ComboFix 12-12-23.01 - owner 12/23/2012 12:16:46.3.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2814.1750 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\owner\Desktop\CFScript.tex AV: BullGuard Antivirus *Disabled/Outdated* {C3CCAC61-52F7-A056-1860-6406566E2578} SP: BullGuard Antispyware *Disabled/Outdated* {78AD4D85-74CD-AFD8-22D0-5F742DE96FC5} SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\owner\appdata\roaming\Bezoeq c:\users\owner\appdata\roaming\Bezoeq\obco.uqm c:\users\owner\appdata\roaming\Puug c:\users\owner\appdata\roaming\Ruihn . . ((((((((((((((((((((((((( Files Created from 2012-11-23 to 2012-12-23 ))))))))))))))))))))))))))))))) . . 2012-12-23 17:23 . 2012-12-23 17:23 -------- d-----w- c:\users\owner\AppData\Local\temp 2012-12-23 17:23 . 2012-12-23 17:23 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-12-20 01:06 . 2009-01-25 17:14 15224 ----a-w- c:\windows\system32\sdnclean.exe 2012-12-20 01:06 . 2012-12-20 01:06 -------- d-----w- c:\program files\Spybot - Search & Destroy 2 2012-12-20 01:05 . 2012-12-20 01:05 -------- d-----w- c:\users\owner\AppData\Local\Programs 2012-12-20 00:45 . 2012-12-20 00:45 -------- d-----w- c:\programdata\Tarma Installer 2012-12-19 23:27 . 2012-12-19 23:27 388096 ----a-r- c:\users\owner\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-12-19 15:22 . 2012-12-19 15:22 -------- d-----w- c:\program files\Trend Micro 2012-12-19 15:13 . 2012-12-19 15:13 -------- d-----w- c:\program files\Common Files\Java 2012-12-19 15:12 . 2012-12-19 15:11 859072 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-12-19 15:12 . 2012-12-19 15:11 93640 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2012-12-19 14:44 . 2012-12-19 14:44 -------- d-----w- c:\program files\CCleaner 2012-12-17 19:26 . 2012-12-23 10:33 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8B0D1673-EFBE-4DF5-A790-85AEA6E6E239}\offreg.dll 2012-12-16 00:26 . 2012-12-16 00:26 -------- d-----w- c:\users\owner\AppData\Local\MFAData 2012-12-16 00:26 . 2012-12-16 00:26 -------- d-----w- c:\users\owner\AppData\Local\Avg2013 2012-12-15 18:20 . 2012-12-15 18:19 54624 ----a-w- c:\windows\system32\BGLsp.dll 2012-12-15 17:47 . 2012-12-15 17:47 -------- d-----w- c:\program files\Common Files\BullGuard Ltd 2012-12-15 17:47 . 2012-12-15 17:47 -------- d-----w- c:\program files\BullGuard Ltd 2012-12-11 14:10 . 2012-12-11 14:10 -------- d-----w- c:\program files\MyScrapNook_12 2012-12-09 15:47 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8B0D1673-EFBE-4DF5-A790-85AEA6E6E239}\mpengine.dll 2012-12-04 03:57 . 2012-12-04 03:57 -------- d-----w- c:\windows\Sun . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-19 15:11 . 2012-02-06 22:55 779704 ----a-w- c:\windows\system32\deployJava1.dll 2012-12-12 05:12 . 2012-05-17 18:58 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-12-12 05:12 . 2012-01-31 15:28 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-18 17:59 . 2012-11-14 11:37 2345984 ----a-w- c:\windows\system32\win32k.sys 2012-10-04 07:38 . 2012-10-04 07:38 27760 ----a-w- c:\windows\system32\drivers\BdNet.sys 2012-09-30 00:54 . 2012-11-19 14:29 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-25 22:47 . 2012-11-14 11:14 78336 ----a-w- c:\windows\system32\synceng.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Spybot-S&D Cleaning"="c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe" [2012-11-13 3713032] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BullGuard"="c:\program files\BullGuard Ltd\BullGuard Antivirus\BullGuard.exe" [2012-12-17 598880] "BullGuardUpdate2"="c:\program files\bullguard ltd\bullguard antivirus\BullGuardUpdate2.exe" [2012-12-17 1884512] "SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2012-11-13 3825176] . c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ NexDef Plug-in.lnk - c:\users\owner\AppData\Local\Autobahn\nexdef.exe [2011-8-11 15490560] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\progra~1\BULLGU~1\BULLGU~1\BgAgent.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [x] R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [x] R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S1 BdSpy;BdSpy;c:\windows\system32\drivers\BdSpy.sys [x] S1 NovaShieldFilterDriver;NovaShieldFilterDriver;c:\windows\system32\DRIVERS\NSKernel.sys [x] S1 NovaShieldTDIDriver;NovaShieldTDIDriver;c:\windows\system32\DRIVERS\NSNetmon.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 BsBhvScan;BullGuard behavioural detection service;c:\program files\BullGuard Ltd\BullGuard Antivirus\BullGuardBhvScanner.exe [x] S2 BsFileScan;BullGuard on-access service;c:\windows\System32\SvcHost.exe [x] S2 BsMailProxy;BullGuard e-mail monitoring service;c:\windows\System32\SvcHost.exe [x] S2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe [x] S2 BsScanner;BullGuard scanning service;c:\program files\BullGuard Ltd\BullGuard Antivirus\BullGuardScanner.exe [x] S2 BsUpdate;BullGuard update service;c:\program files\BullGuard Ltd\BullGuard Antivirus\BullGuardUpdate.exe [x] S3 BdNet;BdNet;c:\windows\system32\drivers\BdNet.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 10753974 *NewlyCreated* - 87844241 *Deregistered* - 10753974 *Deregistered* - 87844241 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] BullGuard_Backup REG_MULTI_SZ BsBackup BsBackup BsBackup BsBackup BsBackup BullGuard_Main REG_MULTI_SZ BsMain BullGuard REG_MULTI_SZ BsFileScan BullGuard_Proxy REG_MULTI_SZ BsMailProxy . Contents of the 'Scheduled Tasks' folder . 2012-12-23 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-17 05:12] . 2012-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-01-31 15:29] . 2012-12-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-01-31 15:29] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ mStart Page = hxxp://www.bigseekpro.com/nchfilebulldog/{83749C25-4904-432A-BE1C-A567637117C2} uInternet Settings,ProxyOverride = local; uSearchAssistant = hxxp://feed.snap.do/?publisher=VertiTechnology&dpid=VertiTechnology&co=US&userid=48bbb08d-ad57-4ce0-966c-4c5fbf3df08a&searchtype=ds&q={searchTerms} TCP: DhcpNameServer = 192.168.1.1 . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-12-23 12:25:19 ComboFix-quarantined-files.txt 2012-12-23 17:25 ComboFix2.txt 2012-12-23 04:08 . Pre-Run: 117,503,918,080 bytes free Post-Run: 120,096,460,800 bytes free . - - End Of File - - F900F403D08CDF87157FAD3F5B7C7040