ComboFix 12-04-14.02 - Tendai 14/04/2012 18:13:52.5.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.1917.1093 [GMT 1:00]
Running from: c:\users\Tendai\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Amazon.ico
c:\programdata\MercadoLivre.ico
c:\users\Tendai\AppData\Local\temp\bd7c47bb-f5c0-417c-a180-ec348d87718a\CliSecureRT.dll
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
.
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-03-14 to 2012-04-14 )))))))))))))))))))))))))))))))
.
.
2012-04-14 17:24 . 2012-04-14 17:28 -------- d-----w- c:\users\Tendai\AppData\Local\temp
2012-04-14 17:24 . 2012-04-14 17:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-04-14 17:24 . 2012-04-14 17:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-14 13:50 . 2012-03-14 02:15 6582328 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B3C3608-75A4-400D-A8A2-887F75943195}\mpengine.dll
2012-04-13 03:03 . 2012-04-13 03:03 -------- d-----w- c:\users\Tendai\AppData\Roaming\Media Player Classic
2012-04-13 00:40 . 2012-04-13 00:40 -------- dc----w- C:\_OTL
2012-04-11 00:18 . 2012-02-28 01:58 141112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-04-11 00:18 . 2012-02-28 01:08 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2012-04-11 00:18 . 2012-02-28 01:18 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-04-11 00:18 . 2012-02-28 01:13 678912 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-04-11 00:18 . 2012-02-28 01:11 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-04-11 00:17 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-11 00:17 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-10 23:45 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2012-04-10 21:41 . 2012-04-10 21:41 -------- d-----w- c:\program files\Essentials Codec Pack
2012-04-06 01:37 . 2010-04-27 02:25 98560 ----a-w- c:\windows\system32\drivers\ss_bus.sys
2012-04-06 01:37 . 2010-04-27 02:25 14848 ----a-w- c:\windows\system32\drivers\ss_mdfl.sys
2012-04-06 01:37 . 2010-04-27 02:25 12416 ----a-w- c:\windows\system32\drivers\ss_cmnt.sys
2012-04-06 01:37 . 2010-04-27 02:25 12416 ----a-w- c:\windows\system32\drivers\ss_cm.sys
2012-04-06 01:37 . 2010-04-27 02:25 123776 ----a-w- c:\windows\system32\drivers\ss_mdm.sys
2012-04-06 01:37 . 2010-04-27 02:25 12288 ----a-w- c:\windows\system32\drivers\ss_whnt.sys
2012-04-06 01:37 . 2010-04-27 02:25 12288 ----a-w- c:\windows\system32\drivers\ss_wh.sys
2012-04-06 01:35 . 2010-07-04 18:07 238952 ----a-w- c:\windows\system32\FsUsbExService.Exe
2012-04-06 01:35 . 2010-06-14 08:32 36608 ----a-w- c:\windows\system32\FsUsbExDisk.Sys
2012-04-06 01:35 . 2010-06-14 08:32 110592 ----a-w- c:\windows\system32\FsUsbExDevice.Dll
2012-04-06 00:51 . 2012-04-06 00:51 -------- dc----w- C:\Download
2012-04-06 00:46 . 2012-04-06 00:46 -------- dc----w- C:\AllShare
2012-04-04 12:35 . 2012-04-14 02:05 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-29 19:19 . 2012-03-29 19:19 -------- d-----w- c:\program files\iPod
2012-03-29 19:19 . 2012-03-29 19:22 -------- d-----w- c:\program files\iTunes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-14 02:05 . 2011-06-21 23:50 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 14:56 . 2011-08-13 14:51 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-26 00:16 . 2012-01-25 02:36 5642 --sha-w- c:\programdata\KGyGaAvL.sys
2012-03-26 00:15 . 2012-01-25 02:36 88 --sh--r- c:\programdata\E0C60D2CBC.sys
2012-03-14 02:15 . 2011-08-29 23:52 6582328 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-03-12 00:18 . 2012-03-12 00:21 25893376 -c--a-w- C:\Samsung AllShare.msi
