ComboFix 12-09-18.07 - user 19/09/2012 21:20:45.1.4 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.60.1033.18.1975.853 [GMT 8:00] Running from: c:\users\user\Desktop\ComboFix.exe * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\$recycle.bin\S-1-5-18\$d3d606a378251cd818129d0c50babd00\@ c:\$recycle.bin\S-1-5-18\$d3d606a378251cd818129d0c50babd00\n c:\$recycle.bin\S-1-5-21-1684675616-945150509-1592304537-1000\$d3d606a378251cd818129d0c50babd00\n c:\program files\RelevantKnowledge c:\users\user\AppData\Local\TempDIR c:\users\user\AppData\Roaming\FFSJ c:\users\user\AppData\Roaming\FFSJ\FFSJ.cfg c:\users\user\AppData\Roaming\IDM\idmmzcc3 c:\users\user\AppData\Roaming\IDM\idmmzcc3\chrome.manifest c:\users\user\AppData\Roaming\IDM\idmmzcc3\chrome\idmmzcc.jar c:\users\user\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll c:\users\user\AppData\Roaming\IDM\idmmzcc3\components\iIDMMzCC.xpt c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper.js c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\idmhelper2.js c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc.dll c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\idmmzcc64.dll c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper.xpt c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\iIDMHelper2.xpt c:\users\user\AppData\Roaming\IDM\idmmzcc3\components2\iIDMMzCC.xpt c:\users\user\AppData\Roaming\IDM\idmmzcc3\install.js c:\users\user\AppData\Roaming\IDM\idmmzcc3\install.rdf c:\users\user\AppData\Roaming\IDM\idmmzcc3\META-INF\manifest.mf c:\users\user\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.rsa c:\users\user\AppData\Roaming\IDM\idmmzcc3\META-INF\zigbert.sf c:\windows\apppatch\AppLoc.exe c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb c:\windows\assembly\GAC\Desktop.ini c:\windows\system32\DEBUG.log . . ((((((((((((((((((((((((( Files Created from 2012-08-19 to 2012-09-19 ))))))))))))))))))))))))))))))) . . 2012-09-19 13:33 . 2012-09-19 13:33 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-09-19 12:50 . 2012-09-19 12:50 -------- d-----w- C:\_OTL 2012-09-19 05:23 . 2012-09-19 05:23 -------- d-----w- c:\users\user\AppData\Roaming\hellomoto 2012-09-19 00:55 . 2012-08-23 07:15 7022536 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A38B91C7-FCC5-4D00-BAC4-3DA3206DB519}\mpengine.dll 2012-09-12 15:12 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-09-12 15:12 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys 2012-09-12 15:12 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-09-12 15:12 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys 2012-09-12 15:12 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-09-12 15:12 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll 2012-09-11 08:54 . 2012-09-11 08:54 -------- d-----w- c:\users\user\AppData\Roaming\Origin 2012-09-11 08:53 . 2012-09-11 08:56 -------- d-----w- c:\programdata\Origin . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-19 02:26 . 2012-08-03 05:22 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-09-19 02:26 . 2011-05-20 01:12 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-07-18 17:47 . 2012-08-16 06:44 2345984 ----a-w- c:\windows\system32\win32k.sys 2012-07-06 19:23 . 2012-08-17 07:55 393728 ----a-w- c:\windows\system32\drivers\bthport.sys 2012-07-04 21:14 . 2012-08-16 06:44 102912 ----a-w- c:\windows\system32\browser.dll 2012-07-04 21:14 . 2012-08-16 06:43 41984 ----a-w- c:\windows\system32\browcli.dll 2012-06-29 00:16 . 2012-08-17 07:54 1800704 ----a-w- c:\windows\system32\jscript9.dll 2012-06-29 00:09 . 2012-08-17 07:54 1129472 ----a-w- c:\windows\system32\wininet.dll 2012-06-29 00:08 . 2012-08-17 07:54 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2012-06-29 00:04 . 2012-08-17 07:54 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2012-06-29 00:00 . 2012-08-17 07:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-06-22 01:12 . 2012-06-22 01:12 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-01-25 10:40 67680 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-10-16 2363392] "HPADVISOR"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-02-11 3270040] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-10-04 3077528] "Facebook Update"="c:\users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096] "FreeRAM XP"="c:\yourware solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-22 1591808] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-12 98304] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-15 282624] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-10-21 495708] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-08-20 322104] "NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-11-04 2087424] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296] . c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Facebook Messenger.lnk - c:\users\user\AppData\Local\Facebook\Messenger\2.1.4631.0\FacebookMessenger.exe [2012-9-5 247728] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-31 795936] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [x] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [x] R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x] R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [x] R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_94cb740f1febe83e\aestsrv.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [x] S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe [x] S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [x] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-10-16 20:49 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2012-09-19 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 02:26] . 2012-09-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1684675616-945150509-1592304537-1000Core.job - c:\users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-22 06:44] . 2012-09-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1684675616-945150509-1592304537-1000UA.job - c:\users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-22 06:44] . 2012-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 11:37] . 2012-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-08-13 11:37] . 2012-09-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1684675616-945150509-1592304537-1000Core.job - c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-17 12:14] . 2012-09-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1684675616-945150509-1592304537-1000UA.job - c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-17 12:14] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 202.188.0.132 202.188.1.4 TCP: Interfaces\{2718498D-5F4A-488C-AEA1-5DD2E7B2DF18}: NameServer = 8.8.8.8,8.8.4.4 . - - - - ORPHANS REMOVED - - - - . HKCU-Run-caofa - c:\users\user\AppData\Roaming\caofa.dll . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.0.0.136\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.0.0.136\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1684675616-945150509-1592304537-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):d3,0f,66,cd,b4,ca,ca,af,ed,19,ea,9d,02,9f,3f,c1,e7,f5,72,9c,66, 0d,d1,30,a9,76,1b,b6,e7,4d,0b,53,1e,65,33,c1,04,96,e0,04,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-1684675616-945150509-1592304537-1000_Classes\CLSID\{8d8b34e2-75cb-40f8-8c73-49aff6289e82}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:000000c1 "Therad"=dword:00000021 "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(496) c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll c:\program files\Internet Download Manager\idmmkb.dll c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_94cb740f1febe83e\STacSV.exe c:\windows\system32\atieclxx.exe c:\windows\system32\taskhost.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Avira\AntiVir Desktop\avshadow.exe c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\windows\system32\conhost.exe c:\program files\CyberLink\Shared files\RichVideo.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\17.0.0.136\InstStub.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\conhost.exe c:\program files\Apoint2K\ApMsgFwd.exe c:\program files\Apoint2K\Apntex.exe c:\windows\system32\conhost.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\program files\Internet Download Manager\IEMonitor.exe c:\program files\Hewlett-Packard\Shared\hpqToaster.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe c:\windows\system32\sppsvc.exe c:\windows\system32\DllHost.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Completion time: 2012-09-19 21:43:26 - machine was rebooted ComboFix-quarantined-files.txt 2012-09-19 13:43 . Pre-Run: 112,776,015,872 bytes free Post-Run: 112,997,265,408 bytes free . - - End Of File - - 12684A34848031BE104AAE2D6132E97B