ven2000 Posted February 3, 2012 ID:523110 Share Posted February 3, 2012 I need to see if my system is ok. I followed the steps in one of yours.Please check this combofix log;ComboFix 12-01-31.01 - VNKT 02/01/2012 22:53:09.3.4 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.2015 [GMT -5:00]Running from: c:\users\VNKT\Downloads\ComboFix.exe..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\program files (x86)\StartNow Toolbarc:\program files (x86)\StartNow Toolbar\Resources\images\engine_images.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_maps.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_news.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_videos.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_web.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_amazon.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_ebay.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_facebook.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_games.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_msn.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_shopping.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_travel.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_twitter.pngc:\program files (x86)\StartNow Toolbar\Resources\images\startnow_logo.pngc:\program files (x86)\StartNow Toolbar\Resources\installer.xmlc:\program files (x86)\StartNow Toolbar\Resources\protect\index.htmlc:\program files (x86)\StartNow Toolbar\Resources\protect\NotIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\OnlyIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\SearchProtectIcon.pngc:\program files (x86)\StartNow Toolbar\Resources\protect\window.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\window.jsc:\program files (x86)\StartNow Toolbar\Resources\reactivate\index.htmlc:\program files (x86)\StartNow Toolbar\Resources\reactivate\LeftImage.pngc:\program files (x86)\StartNow Toolbar\Resources\reactivate\NotIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\OnlyIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.jsc:\program files (x86)\StartNow Toolbar\Resources\skin\chevron_button.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_hover.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_normal.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_background.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_left.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_middle.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\separator.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\splitter.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.pngc:\program files (x86)\StartNow Toolbar\Resources\toolbar.xmlc:\program files (x86)\StartNow Toolbar\Resources\update.xmlc:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exec:\program files (x86)\StartNow Toolbar\ToOLbar32.dllc:\program files (x86)\StartNow Toolbar\ToolbarUpdaterService.exec:\program files (x86)\StartNow Toolbar\uninstall.datc:\programdata\Roamingc:\users\db2admin\AppData\Roaming\Mozilla\Firefox\Profiles\tr710st5.default\extensions\{35e960ea-5cf9-4dc3-9252-bf467267adc1}c:\users\db2admin\AppData\Roaming\Mozilla\Firefox\Profiles\tr710st5.default\extensions\{35e960ea-5cf9-4dc3-9252-bf467267adc1}\chrome.manifestc:\users\db2admin\AppData\Roaming\Mozilla\Firefox\Profiles\tr710st5.default\extensions\{35e960ea-5cf9-4dc3-9252-bf467267adc1}\chrome\xulcache.jarc:\users\db2admin\AppData\Roaming\Mozilla\Firefox\Profiles\tr710st5.default\extensions\{35e960ea-5cf9-4dc3-9252-bf467267adc1}\defaults\preferences\xulcache.jsc:\users\db2admin\AppData\Roaming\Mozilla\Firefox\Profiles\tr710st5.default\extensions\{35e960ea-5cf9-4dc3-9252-bf467267adc1}\install.rdfc:\users\VNKT\AppData\Local\Temp\1.tmp\F_IN_BOX.dllc:\users\VNKT\g2mdlhlpx.exec:\windows\dasetup.logc:\windows\svchost.exec:\windows\system32\drivers\etc\lmhostsc:\windows\system32\java.exe..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_Updater Service for StartNow Toolbar-------\Service_Updater Service for StartNow Toolbar..((((((((((((((((((((((((( Files Created from 2012-01-02 to 2012-02-02 )))))))))))))))))))))))))))))))..2012-02-02 04:23 . 2012-02-02 04:23 -------- d-----w- c:\users\Default\AppData\Local\temp2012-02-02 04:23 . 2012-02-02 04:23 -------- d-----w- c:\users\db2admin\AppData\Local\temp2012-02-01 05:31 . 