFix 10-07-09.02 - Keren 07/10/2010 19:09:04.1.2 - x86
Microsoft® Windows Vistaâ„¢ Home Basic 6.0.6002.2.1255.972.1033.18.1943.655 [GMT 3:00]
Running from: c:\users\Keren\Desktop\ComboFix.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
SP: Symantec Endpoint Protection *disabled* (Updated) {6C85A515-B91D-4D2B-AF18-40984A4A8493}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\SysWoW32
c:\programdata\SysWoW32\mu113783449v4
c:\programdata\SysWoW32\mu113783449v4.kwd
c:\programdata\SysWoW32\mu113783449v5
c:\programdata\SysWoW32\mu113783449v5.kwd
c:\programdata\SysWoW32\mu113783449v6
c:\programdata\SysWoW32\mu113783449v6.kwd
c:\programdata\SysWoW32\mu113783449v7
c:\programdata\SysWoW32\mu113783449v7.kwd
c:\programdata\SysWoW32\wu113783449v0
c:\programdata\SysWoW32\wu113783449v0.kwd
c:\programdata\SysWoW32\wu113783449v1
c:\programdata\SysWoW32\wu113783449v1.kwd
c:\programdata\SysWoW32\wu113783449v2
c:\programdata\SysWoW32\wu113783449v2.kwd
c:\programdata\SysWoW32\wu113783449v3
c:\programdata\SysWoW32\wu113783449v3.kwd
c:\programdata\unrar.exe
c:\users\Keren\AppData\Roaming\02000000eb3c54e4964C.manifest
c:\users\Keren\AppData\Roaming\02000000eb3c54e4964O.manifest
c:\users\Keren\AppData\Roaming\02000000eb3c54e4964P.manifest
c:\users\Keren\AppData\Roaming\02000000eb3c54e4964S.manifest
c:\users\Keren\AppData\Roaming\4E1F.tmp
c:\users\Tali\AppData\Roaming\02000000eb3c54e4964C.manifest
c:\users\Tali\AppData\Roaming\02000000eb3c54e4964O.manifest
c:\users\Tali\AppData\Roaming\02000000eb3c54e4964P.manifest
c:\users\Tali\AppData\Roaming\02000000eb3c54e4964S.manifest
c:\users\Tali\AppData\Roaming\37BF.tmp
c:\users\Tali\AppData\Roaming\5FD9.tmp
c:\users\Tali\AppData\Roaming\C84A.tmp
c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{56e7b4f3-c15d-4da8-9d48-8089fa60710b}
c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{56e7b4f3-c15d-4da8-9d48-8089fa60710b}\chrome.manifest
c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{56e7b4f3-c15d-4da8-9d48-8089fa60710b}\chrome\xulcache.jar
c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{56e7b4f3-c15d-4da8-9d48-8089fa60710b}\defaults\preferences\xulcache.js
c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{56e7b4f3-c15d-4da8-9d48-8089fa60710b}\install.rdf
c:\windows\system32\Thumbs.db
Q:\AUTORUN.INF
S:\AUTORUN.INF
.
((((((((((((((((((((((((( Files Created from 2010-06-10 to 2010-07-10 )))))))))))))))))))))))))))))))
.
2010-07-10 16:21 . 2010-07-10 16:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-10 16:04 . 2010-07-10 16:05 -------- d-----w- C:\32788R22FWJFW
2010-07-10 09:12 . 2010-07-10 09:12 -------- d-----w- c:\users\Tali\AppData\Roaming\Malwarebytes
2010-07-03 19:33 . 2010-07-03 19:33 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-03 19:30 . 2010-07-10 15:57 -------- d-----w- c:\programdata\NOS
2010-07-03 19:19 . 2010-07-03 19:19 -------- d-----w- c:\users\Keren\AppData\Local\Broadcom
2010-07-03 13:37 . 2010-07-03 13:37 -------- d-----w- c:\users\Keren\AppData\Roaming\Malwarebytes
2010-07-03 13:36 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-03 13:36 . 2010-07-03 13:36 -------- d-----w- c:\programdata\Malwarebytes
2010-07-03 13:36 . 2010-07-03 13:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-03 13:36 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-03 13:19 . 2010-07-03 13:19 -------- d-----w- c:\program files\Digital Line Detect
2010-07-03 13:19 . 2010-07-03 13:19 -------- d-----w- c:\users\Keren\AppData\Local\BVRP Software
2010-07-03 13:19 . 2010-07-03 13:19 -------- d-----w- c:\program files\NetWaiting
2010-07-03 13:19 . 2010-07-03 13:19 -------- d-----w- c:\users\Keren\AppData\Roaming\InstallShield
2010-07-03 13:17 . 2009-08-17 09:17 262144 ----a-w- c:\windows\system32\UCI32M42.dll
2010-07-03 13:17 . 2009-04-29 08:21 410624 ----a-w- c:\windows\system32\XAudio32.dll
2010-07-03 13:17 . 2009-04-29 08:20 8704 ----a-w- c:\windows\system32\drivers\XAudio32.sys
2010-07-03 13:17 . 2009-06-30 09:40 981504 ----a-w- c:\windows\system32\drivers\HSX_DPV.sys
2010-07-03 13:17 . 2009-06-30 09:38 207360 ----a-w- c:\windows\system32\drivers\HSXHWAZL.sys
2010-07-03 13:17 . 2009-06-30 09:37 661504 ----a-w- c:\windows\system32\drivers\HSX_CNXT.sys
2010-07-03 12:58 . 2010-07-03 12:58 -------- d-----w- c:\windows\system32\x64
2010-07-03 12:55 . 2010-01-25 14:54 81920 ----a-w- c:\windows\system32\igfxCoIn_v2057.dll
2010-07-03 12:55 . 2010-01-25 13:43 208896 ----a-w- c:\windows\system32\iglhsip32.dll
2010-07-03 12:55 . 2010-01-25 13:43 143360 ----a-w- c:\windows\system32\iglhcp32.dll
2010-07-03 12:55 . 2010-01-25 13:52 4096 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2010-07-03 12:55 . 2010-02-01 11:34 3126808 ----a-w- c:\windows\system32\GfxUI.exe
