Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ComboFix Log


  • This topic is locked This topic is locked
2 replies to this topic

#1 allenflame

allenflame

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:04:19 AM

Posted 23 February 2013 - 03:42 PM

 
~~boopme
 
 
seems sluggish alot, almost freezing.  Stil can't do net 4.0 updates.  I ran hdat hard drive tests, tested fine.
 
 
ComboFix 13-02-23.01 - Molly 02/23/2013  15:28:28.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.2036.1133 [GMT -5:00]
Running from: c:\users\Molly\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
 * Created a new restore point
.
.
(((((((((((((((((((((((((   Files Created from 2013-01-23 to 2013-02-23  )))))))))))))))))))))))))))))))
.
.
2013-02-23 20:37 . 2013-02-23 20:37    --------    d-----w-    c:\users\Molly\AppData\Local\temp
2013-02-23 20:37 . 2013-02-23 20:37    --------    d-----w-    c:\users\Default\AppData\Local\temp
2013-02-23 20:20 . 2013-02-23 20:20    29904    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E7197009-CA82-4A91-B4E3-8B1936C8C9C6}\MpKsla4a34348.sys
2013-02-22 18:58 . 2011-09-26 16:20    161760    ----a-w-    c:\program files\0eres.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-02-22 18:46 . 2013-02-22 18:46    159744    ----a-w-    c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-02-22 18:45 . 2013-02-22 18:46    --------    d-----w-    c:\program files\QuickTime
2013-02-22 18:44 . 2013-02-22 18:44    --------    d-----w-    c:\program files\iPod
2013-02-22 18:44 . 2013-02-22 18:44    --------    d-----w-    c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-02-22 18:44 . 2013-02-22 18:44    --------    d-----w-    c:\program files\iTunes
2013-02-22 18:16 . 2013-02-22 18:23    --------    d-----w-    c:\windows\system32\catroot2
2013-02-22 17:26 . 2013-02-05 20:09    374784    ----a-w-    c:\windows\system32\TrustedInstaller.exe
2013-02-22 17:26 . 2013-02-22 17:26    30616    ----a-w-    c:\windows\system32\drivers\hitmanpro37.sys
2013-02-22 12:40 . 2013-02-22 12:40    --------    d-----w-    c:\programdata\COMODO
2013-02-21 21:21 . 2013-02-21 21:21    --------    d-----w-    c:\windows\CheckSur
2013-02-21 21:13 . 2013-02-07 21:45    6954968    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E7197009-CA82-4A91-B4E3-8B1936C8C9C6}\mpengine.dll
2013-02-21 21:08 . 2012-07-26 02:46    9728    ----a-w-    c:\windows\system32\Wdfres.dll
2013-02-21 21:08 . 2012-07-26 02:33    66560    ----a-w-    c:\windows\system32\drivers\WUDFPf.sys
2013-02-21 21:08 . 2012-07-26 02:32    155136    ----a-w-    c:\windows\system32\drivers\WUDFRd.sys
2013-02-21 21:08 . 2012-07-26 03:20    73216    ----a-w-    c:\windows\system32\WUDFSvc.dll
2013-02-21 21:08 . 2009-07-14 12:12    16896    ----a-w-    c:\windows\system32\winusb.dll
2013-02-21 21:08 . 2012-07-26 03:20    172032    ----a-w-    c:\windows\system32\WUDFPlatform.dll
2013-02-21 21:07 . 2012-07-26 03:39    47720    ----a-w-    c:\windows\system32\drivers\WdfLdr.sys
2013-02-21 21:07 . 2012-07-26 03:39    526952    ----a-w-    c:\windows\system32\drivers\Wdf01000.sys
2013-02-21 21:07 . 2012-07-26 03:21    196608    ----a-w-    c:\windows\system32\WUDFHost.exe
2013-02-21 21:07 . 2012-07-26 03:20    38912    ----a-w-    c:\windows\system32\WUDFCoinstaller.dll
2013-02-21 21:07 . 2012-07-26 03:20    613888    ----a-w-    c:\windows\system32\WUDFx.dll
2013-02-21 20:42 . 2013-01-07 02:11    389632    ----a-w-    c:\windows\system32\html.iec
2013-02-21 20:42 . 2012-08-24 15:53    172544    ----a-w-    c:\windows\system32\wintrust.dll
2013-02-21 20:42 . 2012-11-08 03:48    1314816    ----a-w-    c:\windows\system32\quartz.dll
2013-02-21 20:42 . 2013-01-04 11:28    914792    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2013-02-21 20:42 . 2013-01-04 01:55    31232    ----a-w-    c:\windows\system32\drivers\tcpipreg.sys
2013-02-21 20:42 . 2013-01-05 05:26    3550072    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-02-21 20:42 . 2013-01-05 05:26    3602808    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-02-21 18:43 . 2013-02-21 20:00    --------    d-----w-    c:\programdata\HitmanPro
