ComboFix 11-02-22.01 - Esther 02/22/2011 13:58:06.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1014.425 [GMT -8:00]
Running from: c:\users\Esther\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\xp
c:\programdata\xp\EBLib.dll
c:\programdata\xp\TPwSav.sys
c:\users\Esther\AppData\Local\{D5865824-BCF7-4D4C-9529-8D270FFF8B8A}
c:\users\Esther\AppData\Local\{D5865824-BCF7-4D4C-9529-8D270FFF8B8A}\chrome.manifest
c:\users\Esther\AppData\Local\{D5865824-BCF7-4D4C-9529-8D270FFF8B8A}\chrome\content\_cfg.js
c:\users\Esther\AppData\Local\{D5865824-BCF7-4D4C-9529-8D270FFF8B8A}\chrome\content\overlay.xul
c:\users\Esther\AppData\Local\{D5865824-BCF7-4D4C-9529-8D270FFF8B8A}\install.rdf
c:\windows\System32\config\systemprofile\AppData\Local\{73370CCD-BCBF-467A-A7C9-0C5200F1EB4B}
c:\windows\System32\config\systemprofile\AppData\Local\{73370CCD-BCBF-467A-A7C9-0C5200F1EB4B}\chrome.manifest
c:\windows\System32\config\systemprofile\AppData\Local\{73370CCD-BCBF-467A-A7C9-0C5200F1EB4B}\chrome\content\_cfg.js
c:\windows\System32\config\systemprofile\AppData\Local\{73370CCD-BCBF-467A-A7C9-0C5200F1EB4B}\chrome\content\overlay.xul
c:\windows\System32\config\systemprofile\AppData\Local\{73370CCD-BCBF-467A-A7C9-0C5200F1EB4B}\install.rdf
c:\windows\system32\config\systemprofile\AppData\Roaming\Adobe\plugs
c:\windows\system32\gonrrkt.dll
.
((((((((((((((((((((((((( Files Created from 2011-01-22 to 2011-02-22 )))))))))))))))))))))))))))))))
.
2011-02-22 22:08 . 2011-02-22 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-21 02:15 . 2011-02-21 02:15 -------- d-----w- c:\users\Esther\AppData\Roaming\Malwarebytes
2011-02-21 02:14 . 2010-12-21 02:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-21 02:14 . 2011-02-21 02:14 -------- d-----w- c:\programdata\Malwarebytes
2011-02-21 02:14 . 2011-02-21 02:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-21 02:14 . 2010-12-21 02:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-18 01:47 . 2011-02-18 01:47 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Adobe
2011-02-18 01:43 . 2010-10-07 16:50 428352 ----a-w- c:\windows\system32\StubInstaller.exe
2011-02-18 01:34 . 2010-10-07 16:50 428352 ----a-w- c:\program files\Mozilla Firefox\StubInstaller.exe
2011-02-17 02:31 . 2011-02-17 05:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-02-17 02:31 . 2011-02-17 02:35 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-02-11 06:20 . 2011-02-21 01:53 0 ----a-w- c:\users\Esther\AppData\Local\Ijilad.bin
2011-02-07 22:23 . 2011-02-07 22:23 0 ----a-w- c:\windows\system32\config\systemprofile\AppData\Local\Ijilad.bin
2011-02-07 22:20 . 2011-02-07 22:20 -------- d-----w- c:\program files\Yontoo Layers Client
2011-02-07 22:20 . 2011-02-07 22:20 -------- d-----w- c:\programdata\Tarma Installer
2011-02-07 22:20 . 2011-02-07 22:20 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\SQL
2011-02-07 22:19 . 2011-02-16 18:14 -------- d-----w- c:\programdata\gDgFmKd15400
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 08:47 . 2010-07-08 05:08 38848 ----a-w- c:\windows\avastSS.scr
2011-01-13 08:47 . 2010-07-08 05:08 188216 ----a-w- c:\windows\system32\aswBoot.exe
2011-01-13 08:41 . 2010-07-08 05:09 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-01-13 08:40 . 2010-07-08 05:09 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-01-13 08:37 . 2010-07-08 05:09 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-01-13 08:37 . 2010-07-08 05:09 51280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-01-13 08:37 . 2010-07-08 05:09 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-12-10 04:28 . 2010-12-10 04:28 644360 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-06 19:08 . 2010-10-06 19:08 939956 ----a-w- c:\program files\7z465.exe
.
<pre>
c:\windows\System32\config\systemprofile\AppData\Roaming\Adobe\ctfmon .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2010-12-20 18:09 191488 ------w- c:\program files\Yontoo Layers Client\YontooIEClient.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-01-13 3396624]
"PINGER"="c:\toshiba\IVP\ISM\pinger.exe" [2006-07-20 151552]
"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-07 34352]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-01-19 421888]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]
"TPwrMain"="%ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE" [N/A]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-29 81920]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-29 106496]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-29 98304]
"SmoothView"="%ProgramFiles%\Toshiba\SmoothView\SmoothView.exe" [N/A]
"NDSTray.exe"="NDSTray.exe" [N/A]
c:\users\Esther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]
%ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1922036909]
2006-10-04 00:17 65616 ----a-w- c:\program files\Toshiba Registration\Registration.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HSON]
%ProgramFiles%\TOSHIBA\TBS\HSON.exe [N/A]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2988387190-1376504491-747976677-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000002
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-13 51280]
S2 MSSQL$VSDOTNET;SQL Server (VSDOTNET);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-25 29263712]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
mStart Page = hxxp://www.toshibadirect.com/dpdstart
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Esther\AppData\Roaming\Mozilla\Firefox\Profiles\twwybyw7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - ORPHANS REMOVED - - - -
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-22 14:10
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-02-22 14:15:10
ComboFix-quarantined-files.txt 2011-02-22 22:15
Pre-Run: 54,652,715,008 bytes free
Post-Run: 54,717,132,800 bytes free
- - End Of File - - 5884C6F05E852ECEF2EC2B5C120B2804