2010-07-03 12:55 . 2010-01-25 13:52 119808 ----a-w- c:\windows\system32\gfxSrvc.dll
2010-07-03 12:55 . 2010-01-25 13:43 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2010-07-03 12:54 . 2009-06-23 09:49 40832 ----a-w- c:\windows\system32\drivers\HECI.sys
2010-07-03 12:48 . 2009-12-02 10:11 18472 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2010-07-03 12:48 . 2009-12-02 10:11 86056 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2010-07-03 12:48 . 2009-12-02 10:11 29472 ----a-w- c:\windows\system32\drivers\btwl2cap.sys
2010-07-03 12:48 . 2009-12-02 10:11 108072 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2010-07-03 12:41 . 2009-10-27 12:15 460800 ----a-w- c:\windows\system32\drivers\CHDRT32.sys
2010-07-03 12:41 . 2009-10-06 07:51 1729024 ----a-w- c:\windows\system32\CX32TP17.dll
2010-07-03 12:41 . 2009-08-17 09:16 262144 ----a-w- c:\windows\system32\UCI32A42.dll
2010-07-03 12:28 . 2009-04-29 11:19 560640 ----a-w- c:\windows\system32\drivers\hdaudbus.sys
2010-07-03 12:24 . 2009-11-06 10:51 197632 ----a-w- c:\windows\system32\drivers\usbhub.sys
2010-07-03 12:24 . 2009-11-06 10:51 73216 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-07-03 12:24 . 2009-11-06 10:51 228352 ----a-w- c:\windows\system32\drivers\usbport.sys
2010-07-03 12:24 . 2009-11-06 10:50 39936 ----a-w- c:\windows\system32\drivers\usbehci.sys
2010-07-03 12:24 . 2009-11-06 10:50 23552 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2010-07-03 12:24 . 2009-11-06 10:50 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2010-07-03 12:19 . 2009-07-18 09:23 33280 ----a-w- c:\windows\system32\drivers\watchdog.sys
2010-07-03 12:06 . 2010-05-12 00:25 24304 ------w- c:\windows\system32\drivers\DOZEHDD.SYS
2010-07-03 12:02 . 2008-05-12 15:04 13480 ----a-w- c:\windows\system32\drivers\smiif32.sys
2010-07-01 10:54 . 2010-07-01 10:54 -------- d-----w- c:\users\Tali\AppData\Local\Apps
2010-06-27 14:59 . 2010-04-12 14:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-27 12:38 . 2010-06-27 12:38 -------- d-----w- c:\program files\CCleaner
2010-06-27 12:27 . 2010-06-27 12:27 -------- d-----w- c:\windows\system32\drivers\NSS
2010-06-27 12:27 . 2010-06-27 12:27 -------- d-----w- c:\program files\Norton Security Scan
2010-06-27 09:24 . 2010-06-27 09:24 -------- d-----w- c:\users\Keren\AppData\Roaming\Apple Computer
2010-06-27 09:21 . 2010-06-27 09:21 -------- d-----w- c:\program files\Common Files\Apple
2010-06-27 09:20 . 2010-06-27 09:20 -------- d-----w- c:\program files\QuickTime
2010-06-27 09:20 . 2010-06-27 09:20 -------- d-----w- c:\programdata\Apple Computer
2010-06-27 09:14 . 2010-06-27 09:14 -------- d-----w- c:\users\Keren\AppData\Local\Apple Computer
2010-06-26 09:48 . 2010-06-27 12:26 -------- d-----w- c:\users\Keren\AppData\Roaming\LimeWire
2010-06-26 09:48 . 2010-06-26 09:48 -------- d-----w- c:\program files\LimeWire
2010-06-26 09:32 . 2009-11-08 07:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-26 09:32 . 2009-11-08 07:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-26 09:32 . 2009-11-08 07:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-26 09:32 . 2009-11-08 07:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-26 09:32 . 2009-11-08 07:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-16 15:29 . 2010-06-16 15:26 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-06-10 18:17 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-10 18:17 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-10 18:17 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-06-10 18:16 . 2010-05-01 14:13 2037248 ----a-w- c:\windows\system32\win32k.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 16:31 . 2010-07-10 16:31 -------- d-----w- c:\programdata\WindowsSearch
2010-07-10 16:23 . 2009-03-02 06:20 1076 ----a-w- c:\windows\bthservsdp.dat
2010-07-03 20:07 . 2009-04-03 07:42 34 ----a-w- c:\windows\system32\BD7420.DAT
2010-07-03 19:44 . 2010-02-10 18:00 -------- d-----w- c:\program files\CVision
2010-07-03 19:44 . 2009-03-02 06:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-03 19:35 . 2009-03-23 07:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-03 19:32 . 2010-07-03 19:33 53632 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-03 19:30 . 2010-07-03 19:30 71680 ----a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2010-07-03 18:50 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-07-03 12:47 . 2009-03-02 06:26 -------- d-----w- c:\program files\ThinkPad
2010-07-03 12:03 . 2009-03-02 06:25 -------- d-----w- c:\program files\Lenovo