2013-02-21 17:38 . 2013-02-07 21:45    6954968    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-21 17:38 . 2012-06-02 00:02    985088    ----a-w-    c:\windows\system32\crypt32.dll
2013-02-21 17:38 . 2012-06-02 00:02    98304    ----a-w-    c:\windows\system32\cryptnet.dll
2013-02-21 17:38 . 2012-06-02 00:02    133120    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-02-21 17:06 . 2013-02-21 17:06    204288    ----a-w-    c:\windows\system32\ncrypt.dll
2013-02-21 16:54 . 2013-02-21 16:54    2048000    ----a-w-    c:\windows\system32\win32k.sys
2013-02-21 16:54 . 2013-02-21 16:54    1400832    ----a-w-    c:\windows\system32\msxml6.dll
2013-02-21 16:54 . 2013-02-21 16:54    376320    ----a-w-    c:\windows\system32\dpnet.dll
2013-02-21 16:54 . 2013-02-21 16:54    23040    ----a-w-    c:\windows\system32\dpnsvr.exe
2013-02-21 16:54 . 2013-02-21 16:54    2048    ----a-w-    c:\windows\system32\tzres.dll
2013-02-21 16:51 . 2013-02-21 16:51    75776    ----a-w-    c:\windows\system32\synceng.dll
2013-02-21 16:17 . 2013-02-21 16:47    --------    d-----w-    C:\585a702743a891a943
2013-02-20 23:34 . 2013-02-20 23:34    36864    ----a-w-    c:\windows\system32\tsgqec.dll
2013-02-20 23:34 . 2013-02-20 23:34    2690560    ----a-w-    c:\windows\system32\mstscax.dll
2013-02-20 23:34 . 2013-02-20 23:34    130560    ----a-w-    c:\windows\system32\aaclient.dll
2013-02-20 23:34 . 2013-02-20 23:34    1034240    ----a-w-    c:\windows\system32\mstsc.exe
2013-02-20 23:23 . 2009-10-19 20:06    223232    ----a-w-    c:\windows\system32\wksprt.exe
2013-02-20 23:23 . 2009-10-19 20:06    46080    ----a-w-    c:\windows\system32\TSWbPrxy.exe
2013-02-20 23:23 . 2009-10-19 20:06    12800    ----a-w-    c:\windows\system32\wksprtPS.dll
2013-02-20 23:23 . 2009-10-19 20:06    44544    ----a-w-    c:\windows\system32\MsRdpWebAccess.dll
2013-02-20 22:39 . 2013-02-22 18:16    181064    ----a-w-    c:\windows\PSEXESVC.EXE
2013-02-20 22:37 . 2013-02-20 22:37    --------    d-----w-    c:\program files\Tweaking.com
2013-02-20 22:22 . 2013-02-20 22:22    --------    d-----w-    c:\users\Molly\AppData\Local\Macromedia
2013-02-20 20:18 . 2013-02-20 20:18    --------    d-----w-    c:\programdata\Symantec
2013-02-20 20:16 . 2013-02-20 20:21    --------    d-----w-    C:\f18a28f5ba3cef575484
2013-02-20 20:14 . 2013-02-20 20:14    --------    d-----w-    c:\users\Molly\AppData\Local\Mozilla
2013-02-20 16:05 . 2013-02-20 16:05    --------    d-----w-    C:\269c7a532c98672690b2911f0fdc74
2013-02-20 15:47 . 2013-02-20 15:47    740840    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E75ACE1-B03C-4393-8E67-CF6A3AD0E460}\gapaengine.dll
2013-02-20 15:39 . 2013-02-20 15:39    --------    d-----w-    C:\found.000
2013-02-20 08:00 . 2013-02-20 08:00    --------    d-----w-    C:\59d56eb5e6f40a88b013
2013-02-19 23:43 . 2013-02-21 20:29    --------    d-----w-    c:\program files\Microsoft Security Client
2013-02-19 23:42 . 2010-04-05 20:00    221568    ----a-w-    c:\windows\system32\drivers\netio.sys
2013-02-19 23:22 . 2013-02-19 23:22    --------    d-----w-    c:\program files\OpenOffice.org 3
2013-02-19 23:22 . 2013-02-19 23:22    --------    d-----w-    c:\windows\system32\x64
2013-02-19 23:22 . 2008-02-12 01:13    920088    ----a-w-    c:\windows\system32\igxpun.exe
2013-02-19 23:22 . 2006-11-10 21:25    319456    ----a-w-    c:\windows\system32\difxapi.dll
2013-02-19 23:05 . 2013-02-19 23:05    --------    d-----w-    c:\users\Molly\AppData\Roaming\Auslogics
2013-02-19 22:58 . 2013-02-19 22:58    --------    d-----w-    c:\program files\Combined Community Codec Pack
2013-02-19 22:58 . 2013-02-19 22:58    --------    d-----w-    c:\program files\Auslogics
2013-02-19 22:57 . 2012-10-04 23:50    88688    ----a-w-    c:\windows\system32\cpwmon2k.dll
2013-02-19 22:57 . 2013-02-19 22:57    --------    d-----w-    c:\program files\Acro Software
2013-02-19 22:57 . 2013-02-19 22:57    --------    d-----w-    c:\program files\GPLGS
2013-02-19 22:57 . 2013-02-19 22:57    --------    d-----w-    c:\program files\ImgBurn
2013-02-19 22:56 . 2013-02-19 22:55    861088    ----a-w-    c:\windows\system32\npDeployJava1.dll
2013-02-19 22:56 . 2013-02-19 22:55    782240    ----a-w-    c:\windows\system32\deployJava1.dll
