ComboFix 09-07-19.02 - idan 07/19/2009 22:09.2.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.3582.2924 [GMT 3:00] Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-252873316-1316193749-3699108838-1000 c:\$recycle.bin\S-1-5-21-3990398859-1419371488-2248589702-1000 c:\windows\Installer\1a7d52.msi c:\windows\Installer\2512cf.msi c:\windows\Installer\3e01df.msi c:\windows\Installer\b4f344.msi . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MSQPDXSERV.SYS -------\Service_msqpdxserv.sys ((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-17 14:08 . 2009-07-17 14:08 -------- d-----w- c:\documents and settings\idan\Application Data\Malwarebytes 2009-07-17 14:08 . 2009-07-17 14:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-07-17 14:08 . 2009-07-13 10:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-17 14:08 . 2009-07-17 14:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-17 14:08 . 2009-07-13 10:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-15 17:50 . 2009-06-16 14:36 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll 2009-07-15 17:50 . 2009-06-16 14:36 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll 2009-07-13 20:45 . 2009-07-13 20:45 5589408 ----a-w- c:\documents and settings\idan\Application Data\TVU Networks\TVU AutoUpgrade\TVUPlayer2.4.5.3.exe 2009-07-13 18:43 . 2009-07-13 18:44 -------- d-----w- c:\documents and settings\idan\Local Settings\Application Data\EasyTVRadio 2009-07-13 18:43 . 2009-07-13 18:43 -------- d-----w- c:\program files\EasyTVRadio 2009-07-08 18:19 . 2009-07-19 16:36 -------- d-----w- c:\documents and settings\idan\Local Settings\Application Data\VirtuaTennis2009 2009-07-08 17:54 . 2009-03-09 12:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll 2009-07-08 17:54 . 2009-03-09 12:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll 2009-07-08 17:54 . 2009-03-16 11:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll 2009-07-08 17:54 . 2009-03-16 11:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll 2009-07-08 17:54 . 2009-03-09 12:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll 2009-07-08 17:54 . 2009-03-16 11:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll 2009-07-08 17:54 . 2009-03-16 11:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll 2009-07-07 11:28 . 2009-07-07 11:28 -------- d-----w- c:\documents and settings\idan\Interwise 2009-07-07 11:18 . 2009-07-07 11:18 -------- d-----w- c:\documents and settings\idan\Application Data\FUEL 2009-07-06 11:38 . 2009-07-07 11:28 -------- d-----w- C:\Interwise 2009-07-06 11:34 . 2009-07-06 11:34 -------- d-----w- c:\program files\WMV9_VCM 2009-06-29 12:23 . 2009-06-29 12:23 -------- d-----w- c:\program files\Common Files\DirectX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 19:17 . 2008-04-16 17:31 -------- d-----w- c:\documents and settings\idan\Application Data\DMCache 2009-07-15 23:23 . 2008-04-17 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-07-14 08:40 . 2008-10-04 15:36 -------- d-----w- c:\documents and settings\idan\Application Data\HPAppData 2009-07-13 18:47 . 2008-05-03 15:51 8 ----a-w- c:\windows\system32\nvModes.dat 2009-07-13 18:43 . 2008-07-10 15:37 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-07-13 07:24 . 2008-12-07 18:56 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-11 08:00 . 2008-11-30 17:34 -------- d-----w- c:\documents and settings\idan\Application Data\Skype 2009-07-11 07:46 . 2008-11-30 17:36 -------- d-----w- c:\documents and settings\idan\Application Data\skypePM 2009-07-08 17:49 . 2008-04-16 16:53 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-06-23 08:03 . 2008-12-07 18:56 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-06-16 14:36 . 2007-09-20 04:48 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2007-09-20 04:34 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-13 16:56 . 2008-04-15 12:11 -------- d-----w- c:\program files\ffdshow 2009-06-06 09:00 . 2008-04-15 12:11 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-06-06 09:00 . 2008-04-15 12:11 60273 ----a-w- c:\windows\system32\pthreadGC2.dll 2009-06-03 19:09 . 2007-09-20 04:34 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-06-01 15:05 . 2009-06-01 15:05 -------- d-----w- c:\program files\Crystal Player2 2009-06-01 15:04 . 2008-04-16 18:32 -------- d-----w- c:\program files\Crystal Player 2009-06-01 10:40 . 2008-04-17 21:37 -------- d-----w- c:\program files\Common Files\Adobe 2009-05-25 14:53 . 