ComboFix 09-06-16.05 - guido 06/17/2009 11:00.1 - NTFSx86
Running from: c:\documents and settings\guido\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\kb913800.exe
c:\windows\system32\drivers\UACmprmtymytroyiju.sys
c:\windows\system32\UACbivxlybhbdwoyxi.dll
c:\windows\system32\UACbnfedkawkxjbqpo.dll
c:\windows\system32\UACbonliqjrtsxrpvx.dat
c:\windows\system32\UACfulrkvwyvegeuru.db
c:\windows\system32\UAChqbrsptglkedknn.log
c:\windows\system32\uacinit.dll
c:\windows\system32\UACjcgewlgriddoclf.dll
c:\windows\system32\UACsaaxytbtfjkxoqf.log
c:\windows\system32\UACsupxbxmckaprdms.dll
c:\windows\system32\uactmp.db
c:\windows\system32\UACxaqjnojprxkkkif.dll
c:\windows\system32\UACyeqknkjpsghhmtn.dll
c:\windows\system32\UACyrnuebtufrgikyc.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
((((((((((((((((((((((((( Files Created from 2009-05-17 to 2009-06-17 )))))))))))))))))))))))))))))))
.
2009-06-16 16:50 . 2009-06-07 02:56 2052376 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-06-16 16:50 . 2009-06-07 02:56 352024 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll
2009-06-16 16:50 . 2009-06-07 02:56 27784 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmfx86.sys
2009-06-16 16:11 . 2009-06-16 16:11 -------- d-sh--w- c:\documents and settings\guido\IECompatCache
2009-06-16 15:44 . 2009-06-16 15:44 -------- d-sh--w- c:\documents and settings\guido\PrivacIE
2009-06-16 15:34 . 2009-06-16 15:34 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-16 15:34 . 2009-06-16 15:34 -------- d-sh--w- c:\documents and settings\guido\IETldCache
2009-06-16 04:59 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-16 04:59 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-16 04:59 . 2009-06-16 04:59 -------- d-----w- c:\windows\ie8updates
2009-06-16 04:59 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-16 04:56 . 2009-06-16 04:58 -------- dc-h--w- c:\windows\ie8
2009-06-16 03:40 . 2009-06-02 20:38 1004800 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-16 03:23 . 2009-06-16 03:22 1452312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-06-16 03:23 . 2009-06-07 02:56 1085208 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-06-07 14:16 . 2009-06-07 14:20 -------- d-----w- c:\program files\Windows Live Safety Center
2009-06-07 03:11 . 2009-06-17 13:47 -------- d--h--w- C:\$AVG8.VAULT$
2009-06-07 02:56 . 2009-06-07 02:56 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-07 02:56 . 2009-06-07 02:56 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-06-07 02:56 . 2009-06-07 02:56 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-07 02:56 . 2009-06-16 03:24 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-07 02:56 . 2009-06-16 16:50 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-07 02:56 . 2009-06-17 16:04 -------- d-----w- c:\windows\system32\drivers\Avg
2009-06-07 02:56 . 2009-06-07 03:39 -------- d-----w- c:\documents and settings\guido\Application Data\AVGTOOLBAR
2009-06-07 02:56 . 2009-06-16 23:23 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-07 02:56 . 2009-06-07 02:56 -------- d-----w- c:\program files\AVG
2009-06-07 02:36 . 2009-06-07 02:36 -------- d-----w- c:\documents and settings\guido\Application Data\AVG8
2009-06-04 15:13 . 2009-06-04 15:13 -------- d-----w- c:\documents and settings\guido\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-06-03 19:06 . 2009-06-03 19:07 -------- d-----w- C:\d9de0e30bb78385abae9
2009-06-03 19:01 . 2009-06-03 19:02 -------- d-----w- C:\a2d4e01e38f28c33b24bd7
2009-05-31 01:01 . 2009-05-31 01:01 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-05-29 19:49 . 2009-05-30 13:40 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-05-28 19:10 . 2009-05-28 19:10 0 ----a-w- c:\windows\nsreg.dat
2009-05-28 19:10 . 2009-05-28 19:10 -------- d-----w- c:\documents and settings\guido\Local Settings\Application Data\Mozilla
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 19:48 . 2008-04-22 13:20 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-06-16 15:33 . 2009-01-04 15:22 -------- d-----w- c:\program files\Windows Desktop Search
2009-06-16 05:00 . 2009-06-16 03:26 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-07 02:54 . 2008-03-26 21:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-05 05:26 . 2008-09-04 22:22 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-05-29 19:25 . 2008-01-18 05:41 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-27 17:25 . 2009-02-28 23:15 -------- d-----w- c:\program files\AVS4YOU
2009-05-25 07:24 . 2008-05-27 06:18 350208 ------w- c:\windows\system32\mssph.dll
2009-05-14 15:15 . 2008-03-21 02:43 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-13 05:15 . 2006-03-04 03:33 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-12 22:12 . 2008-01-17 21:34 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:32 . 2004-08-10 11:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-05 18:40 . 2009-05-05 18:40 -------- d-----w- c:\documents and settings\guido\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-05-05 18:40 . 2009-05-05 18:40 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-05 18:36 . 2008-05-08 18:56 38208 ----a-w- c:\documents and settings\guido\Application Data\Macromedia\Flash Player\
www.macromedia.com\bin\airappinstaller\airappinstaller.exe2009-04-24 13:02 . 2008-01-17 22:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-17 12:26 . 2004-08-10 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-10 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-09 15:47 . 2009-04-09 15:47 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-09 15:29 . 2008-01-17 22:00 43272 ----a-w- c:\documents and settings\guido\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-26 21:50 . 2009-03-26 21:50 109688 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-25 18:06 . 2008-01-18 00:59 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-03-25 18:06 . 2008-01-18 00:59 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-03-25 18:06 . 2008-01-18 00:59 79880 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-03-25 18:06 . 2008-01-18 00:59 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-03-25 18:05 . 2008-01-18 00:59 34216 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-03-19 23:32 . 2009-03-19 23:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 23:32 . 2008-01-29 19:01 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2009-03-12 15:35 1883672 ----a-w- c:\program files\Freecorder\tbFre0.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-16 16:29 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-15 39408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-16 1948440]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-15 21:55 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2005-07-23 06:46 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-07 02:56 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Adobe\\Photoshop Elements 6.0\\AdobePhotoshopElementsMediaServer.exe"=
"c:\\Program Files\\Adobe\\Adobe Contribute CS3\\Contribute.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
R3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\Drivers\ICDUSB2.sys [2002-11-29 39048]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-06-07 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-06-16 327688]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-06-07 108552]
S2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-10-02 124832]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-07 298776]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-06-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-15 18:35]
2009-06-17 c:\windows\Tasks\User_Feed_Synchronization-{3BC65C83-7F41-4373-AD9D-2E6A316F7E90}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.google.com/uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) =
hxxp://search.yahoo.com/search?fr=mcafee&p=%s.
**************************************************************************
disk not found C:\
please note that you need administrator rights to perform deep scan
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1020)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Completion time: 2009-06-17 11:09
ComboFix-quarantined-files.txt 2009-06-17 18:09
ComboFix2.txt 2009-03-02 22:33
Pre-Run: 33,685,057,536 bytes free
Post-Run: 33,894,522,880 bytes free
185 --- E O F --- 2009-06-17 04:22