2012-02-01 05:31 -------- d-----w- C:\TDSSKiller_Quarantine2012-01-31 03:06 . 2012-01-31 03:06 -------- d-----w- c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}2012-01-31 01:01 . 2012-01-31 01:01 6656 ----a-w- c:\programdata\Microsoft\Windows\DRM\1D28.tmp2012-01-31 01:01 . 2012-01-31 01:01 6656 ----a-w- c:\programdata\Microsoft\Windows\DRM\1CF8.tmp2012-01-11 15:23 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll2012-01-11 15:23 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll2012-01-11 15:23 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll2012-01-11 15:23 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll2012-01-11 15:23 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll2012-01-11 15:23 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll2012-01-11 15:23 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll2012-01-11 15:23 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll2012-01-07 19:50 . 2012-01-07 19:50 -------- d-----w- c:\users\VNKT\soapUI-Tutorials2012-01-07 19:50 . 2012-01-07 19:50 -------- d-----w- c:\program files (x86)\SmartBear...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-12-16 00:56 . 2011-12-16 00:56 61440 ----a-r- c:\users\VNKT\AppData\Roaming\Microsoft\Installer\{044C5CF5-50FD-48C2-8248-36D7C5B4C196}\NewShortcut1_5BF2144E45854D6EBB4CD940DC97BA80.exe2011-12-15 04:39 . 2011-12-15 04:39 45056 ----a-r- c:\users\VNKT\AppData\Roaming\Microsoft\Installer\{1D243F00-1389-4C63-A7E9-B17E967D1901}\NewShortcut89_1D243F0013894C63A7E9B17E967D1901.exe2011-12-15 04:39 . 2011-12-15 04:39 45056 ----a-r- c:\users\VNKT\AppData\Roaming\Microsoft\Installer\{1D243F00-1389-4C63-A7E9-B17E967D1901}\NewShortcut84_1D243F0013894C63A7E9B17E967D1901.exe2011-12-15 04:39 . 2011-12-15 04:39 45056 ----a-r- c:\users\VNKT\AppData\Roaming\Microsoft\Installer\{1D243F00-1389-4C63-A7E9-B17E967D1901}\NewShortcut83_1D243F0013894C63A7E9B17E967D1901.exe2011-12-15 04:39 . 2011-12-15 04:39 45056 ----a-r- c:\users\VNKT\AppData\Roaming\Microsoft\Installer\{1D243F00-1389-4C63-A7E9-B17E967D1901}\NewShortcut80_1D243F0013894C63A7E9B17E967D1901.exe2011-12-10 20:24 . 2011-01-22 02:31 23152 ----a-w- c:\windows\system32\drivers\mbam.sys2011-12-08 12:56 . 2011-12-08 12:56 485576 ----a-w- c:\users\VNKT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe2011-12-07 12:34 . 2011-05-19 11:19 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2011-11-24 04:52 . 2011-12-14 18:58 3145216 ----a-w- c:\windows\system32\win32k.sys2011-11-10 01:40 . 2011-11-10 01:40 20480 ----a-w- c:\windows\SysWow64\cliconfg.7282011-11-05 05:32 . 2011-12-14 18:58 2048 ----a-w- c:\windows\system32\tzres.dll2011-11-05 04:26 . 2011-12-14 18:58 2048 ----a-w- c:\windows\SysWow64\tzres.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"HPAdvisorDock"="c:\program files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe" [2010-02-10 1712184]"googletalk"="c:\users\VNKT\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]"Facebook Update"="c:\users\VNKT\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-09-18 137536]"VeohPlugin"="c:\program files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2011-11-28 4692296].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-25 401192]"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-25 201512]"VitaKeyTSR"="c:\program files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisTSR.exe" [2010-06-09 380272]"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-12 288088]"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2010-12-09 74752]"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2011-09-29 646232]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-27 648032]"GIDDesktop"="c:\program files (x86)\SFT\GuardedID\gidd.exe" [2011-07-05 395528]"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-06-14 587320]"InstaLAN"="c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736].c:\users\VNKT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2011-11-16 576000].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-9 1128224]Constant Guard.lnk - c:\program files (x86)\Constant Guard Protection Suite\IDVault.exe [2012-1-31 4720200]LoadRunner Agent Process.lnk - c:\program files (x86)\HP\LoadRunner\launch_service\bin\magentproc.exe [2010-8-18 34104]McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]Service Manager.lnk - c:\program files (x86)\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"EnableShellExecuteHooks"= 1 (0x1).