2009-04-13 12:58 -------- d-----w- c:\program files\POMQMV3 2009-05-23 23:44 . 2008-10-31 10:51 1435496 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-05-23 13:34 . 2008-09-05 09:28 -------- d-----w- c:\documents and settings\idan\Application Data\PC Suite 2009-05-07 15:32 . 2004-08-03 23:56 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-07 07:43 . 2008-12-07 18:56 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-04-29 04:49 . 2007-09-20 04:59 828928 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:49 . 2007-09-20 04:58 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-27 15:06 . 2008-05-26 01:24 16608 ----a-w- c:\windows\gdrv.sys 2009-04-21 21:20 . 2009-04-21 21:20 14311680 ----a-w- c:\windows\system32\xlive.dll 2009-04-21 21:20 . 2009-04-21 21:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll 2009-07-17 14:22 . 2008-06-18 19:46 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "IDMan"="c:\program files\Internet Download Manager4\IDMan.exe" [2008-07-30 932272] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016] "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-12 1630208] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-7-21 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-01 23:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-07 07:43 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-10-16 18:35 87352 ----a-w- c:\windows\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^idan^Start Menu^Programs^Startup^���� ��� �� OneNote 2007 �- Launcher.lnk] path=c:\documents and settings\idan\Start Menu\Programs\Startup\���� ��� �� OneNote 2007 �- Launcher.lnk backup=c:\windows\pss\���� ��� �� OneNote 2007 �- Launcher.lnkStartup [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "CTFMON.EXE"=c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"= "f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"= "f:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "f:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "f:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "f:\\Program Files\\Microsoft OfficeXP\\Office12\\GROOVE.EXE"= "f:\\Program Files\\Microsoft OfficeXP\\Office12\\ONENOTE.EXE"= "f:\\Program Files\\Microsoft OfficeXP\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"= "f:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"= "f:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"= "c:\\Program Files\\Xilisoft\\Sound Recorder\\sonorec.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "f:\\Program Files\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"= "f:\\Program Files\\Activision\\Prototype\\prototypef.exe"= "f:\\Program Files\\Codemasters\\FUEL\\FUEL.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [07/12/2008 21:56 335752] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/12/2008 21:56 298776] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [24/07/2008 19:46 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [08/05/2008 23:44 47640] R3 DRVofSonorEC;DRVofSonorEC;c:\windows\system32\drivers\DRVofSonorEC.sys [05/01/2009 00:19 20480] S3 cpuz130;cpuz130;\??\c:\docume~1\idan\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\idan\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?] S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\gsvr.exe [31/05/2008 03:00 55816] S3 MarkFun_NT;MarkFun_NT;c:\program files\GIGABYTE\@BIOS\markfun.w32 [27/03/2009 17:30 17912] S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\documents and settings\idan\Desktop\realtemp\WinRing0.sys [27/03/2009 19:01 14416] S4 LMIRfsClientNP;LMIRfsClientNP; [x] --- Other Services/Drivers In Memory --- *Deregistered* - Ndisprot.sys [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . - - - - ORPHANS REMOVED - - - - BHO-{715D8720-A2ED-49A7-ABDF-695F65E91709} - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.colman.ac.il/ IE: &����� �� Microsoft Excel - f:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000 IE: Download all links with IDM - c:\program files\Internet Download Manager4\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager4\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager4\IEExt.htm LSP: c:\windows\system32\idmmbc.dll FF - ProfilePath - c:\documents and settings\idan\Application Data\Mozilla\Firefox\Profiles\n1yp9azt.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\documents and settings\idan\Application Data\IDM\idmmzcc2\components\idmmzcc.