2012-03-06 06:39 . 2012-04-11 00:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-06 06:39 . 2012-04-11 00:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-02-29 15:11 . 2012-04-11 00:17 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-11 00:17 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-28 01:11 . 2012-04-11 00:18 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-11 00:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-14 15:45 . 2012-03-15 02:04 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-15 02:04 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-13 14:12 . 2012-03-15 02:04 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-15 02:04 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-15 02:04 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 18:53 . 2012-02-10 18:55 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9546D6B6-4965-4CCD-9B9A-C3ACB2544BE9}\gapaengine.dll
2012-02-02 15:16 . 2012-03-15 02:04 2044416 ----a-w- c:\windows\system32\win32k.sys
2012-01-31 12:44 . 2011-06-15 02:16 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-01-31 01:15 . 2012-03-11 23:10 4659712 ----a-w- c:\windows\system32\Redemption.dll
2012-01-31 01:15 . 2012-01-31 01:15 90112 ----a-w- c:\windows\MAMCityDownload.ocx
2012-01-31 01:15 . 2012-01-31 01:15 49152 ----a-w- c:\windows\system32\MaJGUILib.dll
2012-01-31 01:15 . 2012-01-31 01:15 45056 ----a-w- c:\windows\system32\MaXMLProto.dll
2012-01-31 01:15 . 2012-01-31 01:15 40960 ----a-w- c:\windows\system32\MTTELECHIP.dll
2012-01-31 01:15 . 2012-01-31 01:15 325552 ----a-w- c:\windows\MASetupCaller.dll
2012-01-31 01:15 . 2012-01-31 01:15 30568 ----a-w- c:\windows\MusiccityDownload.exe
2012-01-31 01:15 . 2012-01-31 01:15 200704 ----a-w- c:\windows\system32\muzwmts.dll
2012-01-31 01:15 . 2012-01-31 01:15 135168 ----a-w- c:\windows\system32\muzaf1.dll
2012-01-31 01:15 . 2012-01-31 01:15 122880 ----a-w- c:\windows\system32\muzeffect.ax
2012-01-31 01:15 . 2012-01-31 01:15 118784 ----a-w- c:\windows\system32\MaDRM.dll
2012-01-31 01:15 . 2012-01-31 01:15 110592 ----a-w- c:\windows\system32\muzmp4sp.ax
2012-01-31 01:15 . 2012-03-11 23:09 821824 ----a-w- c:\windows\system32\dgderapi.dll
2012-01-31 01:15 . 2012-03-11 23:09 319456 ----a-w- c:\windows\system32\DIFxAPI.dll
2012-01-31 01:15 . 2012-03-11 23:09 20032 ----a-w- c:\windows\system32\drivers\dgderdrv.sys
2012-01-31 01:15 . 2012-01-31 01:15 974848 ----a-w- c:\windows\system32\cis-2.4.dll
2012-01-31 01:15 . 2012-01-31 01:15 81920 ----a-w- c:\windows\system32\issacapi_bs-2.3.dll
2012-01-31 01:15 . 2012-01-31 01:15 65536 ----a-w- c:\windows\system32\issacapi_pe-2.3.dll
2012-01-31 01:15 . 2012-01-31 01:15 57344 ----a-w- c:\windows\system32\MTXSYNCICON.dll
2012-01-31 01:15 . 2012-01-31 01:15 57344 ----a-w- c:\windows\system32\MK_Lyric.dll
2012-01-31 01:15 . 2012-01-31 01:15 57344 ----a-w- c:\windows\system32\issacapi_se-2.3.dll
2012-01-31 01:15 . 2012-01-31 01:15 569344 ----a-w- c:\windows\system32\muzdecode.ax
2012-01-31 01:15 . 2012-01-31 01:15 491520 ----a-w- c:\windows\system32\muzapp.dll
2012-01-31 01:15 . 2012-01-31 01:15 45056 ----a-w- c:\windows\system32\MACXMLProto.dll
2012-01-31 01:15 . 2012-01-31 01:15 40960 ----a-w- c:\windows\system32\MAMACExtract.dll
2012-01-31 01:15 . 2012-01-31 01:15 352256 ----a-w- c:\windows\system32\MSLUR71.dll
2012-01-31 01:15 . 2012-01-31 01:15 258048 ----a-w- c:\windows\system32\muzoggsp.ax
2012-01-31 01:15 . 2012-01-31 01:15 245760 ----a-w- c:\windows\system32\MSCLib.dll
2012-01-31 01:15 . 2012-01-31 01:15 24576 ----a-w- c:\windows\system32\MASetupCleaner.exe
2012-01-31 01:15 . 2012-01-31 01:15 155648 ----a-w- c:\windows\system32\MSFLib.dll
2012-01-31 01:15 . 2012-01-31 01:15 143360 ----a-w- c:\windows\system32\3DAudio.ax
2012-01-31 01:15 . 2012-01-31 01:15 131072 ----a-w- c:\windows\system32\muzmpgsp.ax
2010-01-26 10:11 . 2012-02-04 19:14 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe
2012-03-13 04:39 . 2012-04-13 02:49 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1}]