[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]"EnableShellExecuteHooks"= 1 (0x1).[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{A5949E07-8536-4625-A3D0-2DD83F559990}"= "c:\windows\SysWOW64\ShellHook.dll" [2010-08-02 147456].[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R2 JoinMEPlayUI Assistant Service;JoinMEPlayUI Assistant Service;c:\program files (x86)\JoinME Drivers\JoinMEPlayAssistantServices.exe [2010-05-20 242176]R2 McNASvc32;McAfee Network Agent ;c:\windows\system32\dmband32.exe [x]R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]R3 DB2GOVERNOR_DB2COPY1;DB2 Governor (DB2COPY1);c:\program files\IBM\SQLLIB\BIN\db2govds.exe [2010-05-17 26472]R3 DB2LICD_DB2COPY1;DB2 License Server (DB2COPY1);c:\program files\IBM\SQLLIB\BIN\db2licd.exe [2010-05-17 161640]R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]R3 massfilter_hs;ZTE HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [x]R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-10-19 340240]R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe [x]R3 ServiceEmulation;HP ServiceEmulation;c:\program files (x86)\HP\LoadRunner\apache-tomcat-5.5.17\bin\tomcat5.exe [2009-06-25 102400]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]R3 zgwhsdiag;ZTE WCDMA Handset Diagnostic Port;c:\windows\system32\DRIVERS\zgwhsdiag.sys [x]R3 zgwhsmdm;ZTE WCDMA Handset USB Modem;c:\windows\system32\DRIVERS\zgwhsmdm.sys [x]R3 zgwhsnmea;WCDMA Handset NMEA Port;c:\windows\system32\DRIVERS\zgwhsnmea.sys [x]R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 59744]R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys [x]R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-04-24 428384]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0501000.01D\SYMDS64.SYS [x]S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0501000.01D\SYMEFA64.SYS [x]S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120121.002\BHDrvx64.sys [2011-12-01 1157240]S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys [x]S1 GIDv2;GIDv2; [x]S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120201.002\IDSvia64.sys [2011-12-15 488568]S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0501000.01D\Ironx64.SYS [x]S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0501000.01D\SYMNETS.SYS [x]S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-03-21 89600]S2 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2010-02-17 181760]S2 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2010-02-09 55296]S2 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-06-13 400368]S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]S2 DB2MGMTSVC_DB2COPY1;DB2 Management Service (DB2COPY1);c:\program files\IBM\SQLLIB\BIN\db2mgmtsvc.exe [2010-05-17 40808]S2 DB2REMOTECMD_DB2COPY1;DB2 Remote Command Server (DB2COPY1);c:\program files\IBM\SQLLIB\BIN\db2rcmd.exe [2010-05-17 42856]S2 DCService.exe;DCService.exe;c:\programdata\DatacardService\DCService.exe [2010-05-08 229376]S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-06-25 338168]S2 EgisTec Service;EgisTec Service;c:\program files (x86)\Hewlett-Packard\HP SimplePass Identity Protection\EgisService.exe [2010-06-09 697712]S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-06-09 646000]S2 Giraffic;Veoh Giraffic Video Accelerator;c:\program files (x86)\Giraffic\Veoh_GirafficWatchdog.exe [2012-01-22 2230416]S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992]S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992]S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-06-14 26680]S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]S2 IDVaultSvc;CGPS Service;c:\program files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2012-01-31 65096]S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe [2011-04-17 130008]S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-04-15 2533400]S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176]S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-11-09 138360]S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]S3 sxuptp;SXUPTP Driver;c:\windows\system32\DRIVERS\sxuptp.sys [x]S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]..