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll ---- FIREFOX POLICIES ---- FF - user.js: general.useragent.extra.zencast - c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 22:17 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\c:\program files\Gigabyte\@BIOS\markfun.w32" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1292428093-1390067357-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:43,7e,a8,9f,7b,3a,85,f8,c4,18,b0,91,58,b1,7f,f6,bc,f8,b6,cc,22,59,38, 39,a9,fe,31,61,27,e2,50,47,d0,6f,f0,f3,6c,3f,e4,10,a6,0a,d7,f6,92,92,07,0d,\ "??"=hex:20,6c,02,7f,3d,95,46,b7,c4,ae,31,91,a8,ec,f9,f9 [HKEY_USERS\S-1-5-21-1292428093-1390067357-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:e3,88,83,65,31,83,c6,64,4a,be,ac,66,c6,e2,e7,f9,82,e2,0d,90,b5, f4,36,ea,3e,b1,ec,0d,3d,22,7c,95,a3,d7,7b,e1,64,87,40,27,1f,ba,0f,fc,71,8a,\ "rkeysecu"=hex:95,8f,5f,24,e9,4a,4b,4d,e7,27,6c,00,ca,c8,ee,88 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):24,c1,34,fe,8a,27,78,f1,db,1b,e5,31,79,d5,b0,43,48,41,55,60,e4, b2,1d,cc,10,fa,9d,26,d3,48,8b,0d,a8,6b,07,06,43,fa,ca,da,00,00,00,00,00,00,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{a44af87b-f71a-4162-92b0-0710bbd521e5}] @Denied: (Full) (Everyone) "Model"=dword:000000ac "Therad"=dword:0000000a "MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a, 4b,7b,ad,04,7a,b1,b5,76,9b,27,47,4e,a9,ce,ea,da,41,36,fe,50,fc,7b,bf,11,95,\ [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="D1E087E81D2D08DBF6E11D9970482DED79D931F7543177B7009A7B54EA4FC84E011997E7E6EC218702A9D7D60F9FF8DE6D042DF5DF72AEA572A01EEDB26B090DF8DE4CA5755744F6A4798AFB7C6F2C1BE55707D556C2D17D1C1FFAFB387F46AD4B1EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79338EDD5E5BE2F6E6675D575E7D6A3B98082FBF015F203214AEC4954E28CAEB5CFAC9C056EC83467AF924602342003E0995FDE6A29FA1E7BA79F5718E1D302A0A08E7726F08ABDC840847319D4126228FB6FD16626B3BA659986945226F031B40A55C8D8E4C2911D941BA23FCB2881B078299ACBAFE59C3914DFA9F766F704F66BA92ED3DBB8C524D4F9A0005F13615C6873E83C4292EC966AD0A862201EB8E49027AE529F0A9441533098699EB063190AB5DE43F4D3275BEA278715B9BADD3190985B92319983EC841A968C623104204286B118DE11C39666BAD4BFE4D30CB6A34AEA19F76364CE72125CA392E32D22988E4393674EBB90C9892758C3532DBB53BEE4B375CA22D51CDA84943370D1E692F448564A1E4CFC39018C22887B6975726C6D8A7B5C0D4CC17E3EF5AFC0695944E8E90E61E8B0A850D2FFC990D074B8F543BDD527F39EA03218C4398D1475D5CF0C6E9B0312AAA2B9B4E5E4C212BF4047A5164B9CA78C901E3D937BB9A3C4D56737614D936CEA5749D7197503575C6BA1D97E788BCAF83B62B8AB626D39773FC062D079A1B4C258649174CD94EF628A1191B5B8B0E52D87C175D9FDC89CC0F30AEFBABD364390766A84195418286B2899B7123340D96438A9A18C40B5F9694B1C37763882AEDDC8199F6FE817EC0B5A5283197161B7B6D7DFC83E97D0AF0AC28743A80DD168AEA25CD4388BA0484B38F94F5856BACBFB7D85B6B4BA7D69D359C4061C821676FAC07CAB22532E6F362438DDFAF10CB6733FE2521171D21A13D7EFC0F7840F2444E3DE9DABE4D0E772D9F10134984153C2A3B9D78EC195CC689205268BE4C1E72B14259D0B09A773932EB6FB57C6FBA47183A5C4B657A0F9993373D183E7F6528ECF71BAFC94732A8434ED275E619805C2B0F4FF40AC1D3EA0760104B8E325858482085954FA962F9E854B47F176DBF0CC6AC3357D694D7D0C4176DB2396499B7426240A5F9B742A25BED630A94FDE732826E9DD6403E5D236040CE853FB8E0C08B4A4C06F38F1C5E0BEE834AD600F8E7AB10F5DB2BAB3B80A32002FB117678B38AC678E15E6FD0AC191189FD4CCB870EBFB477D272ED5CC80B63A5541987400FD82CEB67CCBB55515D6F4164D35EBDC9F2E0B32C63BCBD22C5963150AFFBAB1DC3B1A0C9C8FB31D1608CC94044D8D803ACFC0C5CBFF1F2F5B92D6BB52585C2E4CBF1E2404CDC017A62" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(748) c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\windows\system32\LMIinit.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll c:\windows\system32\LMIRfsClientNP.dll - - - - - - - > 'lsass.exe'(804) c:\windows\system32\idmmbc.dll - - - - - - - > 'explorer.exe'(3876) c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\msi.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\Nokia\Nokia PC Suite 7\phonebrowser.dll c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_heb.nlr c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\oodag.exe c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe c:\progra~1\AVG\AVG8\avgrsx.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe c:\program files\Windows Live\Contacts\wlcomm.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-07-19 22:20 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-19 19:20 ComboFix2.txt 2008-12-13 12:00 Pre-Run: 8,584,232,960 bytes free Post-Run: 8,555,667,456 bytes free 311 --- E O F --- 2009-07-15 23:23