ComboFix 12-03-06.01 - Math On DVDs 03/06/2012 14:50:02.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1791.1062 [GMT -5:00]
Running from: c:\documents and settings\Math On DVDs\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Math On DVDs\Desktop\cfscript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\documents and settings\All Users\Start Menu\Programs\Startup\SMART Board Tools.lnk"
"c:\windows\pss\SMART Board Tools.lnkCommon Startup"
"c:\windows\system32\LMIinit.dll"
"c:\windows\system32\LMIRfsClientNP.dll"
"c:\windows\Tasks\MP Scheduled Scan.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Spybot - Search & Destroy
c:\program files\Spybot - Search & Destroy\advcheck.dll
c:\program files\Spybot - Search & Destroy\SDHelper.dll
c:\windows\pss\SMART Board Tools.lnkCommon Startup
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_LMIINFO
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Legacy_SMART_DISPLAY_CONTROLLER
-------\Service_LMIInfo
-------\Service_SASDIFSV
-------\Service_SASKUTIL
-------\Service_SMART Display Controller
-------\Service_STI2303X
.
.
((((((((((((((((((((((((( Files Created from 2012-02-06 to 2012-03-06 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-31 12:44 . 2011-09-15 05:22 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-12 16:53 . 2001-08-23 12:00 1859968 ----a-w- c:\windows\system32\win32k.sys
2011-12-17 19:46 . 2001-08-23 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2011-12-17 19:46 . 2001-08-23 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-12-17 19:46 . 2001-08-23 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-12-16 12:22 . 2011-09-15 03:03 385024 ------w- c:\windows\system32\html.iec
2012-02-18 03:34 . 2011-09-15 02:36 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of %user%\library ----
.
.
---- Directory of c:\program files\Common ----
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-02-23 16:23 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoomMonitor.exe"="c:\program files\Zoom\Zoom Phone Adaptor\ZoomMonitor.exe" [2008-10-23 801304]
"USBDetector"="c:\usbstorage\USBDetector.exe" [2003-04-01 53248]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-02-23 4031368]
"RTHDCPL"="RTHDCPL.EXE" [2011-08-17 20064872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
c:\documents and settings\Math On DVDs\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
Seagate Product Registration.lnk - c:\documents and settings\Math On DVDs\Application Data\Leadertech\PowerRegister\Seagate Product Registration.exe [2012-3-2 1731736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
[BU]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\09803623.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\15006098.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMART Board Tools.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SMART Board Tools.lnk
backup=c:\windows\pss\SMART Board Tools.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2010-10-08 11:26 3366200 ----a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2006-05-14 21:12 155648 ----a-r- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UPHClean"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" -hide -runkey
"SMART Mirror Driver Monitor Service"="c:\documents and settings\Math On DVDs\Application Data\SMART Technologies\Bridgit\4.2.146.0\monitorservice.exe"
"NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
"nwiz"=c:\program files\NVIDIA Corporation\nView\nwiz.exe /installquiet
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Program Files\\FrostWire 5\\FrostWire.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"24726:TCP"= 24726:TCP:FlipShareServer
"24727:TCP"= 24727:TCP:FlipShareServer
.
R0 TLRecAgent;TLRecAgent;c:\windows\system32\drivers\TLRecAgent.sys [10/31/2011 5:51 PM 36976]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/5/2012 11:15 PM 610648]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/5/2012 11:15 PM 337112]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/5/2012 11:15 PM 20696]
R2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [9/13/2010 5:31 AM 95568]
R2 FlipShareServer;FlipShare Server;c:\program files\Flip Video\FlipShareServer\FlipShareServer.exe [12/15/2010 12:22 PM 1085440]
R2 MSSQL$ADCENTERDESKTOP;SQL Server (ADCENTERDESKTOP);c:\program files\Microsoft SQL Server\MSSQL10_50.ADCENTERDESKTOP\MSSQL\Binn\sqlservr.exe [4/3/2010 1:56 PM 42884448]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [9/18/2011 10:00 AM 2255464]
R2 VService;VService;c:\program files\Zoom\Zoom Phone Adaptor\VServ.exe [10/23/2008 9:58 AM 104984]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [9/13/2010 5:31 AM 18120]
R3 scusbvip;VL1800 USB Driver;c:\windows\system32\drivers\scusbvip.sys [10/31/2011 5:51 PM 609936]
R3 SLVAD_simple;Zoom Virtual Audio Device;c:\windows\system32\drivers\slvad.sys [10/31/2011 5:51 PM 84912]
R3 smrtdrv;SMART Technologies Inc. Mirror Driver;c:\windows\system32\drivers\smrtdrv.sys [9/15/2011 2:00 PM 8432]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [4/3/2010 1:56 PM 44896]
S2 SMART Mirror Driver Monitor Service;SMART Mirror Driver Monitor Service;c:\documents and settings\Math On DVDs\Application Data\SMART Technologies\Bridgit\4.2.146.0\monitorservice.exe [9/15/2011 2:00 PM 224624]
S2 SQLAgent$ADCENTERDESKTOP;SQL Server Agent (ADCENTERDESKTOP);c:\program files\Microsoft SQL Server\MSSQL10_50.ADCENTERDESKTOP\MSSQL\Binn\SQLAGENT.EXE [4/3/2010 1:56 PM 367456]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [9/20/2011 10:58 AM 1691480]
S3 glancedrv;glancedrv;c:\windows\system32\drivers\glancedrv.sys [11/26/2011 2:35 PM 34080]
S3 HidBoard;SMART Board Hidmini Driver;c:\windows\system32\drivers\HidBoard.sys [1/25/2011 5:13 PM 19696]