2009-11-08 09:55 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-01-31 17146504]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-04-04 954256]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-04-04 21392]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-08-27 1050072]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-03-31 2221352]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-04-04 3521424]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"AllShareAgent"="c:\program files\Samsung\AllShare\AllShareAgent.exe" [2012-03-01 285072]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Scrybe.lnk - c:\windows\Installer\{147DFAD8-34C3-4DE1-9FCA-ACEFDE9EF810}\NewShortcut11_8ACB210B42E44145A8C31F8E3DD765A3.exe [2011-10-17 45056]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-04 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]
2006-12-11 17:27 530552 ----a-w- c:\program files\TOSHIBA\FlashCards\TCrdMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
2005-04-08 13:09 102400 ------w- c:\program files\epson\Creativity Suite\Event Manager\EEventManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 04:09 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-04-04 14:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2011-06-15 14:16 997920 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2006-11-01 15:37 3772416 ----a-w- c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2006-12-14 19:09 493688 ----a-w- c:\program files\TOSHIBA\SmoothView\SmoothView.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\topi]
2006-12-15 17:11 577536 ----a-w- c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2006-12-13 14:42 554640 ----a-w- c:\program files\TOSHIBA\Registration\ToshibaRegistration.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSHIBA Volume Indicator]
2006-12-13 09:33 94208 ----a-w- c:\program files\TOSHIBA\Utilities\VolControl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
2006-12-14 19:07 411768 ----a-w- c:\program files\TOSHIBA\Power Saver\TPwrMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088]
S1 38013711;38013711;c:\windows\system32\DRIVERS\38013711.sys [2009-09-25 128016]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-17 116608]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - FSUSBEXDISK
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
Akamai REG_MULTI_SZ Akamai
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 02:05]
.
2012-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-15 01:17]
.
2012-04-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-15 01:17]
.
.
------- Supplementary Scan -------
.
uStart Page =
https://mail.google....31245e70ac32cba
uInternet Settings,ProxyOverride = 127.0.0.1:9421
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{85B9BBD9-7474-4605-8E3F-FE01B97288A7}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\users\Tendai\AppData\Roaming\Mozilla\Firefox\Profiles\0tep400u.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-NPSStartup - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-04-14 18:29
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_6c825ce.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\DbgagD\1*]
"value"="?\0a\04\0d\00,-H"
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\FsUsbExService.Exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Synaptics\Scrybe\Service\ScrybeUpdater.exe
c:\program files\Secunia\PSI\PSIA.exe
c:\program files\Toshiba TEMPRO\TemproSvc.exe
c:\windows\system32\TODDSrv.exe
c:\program files\TOSHIBA\Power Saver\TosCoSrv.exe
c:\program files\Secunia\PSI\sua.exe
c:\program files\Synaptics\Scrybe\scrybe.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\program files\Samsung\AllShare\AllShareDMS\AllShareDMS.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Mozilla Firefox\firefox.exe
c:\program files\Mozilla Firefox\plugin-container.exe
.
**************************************************************************
.
Completion time: 2012-04-14 18:41:01 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-14 17:40
.
Pre-Run: 15,119,405,056 bytes free
Post-Run: 15,445,807,104 bytes free
.
- - End Of File - - B4BA15EE25DFEB9DA018214F261DE903