Hi Satchfan,
Sorry about the delay, It took a while to finish the ComboFix scan, this time I used a fresh copy as you said and I added no script, there was no crash and ComboFix finished succesfully after some hours.
Here is the log file:
ComboFix 12-12-04.01 - ASD-MASTER 07/12/2012 15:10:00.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.34.3082.18.2038.1096 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-11-07 to 2012-12-07 )))))))))))))))))))))))))))))))
.
.
2012-12-07 14:47 . 2012-12-07 14:47 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-12-02 02:59 . 2012-12-02 02:59 ——– d—–w- c:\program files\ESET
2012-12-02 02:18 . 2012-12-02 02:21 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-11-27 22:52 . 2012-11-27 22:52 ——– d—–w- c:\program files\DsNET Corp
2012-11-24 22:56 . 2012-11-24 22:56 177496 —-a-w- c:\windows\system32\drivers\65054652.sys
2012-11-23 23:48 . 2012-12-06 17:08 ——– d—–w- c:\windows\system32\drivers\AVG
2012-11-23 19:14 . 2012-11-23 23:28 ——– d—–w- c:\programdata\avg9
2012-11-23 15:51 . 2012-11-23 15:51 0 ——w- c:\windows\system32\drivers\SET73BC.tmp
2012-11-23 05:22 . 2012-11-23 05:45 ——– d—–w- C:\TDSSKiller_Quarantine
2012-11-23 04:46 . 2012-11-23 04:46 ——– d—–w- c:\users\ASD-MASTER\AppData\Local\fontconfig
2012-11-23 04:44 . 2012-11-24 03:04 ——– d—–w- c:\users\ASD-MASTER\AppData\Roaming\Aegisub
2012-11-23 04:44 . 2012-11-23 04:46 ——– d—–w- c:\users\ASD-MASTER\AppData\Local\Aegisub
2012-11-23 04:43 . 2012-11-23 04:44 ——– d—–w- c:\program files\Aegisub
2012-11-23 01:57 . 2009-03-18 15:35 26176 —ha-w- c:\windows\system32\hamachi.sys
2012-11-17 02:24 . 2012-11-27 16:37 ——– d—–w- c:\users\ASD-MASTER\AppData\Local\LogMeIn Hamachi
2012-11-16 03:27 . 2012-11-16 03:49 ——– d—–w- c:\users\ASD-MASTER\AppData\Roaming\.minecraft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-23 05:28 . 2006-11-02 08:35 279552 —-a-w- c:\windows\system32\services.exe
2012-09-29 18:54 . 2010-06-13 10:03 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2006-05-03 09:06 163328 –sh–r- c:\windows\System32\flvDX.dll
2007-02-21 10:47 31232 –sh–r- c:\windows\System32\msfDX.dll
2008-03-16 12:30 216064 –sh–r- c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 2159104]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2007-09-20 253952]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-20 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-20 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-20 137752]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-25 4669440]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2008-10-04 1655552]
"Ask and Record FLV Service"="c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2012-09-29 981656]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-10-01 548864]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-09-25 210216]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984]
.
c:\users\ASD-MASTER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-5-17 372736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-08-14 19:05 98304 —-a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ultra Hal Text-to-Speech Reader Startup.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Ultra Hal Text-to-Speech Reader Startup.lnk
backup=c:\windows\pss\Ultra Hal Text-to-Speech Reader Startup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a-winpoet-service]
2002-11-14 15:08 294912 ——w- c:\program files\WinPoET Broadband Connection\WinPPPoverEthernet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
2006-08-01 14:35 67112 —-a-w- c:\program files\AIM\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 15:58 217544 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-04-11 09:54 3672384 —-a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
2007-09-19 10:09 311296 —-a-w- c:\program files\Sony\ISB Utility\ISBMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-08-11 14:30 249856 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2005-08-11 14:30 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2005-10-06 17:03 278528 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MarketingTools]
2007-11-08 16:03 36864 —-a-w- c:\program files\Sony\Marketing Tools\MarketingTools.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-10-27 13:09 155648 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2009-11-28 03:38 1401096 —-a-w- c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Show missed alarms]
2008-05-31 12:49 376944 —-a-r- c:\program files\Alarm Clock\Alarm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 10:59 254696 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2011-08-11 02:32 273544 —-a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2009-02-17 19:21 218408 ——w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1676464803-1167917439-486494234-1003]
"EnableNotificationsRef"=dword:00000001
.
Contents of the 'Scheduled Tasks' folder
.
2009-03-10 c:\windows\Tasks\asd.job
- c:\program files\Alarm Clock\Alarm.exe [2008-05-31 12:49]
.
.
——- Supplementary Scan ——-
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.club-vaio.com
uSearch Bar = hxxp://www.google.com/ie
IE: FoxyProxy - c:\programdata\fpie\FoxyProxyAdd-on.dll/IDR_HTML1
IE: Link to &MidpX - c:\program files\midpxP\JadInvoker\Extent\jad_wrap.htm
IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: Interfaces\{27E38242-552E-4801-8271-45AAE17EF99A}: NameServer = 80.58.0.33,80.58.32.97
Name-Space Handler: ftp\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
Name-Space Handler: http\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\program files\GetRight\xx2gr.dll
FF - ProfilePath - c:\users\ASD-MASTER\AppData\Roaming\Mozilla\Firefox\Profiles\u4qruwye.default\
FF - prefs.js: browser.startup.homepage - hxxp://home.speedbit.com/?aff=115
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: TinEye Reverse Image Search: [removed] - %profile%\extensions\[removed]
FF - Ext: UnPlug: unplug@compunach - %profile%\extensions\unplug@compunach
FF - Ext: Sothink Web Video Downloader for Firefox: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08} - %profile%\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
FF - Ext: AVG Do Not Track: {F53C93F1-07D5-430c-86D4-C9531B27DFAF} - c:\program files\AVG\AVG2012\Firefox\DoNotTrack
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\AVG Secure Search\11.0.0.9\AVG Secure Search_toolbar.dll
HKLM-Run-vProt - c:\program files\AVG Secure Search\vprot.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-12-07 17:20
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
c:\users\ASD-MA~1\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000a0
.
Completion time: 2012-12-07 17:31:21
ComboFix-quarantined-files.txt 2012-12-07 16:31
ComboFix2.txt 2012-11-28 22:34
ComboFix3.txt 2012-11-28 03:53
ComboFix4.txt 2012-11-27 17:12
.
Pre-Run: 414.982.144 bytes libres
Post-Run: 743.751.680 bytes libres
.
- - End Of File - - 5CC4C6E2C3C74EE28CA6707E5B93B9D0