2013-02-19 22:56 . 2013-02-19 22:56    94112    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2013-02-19 22:49 . 2013-02-19 22:49    --------    d-----w-    c:\program files\Mozilla Maintenance Service
2013-02-19 21:44 . 2013-01-08 22:01    768000    ----a-w-    c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2013-02-19 15:59 . 2013-02-22 17:22    --------    d-----w-    C:\CCE_Quarantine
2013-02-19 13:12 . 2013-02-19 13:12    --------    d-----w-    C:\a4bc34a25f1b6854e61d17b469
2013-02-19 13:10 . 2012-12-16 13:12    34304    ----a-w-    c:\windows\system32\atmlib.dll
2013-02-19 13:10 . 2012-12-16 10:50    293376    ----a-w-    c:\windows\system32\atmfd.dll
2013-02-18 22:48 . 2013-01-18 17:17    6991832    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{C63144B2-0E22-4989-B4D4-011B60EDD7A0}\mpengine.dll
2013-02-18 22:28 . 2013-02-18 22:28    --------    d-----w-    C:\TDSSKiller_Quarantine
2013-02-18 22:13 . 2013-02-18 22:13    --------    d-----w-    c:\users\Molly\AppData\Roaming\Malwarebytes
2013-02-18 22:12 . 2013-02-18 22:12    --------    d-----w-    c:\programdata\Malwarebytes
2013-02-18 22:12 . 2013-02-18 22:12    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2013-02-18 22:12 . 2012-12-14 21:49    21104    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-02-12 21:47 . 2013-02-12 21:47    --------    d-----w-    c:\users\Molly\AppData\Roaming\KODAK AiO Home Center1537064653
2013-02-07 18:13 . 2013-02-07 18:13    --------    d-----w-    c:\users\Molly\AppData\Roaming\KODAK AiO Home Center693756592
2013-02-05 20:09 . 2013-02-05 20:09    374784    ----a-w-    c:\windows\system32\uti.exe
2013-02-02 07:18 . 2013-02-02 07:18    375808    ----a-w-    c:\windows\system32\TrustedInstallerUpdater.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-19 22:54 . 2012-08-17 23:27    691568    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-02-19 22:54 . 2011-08-30 15:10    71024    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-30 10:53 . 2009-10-02 18:45    232336    ----a-w-    c:\windows\system32\MpSigStub.exe
2013-01-20 20:59 . 2013-01-20 20:59    195296    ----a-w-    c:\windows\system32\drivers\MpFilter.sys
2013-01-20 20:59 . 2012-08-31 03:03    100328    ----a-w-    c:\windows\system32\drivers\NisDrvWFP.sys
2012-12-12 21:37 . 2012-12-12 21:37    4472832    ----a-w-    c:\windows\system32\GPhotos.scr
2013-02-16 00:35 . 2013-02-19 22:49    263064    ----a-w-    c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-16 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"KodakHomeCenter"="c:\program files\Kodak\AiO\Center\AiOHomeCenter.exe" [2012-06-19 2234840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-16 12:18    10536    ----a-w-    c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Billminder.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Billminder.lnk
backup=c:\windows\pss\Billminder.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Quicken Startup.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Startup.lnk
backup=c:\windows\pss\Quicken Startup.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Molly^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=c:\users\Molly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-12-18 19:08    946352    ----a-w-    c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-01-28 18:08    59720    ----a-w-    c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Conime]
2009-04-11 06:27    69120    ----a-w-    c:\windows\System32\conime.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 15:13    206064    ----a-w-    c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2008-03-11 16:44    16384    ----a-w-    c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2008-02-29 04:18    17920    ----a-w-    c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25    125952    ----a-w-    c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EKIJ5000StatusMonitor]