2010-07-01 10:52 . 2010-07-08 05:28 1496064 ----a-w- c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-07-01 10:51 . 2010-07-08 05:28 43008 ----a-w- c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-07-01 10:51 . 2010-07-08 05:28 338944 ----a-w- c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-07-01 10:51 . 2010-07-08 05:28 346112 ----a-w- c:\users\Tali\AppData\Roaming\Mozilla\Firefox\Profiles\jtnwtd35.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-06-29 08:09 . 2010-06-29 08:09 0 ----a-w- c:\users\Tali\AppData\Roaming\DF26.tmp
2010-06-27 15:00 . 2009-03-02 06:39 -------- d-----w- c:\program files\Common Files\Java
2010-06-27 14:59 . 2009-03-02 06:39 -------- d-----w- c:\program files\Java
2010-06-27 12:27 . 2009-08-16 13:14 -------- d-----w- c:\programdata\Norton
2010-06-27 12:27 . 2009-08-16 13:14 -------- d-----w- c:\programdata\NortonInstaller
2010-06-26 09:20 . 2010-04-07 14:04 439816 ----a-w- c:\users\Keren\AppData\Roaming\Real\Update\setup3.11\setup.exe
2010-06-16 15:27 . 2010-03-01 08:43 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\programdata\Adobe\Reader\8.2\ARM\17709\AdobeARM.exe
2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\programdata\Adobe\Reader\8.2\ARM\17709\AdobeExtractFiles.dll
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\programdata\Adobe\Reader\8.2\ARM\17709\ReaderUpdater.exe
2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\programdata\Adobe\Reader\8.2\ARM\17709\AcrobatUpdater.exe
2010-05-21 11:14 . 2009-10-16 03:24 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-14 09:56 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-12 00:25 . 2009-03-02 06:43 394600 ------w- c:\windows\PWMBTHLV.EXE
2010-05-12 00:25 . 2009-03-02 06:43 11552 ------w- c:\windows\system32\drivers\TPPWR32V.SYS
2010-05-04 05:59 . 2010-06-10 18:18 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-10 18:18 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-10 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-10 18:18 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-04-23 14:13 . 2010-05-26 03:08 2048 ----a-w- c:\windows\system32\tzres.dll
2010-02-08 12:59 . 2009-03-23 09:53 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-03-02 05:58 . 2009-03-02 05:56 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 10:58 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-23 39408]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-28 307768]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FingerPrintSoftware"="c:\program files\Lenovo Fingerprint Software\fpapp.exe \s" [X]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"TPFNF7"="c:\progra~1\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-08-04 62240]
"TpShocks"="TpShocks.exe" [2009-12-11 337256]
"TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-12-21 69568]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-10-08 256576]
"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-25 487424]
"LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2008-08-31 165208]
"LPMailChecker"="c:\progra~1\THINKV~1\PrdCtr\LPMLCHK.exe" [2008-08-31 124248]
"AMSG"="c:\progra~1\THINKV~1\AMSG\Amsg.exe" [2009-09-03 436800]
"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2010-05-12 894312]
"BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BTVLogEx.DLL" [2010-05-12 214576]
"CreateLMBCShortCut"="c:\program files\Lenovo\Mobile Broadband Connect\UserShortcutCreator.exe" [2009-01-21 36864]
"ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2010-04-22 431464]
"ACWlIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWlIcon.exe" [2010-04-22 181608]
"cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2008-06-25 3077432]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-11-09 115560]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-02-08 30192]
"TPKMAPHELPER"="c:\program files\ThinkPad\Utilities\TpKmapAp.exe" [2007-02-26 992816]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-09-09 176128]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-16 202256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-28 307768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-02-01 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-02-01 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-02-01 166936]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-10-2 795936]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2010-7-3 50688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2352341855-1366475960-3497596356-1001]
"EnableNotificationsRef"=dword:00000001
R1 tvtumon;tvtumon;c:\windows\system32\DRIVERS\tvtumon.sys [2008-07-11 48192]
R2 gupdate;שירות Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 135664]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2010-04-07 45496]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-10-09 360448]
R3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [2009-03-19 106496]