S3 PAC207;PC
[email protected];c:\windows\system32\drivers\PFC027.SYS [4/12/2007 3:50 PM 507264]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;\??\c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys --> c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [4/3/2010 11:02 AM 240608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mathondvds.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
TCP: DhcpNameServer = 207.69.188.185 207.69.188.186 207.69.188.187
FF - ProfilePath - c:\documents and settings\Math On DVDs\Application Data\Mozilla\Firefox\Profiles\mxttmc59.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.mathondvds.com/
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=102&sr=0&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.BabylonToolbar_i.id - 4c71f074000000000000f80f410b5e1e
FF - user.js: extensions.BabylonToolbar_i.hardId - 4c71f074000000000000f80f410b5e1e
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15320
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:43
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=18474
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.ovrDmn - isearch.babylon.com
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
Notify-AutorunsDisabled - c:\program files\SUPERAntiSpyware\SASWINLO.DLL
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-484763869-1078145449-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3BD812E3-EBBA-851A-0313-069F8C08A264}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"gadldkddocnndl"=hex:61,63,65,66,67,6d,62,6a,61,66,6b,64,66,6e,6f,6f,6e,66,6f,
6c,6f,63,65,6c,65,62,6b,62,6b,6e,6c,69,65,65,63,6b,64,63,6a,68,6e,69,6d,6b,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.EXE'(2036)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-03-06 15:25:34 - machine was rebooted
.
Pre-Run: 138,309,771,264 bytes free
Post-Run: 138,349,297,664 bytes free
.
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\afd
DisplayName REG_SZ AFD
Description REG_SZ AFD Networking Support Environment
Group REG_SZ TDI
ImagePath REG_SZ \SystemRoot\System32\drivers\afd.sys
Start REG_DWORD 0x1
Type REG_DWORD 0x1
ErrorControl REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\afd\Enum
0 REG_SZ Root\LEGACY_AFD\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1
INITSTARTFAILED REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\afd\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\afd\Security
Security REG_BINARY 01001480900000009C000000140000003000000002001C000100000002801400FF010F00010100000000000100000000020060000400000000001400FD01020001010000000000051200000000001800FF010F0001020000000000052000000020020000000014008D01020001010000000000050B00000000001800FD01020001020000000000052000000023020000010100000000000512000000010100000000000512000000
Vino's Event Viewer v01c run on Windows XP in English
Report run at 06/03/2012 8:03:39 PM
Note: All dates below are in the format dd/mm/yyyy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 06/03/2012 8:01:15 PM
Type: error Category: 0
Event: 7026 Source: Service Control Manager
The following boot-start or system-start driver(s) failed to load: AFD
Log: 'System' Date/Time: 06/03/2012 8:01:15 PM
Type: error Category: 0
Event: 7022 Source: Service Control Manager
The Net.Tcp Port Sharing Service service hung on starting.
Log: 'System' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 0
Event: 7024 Source: Service Control Manager
The SQL Active Directory Helper Service service terminated with service-specific error 3221225572 (0xC0000064).
Log: 'System' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 0
Event: 7023 Source: Service Control Manager
The Human Interface Device Access service terminated with the following error: The specified module could not be found.
Log: 'System' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 0
Event: 7001 Source: Service Control Manager
The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
Log: 'System' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 0
Event: 7001 Source: Service Control Manager
The DHCP Client service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
Log: 'System' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 0
Event: 7023 Source: Service Control Manager
The TuneUp Theme Extension service terminated with the following error: The specified module could not be found.
Log: 'System' Date/Time: 06/03/2012 7:57:46 PM
Type: error Category: 0
Event: 23 Source: Print
Printer HP Officejet 4500 G510a-f fax failed to initialize because a suitable HP Officejet 4500 G510a-f fax driver could not be found.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 06/03/2012 8:01:46 PM
Type: warning Category: 0
Event: 1003 Source: Dhcp
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address F80F410B5E1E. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Log: 'System' Date/Time: 06/03/2012 7:57:42 PM
Type: warning Category: 0
Event: 19 Source: i8042prt
Could not set the keyboard typematic rate and delay.
Vino's Event Viewer v01c run on Windows XP in English
Report run at 06/03/2012 8:05:59 PM
Note: All dates below are in the format dd/mm/yyyy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 06/03/2012 7:59:52 PM
Type: error Category: 2
Event: 103 Source: SQLAgent$ADCENTERDESKTOP
SQLServerAgent could not be started (reason: This installation of SQL Server Agent is disabled. The edition of SQL Server that installed this service does not support SQL Server Agent.).
Log: 'Application' Date/Time: 06/03/2012 7:59:33 PM
Type: error Category: 0
Event: 100 Source: MSSQLServerADHelper100
'0' is an invalid number of start up parameters. This service takes two start up parameters.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~