2011-06-16 21:53    2510848    ----a-w-    c:\windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-22 23:25    30192    ----a-w-    c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-12 01:13    166424    ----a-w-    c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-12 01:13    141848    ----a-w-    c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-02-20 17:35    152392    ----a-w-    c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-12 01:13    133656    ----a-w-    c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-17 12:22    4907008    ----a-w-    c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-05-16 12:09    68856    ----a-w-    c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23    1008184    ----a-w-    c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25    202240    ----a-w-    c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSLA4A34348
*Deregistered* - TrueSight
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ       FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-22 19:34    1629648    ----a-w-    c:\program files\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-17 22:54]
.
2013-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 16:00]
.
2013-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 16:00]
.
2013-02-22 c:\windows\Tasks\Kodak AiO Scheduled Maintenance.job
- c:\program files\Kodak\AiO\Center\Kodak.Statistics.exe [2012-06-19 01:13]
.
2013-02-21 c:\windows\Tasks\PC Performer_UPDATES.job
- c:\program files\PC Performer\PCPerformer.exe [2012-04-28 19:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
Trusted Zone: mcleodhealth.org
TCP: DhcpNameServer = 10.1.50.48 10.1.50.1
FF - ProfilePath - c:\users\Molly\AppData\Roaming\Mozilla\Firefox\Profiles\ga2ig4aq.default\
FF - ExtSQL: 2013-02-20 10:51; {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}; c:\program files\PriceGong\2.6.4\FF
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{B1E87B65-676A-4CF1-A01A-FCFCE5A2BB32} - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exe
SafeBoot-78625327.sys
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-CieoNetUtilities_0e Browser Plugin Loader - c:\progra~1\CIEONE~2\bar\1.bin\0ebrmon.exe
MSConfigStartUp-ConnectionCenter - c:\program files\Citrix\ICA Client\concentr.exe
AddRemove-Coupon Printer for Windows4.0 - c:\program files\Coupons\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-23 15:37
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-02-23  15:40:13
ComboFix-quarantined-files.txt  2013-02-23 20:40
.
Pre-Run: 268,357,951,488 bytes free
Post-Run: 268,584,235,008 bytes free
.
- - End Of File - - 228260EA9A01DDE530E2ED278C0E8782

Edited by boopme, 23 February 2013 - 08:24 PM.


BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:19 AM

Posted 26 February 2013 - 10:13 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.
 
If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===
Please download ComboFix from any of the links below, and save it to your desktop. For information regarding this download, please visit this web page: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
 
IMPORTANT !!! Save ComboFix.exe to your Desktop
 
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Do not install any other programs until this if fixed.
 
How to : Disable Anti-virus and Firewall...
http://www.bleepingcomputer.com/forums/topic114351.html
 
Double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt
Note: Do not mouse click ComboFix's window while it's running. That may cause it to stall
 
Note: If you have difficulty properly disabling your protective programs, refer to this link --> http://www.bleepingcomputer.com/forums/topic114351.html
 
Note: If after running ComboFix you get this error message "Illegal operation attempted on a registry key that has been marked for deletion." when attempting to run a program all you need to do is restart the computer to reset the registry.
===
 
Third party programs if not up to date can be the cause of infiltration an infection.
 
Please run this security check for my review.
 
Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===
 
Search and delete the AdWare, PUP (Potentially Unwanted Program) installed on your computer.
 
Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete tab follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Rn].txt (n is a number).
Please post the logs and let me know if the problem persists.


#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:19 AM

Posted 23 April 2013 - 12:56 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users