R3 COH_Mon;COH_Mon;c:\windows\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-02-08 30192]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-12-30 137344]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-12-30 8320]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
R4 ApRunSvc;Alps Application Launcher Service;c:\program files\Apoint2K\ApRunSvc.exe [2007-07-23 36864]
S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [2010-05-12 24304]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-06-16 64288]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2009-10-09 20520]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2008-05-12 13480]
S2 ATService;AuthenTec Fingerprint Service;c:\windows\system32\AtService.exe [2009-03-19 1680632]
S2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [2010-05-12 132456]
S2 dtsvc;Data Transfer Service;c:\windows\system32\DTS.exe [2009-03-19 98304]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-07-01 1352832]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2010-04-20 50536]
S2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2010-05-12 75112]
S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2010-04-07 63928]
S2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [2008-05-25 520192]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-03-19 482176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-11-29 181760]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-12-02 29472]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-28 102448]
S3 LenovoRd;LenovoRd;c:\windows\system32\Drivers\LenovoRd.sys [2007-06-08 81280]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2008-02-22 37312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HsfXAudioService REG_MULTI_SZ HsfXAudioService
.
Contents of the 'Scheduled Tasks' folder
2010-07-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 15:26]
2010-07-10 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 13:54]
2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 13:53]
2010-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 13:53]
2010-07-10 c:\windows\Tasks\Norton Security Scan for Keren.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.0.52\Nss.exe [2010-06-27 07:22]
2010-06-28 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2008-12-12 23:32]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.symantec.com/enterprise/security_response/index.jsp
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
TCP: {46C9439F-D0F1-43B1-91BE-B206CE789472} = 192.115.106.35
FF - ProfilePath - c:\users\Keren\AppData\Roaming\Mozilla\Firefox\Profiles\td5ql2t2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll
FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
BHO-{04BE4EA0-8548-4B5D-A607-E0EAD49545Cf} - (no file)
SafeBoot-Symantec Antvirus
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-10 19:28
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vsdatant]
"ImagePath"="a"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(4316)
c:\program files\ThinkPad\Bluetooth Software\btmmhook.dll
c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\US\PWMRT32V.DLL
c:\progra~1\ThinkPad\UTILIT~1\PWMIF32V.DLL
c:\program files\ThinkPad\Bluetooth Software\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\brsvc01a.exe
c:\windows\system32\brss01a.exe
c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
c:\program files\ThinkPad\Bluetooth Software\btwdins.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\program files\Lenovo\Client Security Solution\tvttcsd.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe
c:\program files\Lenovo\System Update\SUService.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Lenovo\NPDIRECT\tpfnf7sp.exe
c:\windows\System32\TpShocks.exe
c:\program files\ThinkPad\Utilities\EZEJMNAP.EXE
c:\program files\ThinkVantage\PrdCtr\LPMGR.EXE
c:\program files\ThinkVantage\PrdCtr\LPMLCHK.EXE
c:\program files\ThinkVantage\AMSG\Amsg.exe
c:\windows\System32\rundll32.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\windows\system32\igfxext.exe
c:\program files\Apoint2K\Apntex.exe
c:\progra~1\ThinkPad\UTILIT~1\PWMUIAux.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\program files\ThinkPad\Bluetooth Software\BtStackServer.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
c:\progra~1\ThinkPad\UTILIT~1\PWMUIAux.exe
.
**************************************************************************
.
Completion time: 2010-07-10 19:38:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-10 16:38
Pre-Run: 62,545,178,624 bytes free
Post-Run: 65,143,054,336 bytes free
- - End Of File - - B4B1E1CCD2FCFB348730D662BBF03CFA
Edited by Orange Blossom, 10 July 2010 - 09:10 PM.
Move to log forum. ~ OB