[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{9191979D-821C-4EA8-B021-2DA1D859A7C5}-3Reg]2011-07-05 14:26 435976 ----a-w- c:\program files (x86)\SFT\GuardedID\GIDI.exe.Contents of the 'Scheduled Tasks' folder.2012-02-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-466732330-115222161-653102404-1001Core.job- c:\users\VNKT\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-18 17:47].2012-02-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-466732330-115222161-653102404-1001UA.job- c:\users\VNKT\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-18 17:47].2012-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-466732330-115222161-653102404-1001Core.job- c:\users\VNKT\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-11 17:37].2012-02-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-466732330-115222161-653102404-1001UA.job- c:\users\VNKT\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-11 17:37].2012-01-31 c:\windows\Tasks\HPCeeScheduleForVNKT.job- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15]..--------- x86-64 -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-06-26 324096]"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-01-20 611896]"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-10-19 1931024]"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-21 525312]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]"DB2COPY1 - db2systray.exe DB2"="c:\progra~1\IBM\SQLLIB\BIN\db2systray.exe" [2010-05-17 119144]"combofix"="c:\combofix\CF21939.3XE" [2010-11-20 345088].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"LoadAppInit_DLLs"=0x0.------- Supplementary Scan -------.uStart Page = hxxp://google.com/uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localIE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htmIE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htmTCP: Interfaces\{88E59CA2-C93D-47D2-99F3-10759D14A018}: NameServer = 0.0.0.0FF - ProfilePath - c:\users\VNKT\AppData\Roaming\Mozilla\Firefox\Profiles\a3yspyxg.default\FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=FF - prefs.js: network.proxy.type - 0.- - - - ORPHANS REMOVED - - - -.Wow6432Node-HKLM-Run-StartNowToolbarHelper - c:\program files (x86)\StartNow Toolbar\ToolbarHelper.exeHKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-StartNow Toolbar - c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exeAddRemove-_{53A908D4-99C6-469B-BC13-F4189F260742} - c:\program files (x86)\Corel\Corel Painter Essentials 4\MSILauncher {53A908D4-99C6-469B-BC13-F4189F260742}AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\5.1.0.29\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.10".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Belkin\Router Setup and Monitor\BelkinService.exec:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\windows\system32\crypserv.exec:\program files (x86)\Mercury\Quality Center\msdeBinn\MSSQL\Binn\sqlservr.exec:\program files (x86)\Giraffic\Veoh_Giraffic.exec:\program files (x86)\Microsoft\BingBar\SeaPort.EXEc:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exec:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exec:\program files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe.**************************************************************************.Completion time: 2012-02-02 07:44:06 - machine was rebootedComboFix-quarantined-files.txt 2012-02-02 12:43.Pre-Run: 303,644,925,952 bytes freePost-Run: 303,457,058,816 bytes free.- - End Of File - - 0C43E181888FB73948833AF5F9F18E3D Link to post Share on other sites More sharing options...
exile360 Posted February 3, 2012 ID:523113 Share Posted February 3, 2012 Greetings We don't work on malware removal in this part of the forums.Please read and follow the directions here, skipping any steps you are unable to complete. Then create a NEW topic here.One of the expert helpers there will give you one on one assistance when one becomes available.Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.If you prefer to be assisted via email you may contact Consumer Support and one of our support staff members will assist you directly.If you are a reseller, affiliate, technician, corporate, business, educational, government or non-profit customer then please contact Corporate Support and include full contact details along with your Reference # when you do to ensure that you receive prompt assistance.Thank you Link to post Share on other sites More sharing options...
Recommended Posts